NIS2 Chemical Sector: Who Is in Scope Under Annex II and REACH

A mid-sized adhesives producer in Antwerp buys its solvents in bulk, runs a dosing line on a PLC, and has never thought of itself as an IT-regulated business. Then its biggest customer sends a supplier questionnaire with one line: "Confirm your NIS2 status." Nobody on the plant floor knows the answer.

That scenario is playing out across the NIS2 chemical sector. Chemicals are an "other critical sector" in Annex II of Directive (EU) 2022/2555, and the wording is wider than most clients expect.

What Annex II item 3 actually covers

Annex II lists seven sectors. Item 3 is "Manufacture, production and distribution of chemicals". The text points to REACH (Regulation (EC) No 1907/2006) and captures:

• undertakings carrying out the manufacture of substances (REACH Article 3, point 9);
• undertakings carrying out the distribution of substances or mixtures (REACH Article 3, point 14);
• undertakings producing articles from substances or mixtures (REACH Article 3, point 3).

Two groups are not named: importers and downstream users as such. A company that only imports a substance is not captured by this entry. A formulator is a downstream user under REACH, but the Annex II wording on distributing substances or mixtures and on producing articles can still catch it. Do not rule a blender out on REACH labels alone.

The third bullet is where scope creeps. German industry lawyers have pointed out that "producing articles" can pull in manufacturers far outside what anyone calls the chemical industry. A plant that makes plastic parts or coated metal goods may qualify under item 3 and under the Annex II "Manufacturing" sector at the same time. Check both entries before telling a client they are out.

Size decides whether the directive applies at all

NIS2 applies to medium-sized and larger entities in the listed sectors (Article 2(1)). Medium-sized means at least 50 staff, or turnover and balance sheet total both above €10 million. A 30-person specialty blender with €6 million turnover falls below the cap, unless a Member State has chosen to include smaller entities that play a key role for society or the economy (Article 2(2)).

Annex II entities are important entities by default. They become essential only if they meet one of the other criteria in Article 3, for example by also being a designated critical entity or a qualifying provider in an Annex I sector.

Why chemical clients are harder than they look

Chemical producers sit on the IT/OT boundary. Dosing, batching, tank-level monitoring and safety instrumented systems are all networked. Our guide to IT/OT segmentation for manufacturers covers the architecture. For chemicals, three points deserve extra attention in a gap analysis:

1. Asset inventory that includes OT. If the register stops at laptops and servers, Article 21(2)(i) is not met.
2. Incident handling that includes process impact. A ransomware event that stops a batch process is a significant incident with consequences beyond data.
3. Supply chain security. Article 21(2)(d) requires attention to direct suppliers and service providers. Chemical firms depend on logistics platforms, hosted ERP and remote vendor access to equipment. See supplier contracts under Article 21.

Distributors have a different profile. Their exposure is mostly ERP, order portals and warehouse systems. The measures are the same ten under Article 21(2), applied to a smaller attack surface.

What the penalties look like

For important entities, the maximum administrative fine under Article 34(5) is the higher of €7 million or 1.4% of total worldwide annual turnover. Essential entities face up to €10 million or 2%. Our piece on NIS2 fines and board exposure explains how national regimes apply those ceilings.

Where the national law stands

The directive is implemented country by country, and the status differs sharply:

• Germany: the NIS2 implementation act amending the BSIG took effect on 6 December 2025 with no transition period. Chemical manufacturers appear in Annex 2 of the BSIG and must register with the BSI.
• Netherlands: the Cyberbeveiligingswet has applied since 15 August 2026, with registration in the national entity register run by the NCSC.
• Italy: Legislative Decree 138/2024 has applied since 16 October 2024. ACN expects baseline security measures to be operational by October 2026 and is moving from guidance to verification.
• Poland: the amended KSC Act took effect on 3 April 2026 and added chemical manufacturing to the covered sectors.
• France and Spain: neither has completed transposition. Both have been referred to the Court of Justice. The directive does not bind a private company directly, but customers in transposed countries pass the requirements down through contracts.

For the wider picture, see the EU implementation timeline.

How to scope a chemical client in an hour

Work through four questions in this order:

1. Which REACH role does the client hold for each product line: manufacturer, distributor, article producer, importer only, or downstream user?
2. Which Member States does it operate in? Each national law sets its own registration and reporting rules.
3. Does it cross the medium-size threshold, or does a national rule capture it anyway?
4. Which OT systems influence production or safety, and who has remote access to them?

Start with question one. Most scoping errors come from assuming "we only blend" means "we are out". Test that claim against the Annex II wording and the national law before you accept it.

If you want a structured starting point, run the client through the free NIS2Certify quick scan. It produces a readiness assessment you can use to open the conversation.

The takeaway: do not rely on the sector name. Scope follows the REACH role, the size and the country, in that order.