EUROPEAN

COMMISSION

Brussels, 16.12.2020
COM(2020) 823 final

ANNEXES 1 to 3

ANNEXES

to the

Proposal for a

DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

on measures for a high common level of cybersecurity across the Union, repealing
Directive 2016/1148

{SEC(2020) 430 final} - {SWD(2020) 344 final} - {SWD(2020) 345 final}

EN EN
 ANNEX I

ESSENTIAL ENTITIES:

SECTORS, SUBSECTORS AND TYPES OF ENTITIES

Sector Subsector Type of entity

1. Energy (a) Electricity — Electricity undertakings referred to

in point (57) of Article 2 of
Directive (EU) 2019/944, which
carry out the function of ‘supply’
referred to in point (12) of Article 2
of that Directive (1)

— Distribution system operators

referred to in point (29) of Article 2
of Directive (EU) 2019/944

— Transmission system operators

referred to in point (35) of Article 2
of Directive (EU) 2019/944

— Producers referred to in point (38)

of Article 2 of Directive (EU)
2019/944

 Nominated electricity market

operators referred to in point 8 of
Article 2 of Regulation (EU)
2019/943 (2)

— Electricity market participants

referred to in point (25) of Article 2
of Regulation (EU) 2019/943
providing aggregation, demand
response or energy storage services
referred to in points (18), (20) and
(59) of Article 2 of Directive (EU)

1
Directive (EU) 2019/944 of the European Parliament and of the Council of 5 June 2019 on common rules for
the internal market for electricity and amending Directive 2012/27/EU (OJ L 158, 14.6.2019, p.125).
2
Regulation (EU) 2019/943 of the European Parliament and of the Council on the internal market for electricity
(OJ L 158, 14.6.2019, p. 54).

1
 2019/944

(b) District heating and — District heating or district cooling

cooling referred to in point (19) of Article 2
of the Directive (EU) 2018/2001 (3)
on the promotion of the use of
energy from renewable sources

(c) Oil — Operators of oil transmission

pipelines

— Operators of oil production, refining

and treatment facilities, storage and
transmission

 Central oil stockholding entities

referred to in point (f) of Article 2 of
Council Directive 2009/119/EC (4)

(d) Gas — Supply undertakings referred to in

point (8) of Article 2 of Directive
(EU) 2009/73/EC (5)

— Distribution system operators

referred to in point (6) of Article 2
of Directive 2009/73/EC

— Transmission system operators

referred to point (4) of Article 2 of
Directive 2009/73/EC

— Storage system operators referred to

in point (10) of Article 2 of
Directive 2009/73/EC

— LNG system operators referred to in

point (12) of Article 2 of Directive
2009/73/EC

3
Directive (EU) 2018/2001 of the European Parliament and of the Council of 11 December 2018 on the
promotion of the use of energy from renewable sources (OJ L 328, 21.12.2018, p. 82).
4
Council Directive 2009/119/EC of 14 September 2009 imposing an obligation on Member States to maintain
minimum stocks of crude oil and/or petroleum products (OJ L 265, 9.10.2009, p.9).
5
Directive 2009/73/EC of the European Parliament and of the Council of 13 July 2009 concerning common
rules for the internal market in natural gas and repealing Directive 2003/55/EC (OJ L 211, 14.8.2009, p. 94).

2
 — Natural gas undertakings as defined
in point (1) of Article 2 of Directive
2009/73/EC

— Operators of natural gas refining

and treatment facilities

(e) Hydrogen Operators of hydrogen production,

storage and transmission

2. Transport (a) Air — Air carriers referred to in point (4)

of Article 3 of Regulation (EC) No
300/2008 (6)

— Airport managing bodies referred to

in point (2) of Article 2 of Directive
2009/12/EC(7), airports referred to
in point (1) of Article 2 of that
Directive, including the core
airports listed in Section 2 of Annex
II to Regulation (EU) No 1315/2013
(8), and entities operating ancillary
installations contained within
airports

— Traffic management control

operators providing air traffic
control (ATC) services referred to in
point (1) of Article 2 of Regulation
(EC) No 549/2004 (9)

6
Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008 on common
rules in the field of civil aviation security and repealing Regulation (EC) No 2320/2002 (OJ L 97, 9.4.2008,
p.72).
7
Directive 2009/12/EC of the European Parliament and of the Council of 11 March 2009 on airport charges (OJ
L 70, 14.3.2009, p.11).
8
Regulation (EC) No 1315/2013 of the European Parliament and of the Council of 11 December 2013 on Union
guidelines for the development of the trans-European transport network and repealing Decision No
661/2010/EU (OJ L 348, 20.12.2013, p.1).
9
Regulation (EC) No 549/2004 of the European Parliament and of the Council of 10 March 2004 laying down
the framework for the creation of the single European sky (the framework Regulation) (OJ L 96, 31.3.2004,
p.1).

3
 (b) Rail — Infrastructure managers referred to
in point (2) of Article 3 of Directive
2012/34/EU(10)

— Railway undertakings referred to in

point (1) of Article 3 of Directive
2012/34/EU, including operators of
service facilities referred to in point
(12) of Article 3 of Directive
2012/34/EU

(c) Water — Inland, sea and coastal passenger

and freight water transport
companies, referred to for maritime
transport in Annex I to Regulation
(EC) No 725/2004 (11), not
including the individual vessels
operated by those companies

— Managing bodies of ports referred to

in point (1) of Article 3 of Directive
2005/65/EC (12), including their port
facilities referred to in point (11) of
Article 2 of Regulation (EC) No
725/2004, and entities operating
works and equipment contained
within ports

— Operators of vessel traffic services

referred to in point (o) of Article 3
of Directive 2002/59/EC (13)

(d) Road — Road authorities referred to in point

(12) of Article 2 of Commission

10
Directive 2012/34/EU of the European Parliament and of the Council of 21 November 2012 establishing a
single European railway area (OJ L 343, 14.12.2012, p.32).
11
Regulation (EC) No 725/2004 of the European Parliament and of the Council of 31 March 2004 on enhancing
ship and port facility security (OJ L 129, 29.4.2004, p.6).
12
Directive 2005/65/EC of the European Parliament and of the Council of 26 October 2005 on enhancing port
security (OJ L 310, 25.11.2005, p. 28).
13
Directive 2002/59/EC of the European Parliament and of the Council of 27 June 2002 establishing a
Community vessel traffic monitoring and information system and repealing Council Directive 93/75/EEC
(OJ L 208, 5.8.2002, p.10)

4
 Delegated Regulation (EU)
14
2015/962 ( ) responsible for traffic
management control

— Operators of Intelligent Transport

Systems referred to in point (1) of
Article 4 of Directive 2010/40/EU
(15)

3. Banking Credit institutions referred to in point

(1) of Article 4 of Regulation (EU) No
575/2013 (16)

4. Financial market — Operators of trading venues referred

infrastructures to in point (24) of Article 4 of
Directive 2014/65/EU (17)

— Central counterparties (CCPs)

referred to in point (1) of Article 2
of Regulation (EU) No 648/2012
(18)

5. Health  Healthcare providers referred to in

point (g) of Article 3 of Directive
2011/24/EU (19)

14
Commission Delegated Regulation (EU) 2015/962 of 18 December 2014 supplementing Directive
2010/40/EU of the European Parliament and of the Council with regard to the provision of EU–wide real–
time traffic information services (OJ L 157, 23.6.2015, p. 21).
15
Directive 2010/40/EU of the European Parliament and of the Council of 7 July 2010 on the framework for the
deployment of Intelligent Transport Systems in the field of road transport and for interfaces with other modes
of transport (OJ L 207, 6.8.2010, p. 1).
16
Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential
requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012 (OJ L
176, 27.6.2013, p. 1).
17
Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial
instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (OJ L 173, 12.6.2014, p. 349).
18
Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC
derivatives, central counterparties and trade repositories (OJ L 201, 27.7.2012, p. 1).
19
Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of
patients' rights in cross–border healthcare (OJ L 88, 4.4.2011, p. 45).

5
  EU reference laboratories referred to
in Article 15 of Regulation
XXXX/XXXX on serious cross-
border threats to health20

 Entities carrying out research and

development activities of medicinal
products referred to in Article 1
point 2 of Directive 2001/83/EC (21)
 Entities manufacturing basic
pharmaceutical products and
pharmaceutical preparations referred
to in section C division 21 of NACE
Rev. 2
 Entities manufacturing medical
devices considered as critical during
a public health emergency (‘the
public health emergency critical
devices list’) referred to in Article
20 of Regulation XXXX22

6. Drinking water Suppliers and distributors of water

intended for human consumption
referred to in point (1)(a) of Article 2 of
Council Directive 98/83/EC(23) but
excluding distributors for whom
distribution of water for human
consumption is only part of their
general activity of distributing other
commodities and goods which are not
considered essential or important
services

7. Waste water Undertakings collecting, disposing or

20
[Regulation of the European Parliament and of the Council on serious cross-border threats to health and
repealing Decision No 1082/2013/EU, reference to be updated once the proposal COM (2020)727 final is
adopted]
21
Directive 2001/83/EC of the European Parliament and of the Council of 6 November 2001 on the community
code relating to medicinal products for human use (OJ L 311, 28.11.2001, p.67).
22
[Regulation of the European Parliament and of the Council on a reinforced role for the European Medicines
Agency in crisis preparedness and management for medicinal produces and medical devices, reference to be
updated once the proposal COM(2020)725 final is adopted]
23
Council Directive 98/83/EC of 3 November 1998 on the quality of water intended for human consumption (OJ
L 330, 5.12.1998, p. 32).

6
 treating urban, domestic and industrial
waste water referred to in points (1) to
(3) of Article 2 of Council Directive
91/271/EEC (24)

8. Digital infrastructure — Internet Exchange Point providers

— DNS service providers

— TLD name registries

— Cloud computing service providers

— Data centre service providers

 Content delivery network providers

— Trust service providers referred to in

point (19) of Article 3 of Regulation
(EU) No 910/2014(25)

— Providers of public electronic

communications networks referred
to in point (8) of Article 2 of
Directive (EU) 2018/1972(26) or
providers of electronic
communications services referred to
in point (4) of Article 2 of Directive
(EU) 2018/1972 where their
services are publicly available

9. Public administration  Public administration entities of

central governments

 Public administration entities of

NUTS level 1 regions listed in

24
Council Directive 91/271/EEC of 21 May 1991 concerning urban waste water treatment (OJ L 135, 30.5.1991,
p.40).
25
Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic
identification and trust services for electronic transactions in the internal market and repealing Directive
1999/93/EC (OJ L 257, 28.8.2014, p.73).
26
Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing
the European Electronic Communication Code (OJ L 321, 17.12.2018, p. 36).

7
 Annex I of Regulation (EC) No
1059/2003 (27)

 Public administration entities of

NUTS level 2 regions listed in
Annex I of Regulation (EC) No
1059/2003

10. Space Operators of ground-based

infrastructure, owned, managed and
operated by Member States or by
private parties, that support the
provision of space-based services,
excluding providers of public
electronic communications networks
referred to in point (8) of Article 2 of
Directive (EU) 2018/1972

27
Regulation (EC) No 1059/2003 of the European Parliament and of the Council of 26 May 2003 on the
establishment of a common classification of territorial units for statistics (NUTS) (OJ L 154, 21.6.2003, p. 1).

8
 ANNEX II

IMPORTANT ENITIES:

SECTORS, SUBSECTORS AND TYPES OF ENTITIES

Sector Subsector Type of entity

1. Postal and courier Postal service providers referred to in

services point (1) of Article 2 of Directive
97/67/EC (28)and providers of courier
services

2. Waste management Undertakings carrying out waste

management referred to in point (9) of
Article 3 of Directive 2008/98/EC (29)
but excluding undertakings for whom
waste management is not their principal
economic activity

3. Manufacture, Undertakings carrying out the

production and manufacture, production and
distribution of distribution of substances and articles
chemicals referred to in points (4), (9) and (14) of
Article 3 of Regulation (EC) No
1907/2006 (30)

4. Food production, Food businesses referred to in point (2)

processing and of Article 3 of Regulation (EC) No
distribution 178/2002 (31)

5. Manufacturing (a) Manufacture of Entities manufacturing medical devices

28
Directive 97/67/EC of the European Parliament and of the Council of 15 December 1997 on common rules for
the development of the internal market of Community postal services and the improvement of the quality of
service (OJ L 15, 21.1.98, p.14).
29
Directive 2008/98/EC of the European Parliament and of the Council of 19 November 2008 on waste and
repealing certain Directives (OJ L 312, 22.11.2008, p. 3)
30
Regulation (EC) No 1907/2006 of the European Parliament and of the Council of 18 December 2006
concerning registration, evaluation, authorisation and restriction of chemicals (REACH), establishing a
European Chemicals Agency amending Directive 1999/45/EC and repealing Council Regulation (EEC) No
793/93 and Commission Regulation (EC) No 1488/94 as well as Council Directive 76/769/EEC and
Commission Directives 91/155.EEC, 93/67/EEC, 93/105/EC and 2000/21/EC (OJ L 396, 30.12.2006, p. 1).
31
Regulation (EC) No 178/2002 of the European Parliament and of the Council of 28 January 2002 laying down
the general principles and requirements of food law, establishing the European Food Safety Authority and
laying down procedures in matters of food safety (OJ L 31, 1.2.2002, p.1).

9
 medical devices and in referred to in Article 2 point 1 of
vitro diagnostic medical Regulation (EU) 2017/745(32), and
devices entities manufacturing in vitro
diagnostic medical devices referred to
in Article 2 point 2 of Regulation (EU)
2017/746 (33) with exception of entities
manufacturing medical devices
mentioned in Annex 1, point 5.

(b) Manufacture of Undertakings carrying out any of the

computer, electronic and economic activities referred to in
optical products section C division 26 of NACE Rev. 2

(c) Manufacture of Undertakings carrying out any of the

electrical equipment economic activities referred to in
section C division 27 of NACE Rev. 2

(d) Manufacture of Undertakings carrying out any of the

machinery and economic activities referred to in
equipment n.e.c. section C division 28 of NACE Rev. 2

(e) Manufacture of motor Undertakings carrying out any of the

vehicles, trailers and economic activities referred to in
semi-trailers section C division 29 of NACE Rev. 2

(f) Manufacture of other Undertakings carrying out any of the

transport equipment economic activities referred to in
section C division 30 of NACE Rev. 2

6. Digital providers — Providers of online marketplaces

— Providers of online search engines

— Providers of social networking

services platform

32
Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices,
amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and
repealing Council Directives 90/385/EEC and 93/42/EEC (OJ L 117, 5.5.2017, p.1)
33
Regulation (EU) 2017/746 of the European Parliament and of the Council of 5 April 2017 on in vitro
diagnostic medical devices and repealing Directive 98/79/EC and Commission Decision 2010/227/EU (OJ L
117, 5.5.2017, p.176)

10
 ANNEX III

CORRELATION TABLE

Directive (EU) 2016/1148 This Directive

Article 1 (1) Article 1 (1)

Article 1 (2) Article 1 (2)

Article 1 (3) -

Article 1 (4) Article 2 (4)

Article 1 (5) Article 2 (5)

Article 1 (6) Article 2 (3)

Article 1 (7) Article 2 (6)

Article 2 -

Article 3 Article 3

Article 4 Article 4

Article 5 -

Article 6 -

Article 7 (1) Article 5 (1)

Article 7 (2) Article 5 (4)

Article 7 (3) Article 5 (3)

Article 8 (1)–(5) Article 8 (1)–(5)

Article 8 (6) Article 11 (4)

Article 8 (7) Article 8 (6)

Article 9 (1)-(3) Article 9 (1)-(3)

Article 9 (4) Article 9 (7)

Article 9 (5) Article 9 (8)

Article 10 (1)-(3) Article 11 (1)-(3)

Article 11 (1) Article 12 (1) –(2)

11
Article 11 (2) Article 12 (3)

Article 11 (3) Article 12(4) and (6)

Article 11 (4) -

Article 11 (5) Article 12 (7)

Article 12 (1)-((5) Article 13 (1)-(5)

Article 13 -

Article 14 (1) Article 18 (1)

Article 14 (2) Article 18 (2)-(4)

Article 14 (3) Article 20 (1)

Article 14 (4) Article 20 (3)

Article 14 (5) Article 20 (5), (6), (8)

Article 14 (6) Article 20 (7)

Article 14 (7) -

Article 15 (1) Article 29 (2)

Article 15 (2)(a) Article 29 (2) (e)

Article 15 (2)(b) Article 29 (2) (g)

Article 15 (2) second indent Article 29 (3)

Article 15 (3) Article 29 (4) (b)

Article 15 (4) Article 28 (2)

Article 16 (1) Article 18 (1), (2)

Article 16 (2) Article 18 (2)-(4)

Article 16 (3) Article 20 (1)

Article 16 (4) Article 20 (3)

Article 16 (5) -

Article 16 (6) Article 20 (6)

Article 16 (7) Article 20 (7)

12
Article 16 (8), (9) Article 20 (11)

Article 16 (10) -

Article 16 (11) Article 2 (1)

Article 17 (1) -

Article 17 (2)(a) Article 29 (2) (e)

Article 17 (2)(b) Article 29 (4) (b)

Article 17 (3) Article 34 (1) (a), (b)

Article 18 (1) Article 24 (1)-(2)

Article 18 (2) Article 24 (3)

Article 18 (3) Article 24 (4)

Article 19 Article 22

Article 20 Article 27

Article 21 Article 33

Article 22 (1)-(2) Article 37 (1)-(2)

Article 23 Article 35

Article 24 -

Article 25 Article 38

Article 26 Article 42

Article 27 Article 43

Annex I(1) Article 10 (1)

Annex I (2) (a) (i)-(iv) Article 10 (2) (a)-(d)

Annex I (2) (a) (v) Article 10 (2) (f)

Annex I (2) (b) Article 10 (3)

Annex I (2) (c) (i)-(ii) Article 10 (4) (a)

Annex II Annex I

Annex III 1, 2 Annex II, 6.

13
Annex III, 3 Annex I, 8.

14