Annex II of Directive (EU) 2022/2555 has a sector called "digital providers" with three rows: providers of online marketplaces, of online search engines and of social networking services platforms. They are the only platform businesses the Directive names, and they sit in the annex of "other critical sectors", not the annex of "high criticality", which decides something a platform's counsel will want to know first: however large it grows, it is an important entity and not an essential one, unless a member state makes it one. This article takes the three definitions, the status, the state, the registry and the thresholds that are specific to these three, and where the line to a SaaS company and to the Cyber Resilience Act runs.

Three definitions, borrowed from three acts

NIS2 defines two of the three by reference. Article 6(28) sends "online marketplace" to Article 2, point (n), of Directive 2005/29/EC, which reads: "a service using software, including a website, part of a website or an application, operated by or on behalf of a trader which allows consumers to conclude distance contracts with other traders or consumers". Article 6(29) sends "online search engine" to Article 2, point (5), of Regulation (EU) 2019/1150: "a digital service that allows users to input queries in order to perform searches of, in principle, all websites, or all websites in a particular language, on the basis of a query on any subject in the form of a keyword, voice request, phrase or other input, and returns results in any format in which information related to the requested content can be found". Article 6(33) defines the third itself: a social networking services platform is "a platform that enables end-users to connect, share, discover and communicate with each other across multiple devices, in particular via chats, posts, videos and recommendations".

Each definition has an edge that excludes a business that would call itself by the name. The marketplace definition is written for consumers: a platform on which traders contract with other traders only is not an "online marketplace" under Article 2(n), whatever its size, and is more likely a cloud computing service provider for the software it runs. The search engine definition asks for searches of "in principle, all websites": a search box over one site, one catalogue or one company's documents is a feature, not a search engine. The social networking definition asks for end users connecting and communicating with each other across devices, which a comments section under articles does not satisfy and a community platform does. The three rows are on the scope tool verbatim, with the rest of Annexes I and II.

Important however large

Article 2(1) puts an entity of a listed type in scope at medium size or above: 50 staff or more, or above EUR 10 million in both turnover and balance sheet, counted for the enterprise with its partner and linked enterprises. Below that a platform is outside as an entity, unless its member state identifies it under Article 2(2)(b) to (e). Above it, the platform is an important entity under Article 3(2), and it stays important whatever its size, because Article 3(1)(a), the rule that makes large entities essential, reaches only "entities of a type referred to in Annex I". The two ways an Annex II platform becomes essential are an act of the member state under Article 3(1)(e), which needs an identification under Article 2(2)(b) to (e) first, and being identified as a critical entity under Directive (EU) 2022/2557 (Article 3(1)(f)).

Important means Article 33 supervision, ex post, on evidence or indication of non-compliance, and Article 34(5)'s fine ceiling of at least EUR 7 000 000 or 1,4 % of worldwide turnover, whichever is higher. The Article 21 measures and the Article 23 clocks are the same as an essential entity's. The seven ways to be essential, and what the status changes, are their own article.

One state, the registry, and the Regulation

The three digital providers are in the list of Article 26(1)(b), so jurisdiction goes to the member state of the main establishment in the Union, "the Member State where the decisions related to the cybersecurity risk-management measures are predominantly taken" (Article 26(2)), and a platform established outside the Union that offers its service in it designates a representative in a member state where it does (Article 26(3)). The state's act, as communicated to the Commission, is on the transposition register.

They are in the list of Article 27 too: the platform had to submit its name, sector, addresses, contact details, member states served and IP ranges to its competent authority for ENISA's registry by 17 January 2025, and notifies changes within three months.

And they are in Article 1 of Implementing Regulation (EU) 2024/2690, so the technical and methodological requirements of the Article 21(2) measures are the Regulation's Annex, 13 sections, the same in every state, mapped section by section against ISO 27001.

The thresholds are a share of users, not a clock

For cloud and managed service providers the Regulation's first criterion is time: a service completely unavailable for more than 30 minutes. For the three digital providers it is not. Articles 11, 12 and 13 give marketplaces, search engines and social networks the same four criteria, and none of them has a duration: the platform completely unavailable for more than 5 % of its users in the Union, or more than 1 million of them, whichever is smaller; more than 5 % or more than 1 million of its users in the Union impacted by limited availability; the integrity, confidentiality or authenticity of stored, transmitted or processed data compromised as a result of a suspectedly malicious action; or compromised with an impact on more than 5 % or more than 1 million of its users in the Union, whichever is smaller. Article 3(1)'s general criteria apply on top: the direct financial loss above EUR 500 000 or 5 % of turnover, the exfiltration of trade secrets, death or considerable damage to health, the successful and suspectedly malicious access capable of causing severe operational disruption. Users are counted under Article 3(3) as contracted customers plus the natural and legal persons associated with business customers who use the service, which for a marketplace means buyers and sellers, and for a search engine or a social network the people who use it.

The consequence for an incident procedure is that the platform has to know its user count in the Union and the share of it affected by an outage, in the first hours, because that number is the significance test. A five-minute total outage of a platform with 30 million Union users is a significant incident; a two-hour outage for 2 % of them is not, on availability alone. Then Article 23: early warning within 24 hours of becoming aware, notification within 72 hours, final report within one month. The clocks, with the thresholds quoted in full, are their own article.

The lines to a SaaS company and to the CRA

A platform is also software as a service to the businesses that sell or advertise on it, and a company can be both a marketplace and a cloud computing service provider for different parts of what it offers; the Annex I row then brings the possibility of being essential by size with it. NIS2 for a SaaS company is its own article. The Cyber Resilience Act reaches the platform only where it ships something installed: a mobile app, a seller's point-of-sale client, an SDK. The platform accessed through a browser is not a product with digital elements, on the Commission's own reading of Regulation (EU) 2024/2847, and the incident record is one record with the NIS2 form and, for the app, the CRA form. Which law reaches which part is the article for that.

Sources

  • Directive (EU) 2022/2555 (NIS2), Article 2(1) and (2), Article 3(1) and (2), Article 6(28), (29) and (33), Article 21(2), Article 23(4), Article 26(1) to (3), Article 27(1) to (3), Article 33, Article 34(5), Annex II point 6.
  • Directive 2005/29/EC, Article 2, point (n), as amended by Directive (EU) 2019/2161; Regulation (EU) 2019/1150, Article 2, point (5).
  • Commission Implementing Regulation (EU) 2024/2690, Article 1, Article 3, Articles 11 to 13, Annex.
  • Commission Recommendation 2003/361/EC, Annex, Articles 2 and 3.

This is not legal advice. The member state's act names the authority, the portal and the form, and may identify a platform under Article 2(2)(b) to (e) and make it essential under Article 3(1)(e).