The short answer
The metal and manufacturing industry is not mentioned as such in the annexes of the NIS2 Directive. This does not mean the sector is left untouched. Part of the manufacturing industry does fall under the directive, namely where the activity coincides with one of the named sectors — think of the manufacture of certain medical devices, machinery, electrical equipment or vehicle parts, which are listed in Annex II as production sectors. An ordinary construction company or a subcontractor in sheet metal work is usually not among them.
Whether your company falls precisely under that enumeration cannot be said at a glance: the directive works with NACE codes and descriptions that are more precise than "metal" or "manufacturing industry" as a collective term. In addition, size and supply chain position play a role, and you must weigh these three factors against each other before reaching a conclusion. in a few questions see where your company stands provides an initial direction in this regard, without you having to search through the full text yourself.
Sector: which part of the manufacturing industry is actually mentioned
Annex I contains the sectors considered "essential", such as energy, drinking water and transport — the classic utilities. Annex II adds sectors considered "important", and part of the manufacturing industry is among them: the manufacture of certain medical devices and in vitro diagnostics, computers and electronic products, electrical equipment, machinery and apparatus, and motor vehicles and parts. A supplier that falls precisely within such a product group may indeed fall under the directive itself, even if the company has never seen itself as "critical infrastructure".
For companies falling outside that enumeration — think of general metalworking, sheet metal work, welding or structural construction without a specifically named end product — the sector requirement does not apply. That does not rule out an obligation through the supply chain, and we return to that later.
Size: the threshold between medium-sized and large
If the sector does apply, business size is the next factor. The directive uses the European classification of micro, small, medium-sized and large enterprises, based on employee numbers combined with turnover or total assets. Small and medium-sized enterprises are generally excluded from direct obligation, with exceptions that the national legislator may designate. The exact thresholds and any exceptions are in the directive text and the national transposition; we do not invent those figures here, but they can be found via the official source.
For a family business with fifteen employees that falls precisely within a named product group, the sector is therefore not an automatic obligation — size may be the deciding factor that no direct obligation arises. For the larger, export-oriented machinery manufacturer with hundreds of employees, that same sector classification may indeed lead to an obligation.
Supply chain position: affected even without your own obligation
The vast majority of the metal and manufacturing industry is not reached via the sector list, but through the customer. An essential or important entity — an energy company, a water board, a large manufacturer of medical equipment — must under the due diligence obligation also assess the risks in its own supply chain. In practice, this translates into security questionnaires, contractual requirements and sometimes a mandatory procedure for reporting incidents to the contracting party, while the supplying company itself falls outside the law. If you supply as a CNC machinist, welding company or component supplier to such a party, you face the consequences sooner through the contract than through the law itself. How to read and answer such a questionnaire is a separate matter; the explanation per topic sets out the most common situations side by side.
Production systems connected to the network
One reason why clients in the manufacturing industry ask detailed questions here is the link between office automation and production. Machines, PLCs and production lines that once operated in isolation are now connected in many companies to the same network as planning, invoicing and email. A client assessing their own supply chain looks not only at office systems but also at how those production systems are protected, who has access to them and what happens in case of a fault or outage. This explains why questionnaires in this sector often go beyond "do you have a password policy" and specifically ask about network segmentation between office and production.
What to do if it is still unclear
Because sector, size and supply chain position are independent of each other, it is entirely possible that a metalworking company fits none of the three exactly, fits one of them, or fits all three at the same time. A clear answer requires comparing your own NACE code, the latest financial figures and an overview of your main clients side by side. how the result of the check is determined shows which sources are used in the process, including the date on which they were consulted. For your own definitive situation, a lawyer or the designated supervisory authority remains the appropriate point of contact.
Would you like a first direction for your own company without spending half a day on it: the nis2-check is free and only asks about your sector, size and a few questions about your main clients. frequently asked questions about NIS2 and the manufacturing industry answers a number of questions that often come up in this sector, before you need to call yourself.