Essential entity / important entity (NIS2)

The NIS2 Directive distinguishes two categories of regulated parties, according to their size, sector and degree of criticality for the economy and society. Essential entities are generally large enterprises in the most sensitive sectors, such as energy, transport, health, water, public administration and digital infrastructure. They are subject to ex-ante supervision, that is, proactive and ongoing oversight by the national competent authority, which may initiate audits even in the absence of an incident. Important entities, of intermediate size or in less critical sectors, are controlled only ex post, in response to an incident or a suspicion of breach. Both categories nonetheless share the same substantive baseline of obligations derived from Article 21, covering risk management, supply chain security, strong authentication, business continuity and encryption. The sanctions regime differs, however: essential entities may face fines of up to ten million euros or 2 per cent of worldwide turnover, against seven million euros or 1.4 per cent for important entities. This distinction is directly operational for insurers, who incorporate it into their cyber and D&O underwriting questionnaires and pricing.

A French metropolitan authority, as a public-administration entity, is designated an essential entity by ANSSI. A mid-sized regional hospital is designated an important entity. Their shared insurer adjusts their cyber policies accordingly, requiring the metropolitan authority to provide proof of a validated NIS2 compliance plan and an audit conducted within the past twelve months, while for the hospital a simplified declaratory questionnaire suffices at underwriting. The deductibles and sub-limits applied reflect the difference in regulatory exposure between the two entities.

entité essentielle, entité importante, essential entity, important entity, OIV NIS2