NIS2 Medical Device Manufacturers: Who Is Essential, Who Is Important

A client sends you their ISO 13485 certificate and asks, "So we are covered, right?" They are an in vitro diagnostics manufacturer with 180 staff. The certificate says nothing about NIS2.

Product regulation and organisational cybersecurity are different regimes. MDR and IVDR govern the device. NIS2 governs the company that makes it. If you advise NIS2 medical device manufacturers, you need to know which annex each client sits in, because that decides the supervision model, the fine ceiling and the audit pressure.

Pharma and medical devices sit in two different annexes

NIS2 (Directive (EU) 2022/2555) places life-sciences entities in two places.

Annex I, sector 5 (Health) covers, among others:

• manufacturers of basic pharmaceutical products and pharmaceutical preparations;
• entities carrying out research and development of medicinal products;
• EU reference laboratories;
• manufacturers of medical devices considered critical during a public health emergency, meaning devices on the list established under Article 22 of Regulation (EU) 2022/123.

Annex II, sector 5 (manufacture of certain critical products) covers manufacturers of medical devices and in vitro diagnostic medical devices that are not on that emergency list.

The split matters. Annex I entities are "sectors of high criticality". Annex II entities fall under "other critical sectors".

Essential or important: the size test decides

Under Article 3, a large entity in an Annex I sector is an essential entity. A medium-sized entity in an Annex I sector is an important entity. Every in-scope entity in an Annex II sector is important.

In practice:

Client	Annex	Typical classification
Large pharmaceutical manufacturer	I	Essential
Medium-sized medicinal product R&D company	I	Important
Manufacturer of devices on the emergency list, large	I	Essential
Medium-sized IVD manufacturer	II	Important
Large general medical device manufacturer	II	Important

Size comes from Recommendation 2003/361/EC: medium-sized means at least 50 staff or more than EUR 10 million turnover or balance sheet. Small and micro companies are generally out, with narrow exceptions member states can apply for entities with a key societal role.

Do not assume a device maker is Annex I. Most are not. The emergency list only becomes relevant once a public health emergency has been recognised, and Annex II is where the typical client lands.

Why the label changes your engagement

Both categories carry the same Article 21 risk-management duties and the same Article 23 reporting duties. What differs is supervision and fines.

Essential entities face proactive supervision: on-site inspections, security audits and regular checks. Important entities face reactive supervision, which means the regulator moves when there is evidence of a problem. Fines under Article 34 reach EUR 10 million or 2% of worldwide turnover for essential entities, and EUR 7 million or 1.4% for important entities.

A reactive regime is not a relaxed one. When a manufacturer of a connected infusion pump suffers a ransomware incident, "important" stops being a comfort quickly.

What an audit will find in a life-sciences client

Manufacturers have a recognisable pattern of gaps. Quality systems are mature. Security governance usually is not.

OT and lab networks. Production lines, cleanrooms and lab instruments run on legacy systems that cannot be patched on the IT schedule. Segmentation is the realistic control. See NIS2 for Manufacturers: The IT/OT Boundary.

Validated systems. Computerised system validation freezes software versions. Teams treat that as a reason not to patch. NIS2 wants a documented vulnerability handling process and compensating controls, not silence.

Supplier risk. Contract manufacturers, CROs, cloud-hosted LIMS and software suppliers are all supply chain under Article 21(2)(d). A quality agreement is not a security assessment.

Management accountability. Article 20 makes the management body responsible for approving and overseeing the measures. Quality managers cannot sign that off on the board's behalf.

Product security versus corporate security. MDR and IVDR expectations on device cybersecurity cover the product lifecycle. They do not give you an incident process for the company network, a registration, or a 24-hour early warning.

Reporting runs next to your existing vigilance duties

A significant incident triggers an Article 23 early warning within 24 hours, an incident notification within 72 hours and a final report within one month. Those clocks are separate from medical device vigilance reporting. One event can start both.

Build one incident playbook that names who decides what counts as significant, who files with the CSIRT or competent authority, and who files vigilance reports. Test it once. Read the full deadline logic in NIS2 Incident Reporting: The 24-Hour, 72-Hour and 1-Month Deadlines.

Where national law is in force

NIS2 reaches your client through national law, and member states are at different stages. Germany, Italy, Poland and the Netherlands have laws in force. France and Spain have not transposed and the Commission referred both to the Court of Justice in July 2026. A manufacturer with plants in several countries can sit under several regimes at once, with different regulators and registration portals.

Your job is to confirm, per legal entity, which law applies and which authority supervises. Our guide to Article 26 jurisdiction explains the main establishment rules.

What to do this month

1. List the legal entities. NIS2 applies per entity, not per group brand.
2. Classify each against Annex I and Annex II, then apply the size test.
3. Check whether any product is on the emergency device list.
4. Confirm registration status in each country where the entity operates.
5. Map the gaps against the ten Article 21 measures, starting with supply chain and vulnerability handling.

If you need a fast, defensible starting point for a life-sciences client, run a readiness assessment first. Start a free NIS2 Quick Scan and you will have a gap analysis you can put in front of their board.

Sort the client, find the gaps, and fix supply chain and vulnerability handling first. That is where manufacturers lose the most audit points.