NIS2 Online Marketplaces: Is Your E-Commerce Client in Scope?

A 70-person company in Utrecht runs a platform where hobbyists sell vintage camera parts to each other. Buyers pay through the site, sellers ship directly, and your MSP hosts the stack. Ask the founder whether NIS2 applies and you will hear: "We are a small web shop. That is retail, not critical infrastructure."

Under the directive, that answer can be wrong. A platform that lets buyers conclude contracts with third-party sellers is an NIS2 online marketplace, and digital providers of that kind sit in Annex II with their own jurisdiction rule, their own registry duty and their own incident thresholds. Here is how to test it for a client, and what the test changes.

NIS2 online marketplaces: what the directive actually covers

Annex II of the directive lists "digital providers" as a sector. Three types matter here: providers of online marketplaces, providers of online search engines, and providers of social networking services platforms. They are treated as important entities, not essential ones, so supervision is mainly reactive. That does not make them optional. The Article 21 risk-management measures and Article 23 incident reporting apply in full.

The Commission added detail in Implementing Regulation (EU) 2024/2690, in force since 7 November 2024. Article 1 names marketplaces, search engines and social networks among the ten entity types it covers. It sets the technical and methodological requirements for the Article 21(2) measures and specifies when an incident counts as significant.

If you already read our guide on digital infrastructure and the 30-minute incident rule, note the difference. The strict time-based triggers there belong to DNS, cloud and similar providers. Marketplaces, search engines and social networks have user-based triggers instead.

The three definitions that decide scope

Scope turns on Article 6, not on how the client describes itself.

An online marketplace is defined by reference to Directive 2005/29/EC, Article 2(n). In plain terms: a service, run by or for a trader, that allows consumers to conclude distance contracts with other traders or consumers. A shop that sells only its own stock does not meet that test. A platform where third parties list and sell does.

An online search engine is defined by reference to Regulation (EU) 2019/1150, Article 2(5). A site search box does not qualify. A service that searches across websites does.

A social networking services platform is defined in Article 6 itself: a platform that enables end-users to connect, share, discover and communicate with each other across multiple devices, in particular via chats, posts, videos and recommendations. Community features bolted onto a product usually fall short. A product whose main purpose is that interaction does not.

Borderline cases are common: a niche forum with paid listings, a B2B ordering portal where distributors resell, an app with a messaging layer. Write down the reasoning for each client. A documented "out of scope because X" is worth more in an audit than an undocumented assumption.

Size and classification: the test most clients skip

The size rule still applies. A provider must be at least medium-sized: 50 or more staff, or annual turnover and balance sheet both above €10 million. Our 70-person Utrecht platform passes. A 12-person startup running the same service does not.

Passing the size test makes the client an important entity under Annex II. In practice that means fines of up to €7 million or 1.4% of worldwide annual turnover, whichever is higher, under the directive's ceiling for important entities, and a management body that carries the responsibility. For the wider scoping logic, see Does NIS2 apply to my organisation?.

One regulator for the whole EU: Article 26

Most sectors fall under the country where they operate. Marketplaces, search engines and social networks follow a different rule. Under Article 26(1)(b), they fall under the Member State where they have their main establishment in the Union.

Article 26(2) defines that as the Member State where decisions on cybersecurity risk-management measures are predominantly taken. If that cannot be determined, it is where cybersecurity operations are carried out. If that fails too, it is the Member State with the establishment that has the most employees.

This matters for your MSP clients. A platform run from Utrecht but selling in Germany, France and Poland answers to one national authority, not four. And under Article 26(3), a provider established outside the EU that offers services inside it must designate a representative in a Member State where it offers services. The Member State of that representative gets jurisdiction. Our post on which regulator supervises your client walks through the cascade in detail.

Registration under Article 27: a duty that does not wait for audits

Article 27 requires these providers to submit identifying data for the registry that ENISA maintains. The list is specific: entity name, sector and type under Annex II, the address of the main establishment and other EU establishments (or the representative), current contact details, the Member States where services are offered, and the entity's IP ranges.

The first submission was due by 17 January 2025. Any change must be reported without delay and in any event within three months. IP ranges are the item clients forget. They change whenever a CDN or hosting arrangement changes, and nobody tells the compliance owner.

National registers add their own portals and dates. Germany's registration backlog shows what happens when nobody owns the task.

Incident thresholds: 5% of users or 1 million

For marketplaces, search engines and social networks, the Implementing Regulation sets user-based triggers in Articles 11, 12 and 13. An incident is significant if the service is completely unavailable for, or has limited availability for, more than 5% of its users in the Union or more than 1 million users, whichever is smaller. A data compromise affecting that many users also qualifies.

A suspected malicious compromise of data integrity, confidentiality or authenticity is significant regardless of user count. Article 3 adds general triggers that apply to everyone, including direct financial loss above €500,000 or 5% of annual turnover, whichever is lower.

Take a marketplace with 400,000 EU users. Five percent is 20,000. An outage hitting 20,000 users, or a credential leak affecting 20,000 accounts, is significant. Many teams assume the one-million figure is the bar. For small and mid-sized platforms, the percentage is the bar.

Once an incident is significant, the three-step Article 23 sequence applies. The reporting deadlines are 24 hours for the early warning, 72 hours for the incident notification, and one month for the final report.

Where the supervisor stands in October 2026

Your client's obligations depend on how its main-establishment country transposed the directive. The picture is uneven: some Member States are fully live, others are still legislating. France and Spain face Court of Justice proceedings for non-transposition. See the implementation timeline for the full list.

What to check this month

For each platform client, work through five questions. Does the service meet one of the three Article 6 definitions? Does the client pass the size test? Where are cybersecurity decisions predominantly taken, so which regulator applies? Is the client in the national register and the Article 27 data current, including IP ranges? And has anyone checked the user counts against the 5% and 1 million triggers?

Most clients can answer the first two in an afternoon. The last three expose the real gaps. If you want a structured starting point, run a free NIS2 readiness scan and use the output as the baseline for the client conversation.