NIS2 Food Sector: Which Manufacturers and Distributors Are in Scope

A 60-person cheese producer runs its packing line on a PLC nobody has patched since installation. Cold-store temperatures stream to a cloud dashboard. Two supermarket chains send orders over EDI. Ask the owner whether NIS2 applies and you will usually hear: "We make food. We are not a bank."

That answer is wrong more often than it is right. The NIS2 food sector entry in Annex II covers industrial food production, processing and wholesale distribution. If your client sits there and passes the size test, it is an in-scope important entity, with a regulator, a register and a management body that answers for the result.

The NIS2 food sector entry: who it actually covers

Annex II of Directive (EU) 2022/2555 lists "production, processing and distribution of food" as one of the other critical sectors. The entities named are food businesses, as defined in Article 3(2) of Regulation (EC) No 178/2002, that are engaged in wholesale distribution and industrial production and processing.

Three things fall outside that wording unless a member state has designated them as critical under the CER Directive: primary production (farms), retail (shops), and food service (restaurants and caterers). The Finnish Food Authority states this explicitly in its guidance for the sector.

Food is an Annex II sector, so in-scope companies are important entities, not essential ones. That has a practical meaning: supervision is reactive rather than proactive. A regulator acts after evidence of non-compliance, such as an incident, a complaint or an unregistered company found through a sector list.

Size is the second gate. As a working rule, the company must be at least medium-sized: 50 or more employees, or annual turnover and balance sheet total both above EUR 10 million.

Three edge cases that decide scope

The producer with its own shops. A bakery that produces industrially and also runs twelve retail outlets is in scope for the production side. The activity puts the entity in the sector; the size test is applied to the entity as a whole. Do not let a client argue itself out because "most of our revenue is retail" without reading the national text.

The subsidiary of a larger group. Size is measured under Commission Recommendation 2003/361/EC, which counts linked and partner enterprises. A 30-person packing subsidiary of a 400-person group can land in medium or large territory. Ask for the group structure before you accept "we are too small."

The wholesaler and the co-packer. Wholesale distribution is named in the text. An ingredient wholesaler or a contract co-packer supplying branded manufacturers is not a bystander to this sector. It is inside it.

If a client is unsure, our guide on whether NIS2 applies to your organisation walks through the general test.

What important-entity status means in practice

Important entities owe the same Article 21 risk-management measures as essential ones. The difference lies in supervision and penalties, not in the duty itself.

• Management body accountability. Article 20 requires the management body to approve the measures and oversee them. In a family-owned food group that is the owner-manager, not the IT contractor.
• Incident reporting. A significant incident triggers an early warning within 24 hours, a notification within 72 hours and a final report within one month. See the incident reporting deadlines for the mechanics.
• Fines. For important entities the ceiling is EUR 7 million or 1.4% of worldwide annual turnover, whichever is higher, set in Article 34.
• Registration. Nearly every member state requires in-scope companies to register with a national authority. Registration is binary and timestamped, which makes it the easiest thing for a regulator to check. Our registration overview lists the portals.

Where food companies fail: the OT floor and the cold chain

A food plant is an operational technology environment with a canteen-grade IT network wrapped around it. That is where audits find gaps.

The systems that matter are the ones that stop production or spoil product: PLCs and SCADA on filling and packing lines, MES for batch tracking, cold-chain monitoring for temperature and humidity, laboratory systems (LIMS) that release batches, and the ERP that drives orders. Compromise any of them and the plant stops, or worse, ships product whose safety records cannot be trusted.

Four measures carry most of the weight:

1. Segmentation between office IT and production. The pattern in our manufacturing OT/IT segmentation guide applies directly: a flat network turns a phishing email into a stopped line.
2. Remote access with strong authentication. Machine vendors often keep standing remote access to PLCs. Every such path is a supplier access route under Article 21(2)(d).
3. Backups you can restore, including PLC programs and recipes. Article 21(2)(c) is about restoring operations. A backup of the file server that omits the line controller configuration does not restore a plant.
4. Integrity of food-safety records. Cold-chain logs and batch release data are evidence for both the food safety authority and the NIS2 regulator. Protect them accordingly.

Supply chain security cuts both ways. The retailers buying from your client will start asking for proof, and supplier contracts are already part of NIS2 compliance.

The same sector, different starting points across the EU

The directive is one text; the obligations depend on national law. Where things stand as checked in September 2026:

• Finland. The Cybersecurity Act 124/2025 has applied since 8 April 2025. The Finnish Food Authority supervises food companies, and its registration deadline was 8 May 2025.
• Germany. The NIS2 implementation act amended the BSIG. Food producers of medium size are important entities under section 28(2), and the BSI runs the register. A food company can become a particularly important entity only through critical-infrastructure thresholds.
• Netherlands. The Cyberbeveiligingswet has applied since 15 August 2026. Registration runs through the NCSC.
• Poland. The amended KSC lists food production, processing and distribution as an important sector. The Minister for Digital Affairs keeps the register.
• Italy. Legislative Decree 138/2024 has been in force since October 2024, and the ACN sets the phased deadlines.
• France. No transposition law yet. A resilience bill is still moving through parliament, while ANSSI has published its ReCyF framework.
• Spain. Not transposed, and referred to the Court of Justice in July 2026.

What to do with a food client this month

Run the scope test first, in writing: activity, entity size including group, and country. Record the answer even when it is "out of scope," because a regulator will ask how you decided.

If the client is in scope, check registration before anything else, then inventory the OT assets that stop production. Map who has remote access, test one restore of a line controller, and write down the 24-hour reporting path with a named person.

A readiness assessment shows the gaps against Article 21 in a structured format, and you can start one with the NIS2Certify quick scan. Food companies rarely lack effort. They lack a documented picture of which systems matter, and that is the first thing a supervisor asks to see.