What it asks for. The article sorts in-scope organisations into essential and important entities. Essential entities include Annex I entities that exceed the ceilings for medium-sized enterprises, qualified trust service providers, top-level domain registries and DNS service providers regardless of size, medium-sized or larger providers of public electronic communications, central government entities, and entities a Member State designates. Other Annex I or Annex II entities in scope are important entities.
In practice. Both categories must meet the same risk-management and reporting obligations in Articles 21 and 23. The difference lies in supervision and penalties: essential entities face proactive supervision under Article 32 and higher maximum fines, while important entities face reactive, after-the-event supervision under Article 33 and lower maximum fines. Member States must establish a list of essential and important entities and review it at least every two years, and entities must provide registration information. Organisations should document their classification, register with the national authority and track changes in size or activity.
Common gaps. Common gaps are assuming important entities have lighter security obligations, and failing to register or update the authority when the organisation's size or services change.