NIS2 applies to your company if it is an entity of a type listed in Annex I or II, at least medium-sized, and active in the EU. Medium-sized starts at 50 staff, or at turnover and balance sheet total both above EUR 10 million. Some entities are covered regardless of size, and a few are excluded.
This guide covers the decision table, the four steps, the exclusions, what the result means, registration, what the check leaves open in practice, and a checklist.
| Your situation | NIS2 status | Directive |
|---|---|---|
| Annex I type, large | Essential | Art. 2(1), 3(1)(a) |
| Annex I type, medium-sized | Important | Art. 2(1), 3(2) |
| Annex II type, medium-sized or large | Important | Art. 2(1), 3(2) |
| Annex I or II type, small or micro | Out, unless a size-independent case applies | Art. 2(1) to 2(4) |
| Qualified trust service provider, TLD registry, DNS provider, any size | Essential | Art. 3(1)(b) |
| Public electronic communications provider | Essential if medium-sized or large, important if small | Art. 3(1)(a), (c) |
| Domain name registration services, any size | In scope, listed separately | Art. 2(4), 3(3) |
| CER critical entity or central government body | Essential | Art. 3(1)(d), (f) |
| Identified by your Member State | Essential or important, as identified | Art. 2(2)(b) to (e) |
| Public administration in national security, defence or law enforcement | Excluded | Art. 2(7) |
How do you check whether NIS2 applies? The four steps
- Sector: is the entity of a type listed in Annex I or II?
- Size: is it at least medium-sized? If yes, it is in scope.
- Size-independent cases: if not, is it covered regardless of size?
- EU presence: is it active in the EU, and whose law applies?
Then check the exclusions. The NIS2 scope checker gives a first answer from your sector, headcount and turnover.
Step 1: which sectors are in NIS2 scope?
NIS2 covers 18 sectors in two annexes. The test is the type of entity, not the industry label on your website.
Annex I, sectors of high criticality (11): energy (electricity, district heating and cooling, oil, gas, hydrogen), transport (air, rail, water, road), banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business to business), public administration, space.
Annex II, other critical sectors (7): postal and courier services, waste management, chemicals, food, manufacturing, digital providers, research.
Three points settle most borderline cases:
- Most entries are defined by other EU law. Read the definition the annex points to, not your own description of what you do.
- Most digital services sit in Annex I: cloud, data centres, CDNs, DNS, TLD registries, trust services, electronic communications, managed service providers and managed security service providers. Annex II digital providers are only online marketplaces, search engines and social networking platforms.
- Manufacturing is narrow: medical devices and in vitro diagnostics, computer, electronic and optical products, electrical equipment, machinery, motor vehicles and other transport equipment. Chemicals and food are separate sectors; other manufacturers are not listed.
Writing software is not an annex type in itself. A company that installs, manages, operates or maintains ICT products, networks, infrastructure or applications for customers can be a managed service provider under Article 6(39). The boundary is in NIS2 for MSPs and MSSPs.
Step 2: what is the NIS2 size threshold?
NIS1 left identification to Member States; NIS2 uses what recital 7 calls a “size-cap rule” (see NIS1 vs NIS2). The categories come from Recommendation 2003/361/EC:
- Small: fewer than 50 staff, and turnover or balance sheet total up to EUR 10 million. Micro: fewer than 10 staff, up to EUR 2 million.
- Medium-sized: fewer than 250 staff, and turnover up to EUR 50 million or balance sheet total up to EUR 43 million.
- Large: above the medium-sized ceilings.
So the NIS2 line is the top of “small”. You are in scope with 50 or more staff, or when both turnover and balance sheet total exceed EUR 10 million. A company with 30 staff, EUR 14 million turnover and a EUR 6 million balance sheet is still small. Large, which matters for essential status, means 250 or more staff, or turnover above EUR 50 million and balance sheet above EUR 43 million.
If you are near the 50-person line, does NIS2 apply to SMEs covers what smaller suppliers face.
How is company size calculated for NIS2?
- Staff are annual work units. Part-time and seasonal work counts as fractions; apprentices do not count.
- Use the latest approved accounts. A new company uses a good-faith estimate.
- One year does not change your category. Status changes only when a ceiling is crossed over two consecutive accounting periods.
- Group data is added. Linked enterprises count in full, partner enterprises (25% or more) in proportion, so a 30-person subsidiary of a large group can be large. Recital 16 lets Member States weigh the entity’s independence in systems and services.
- Public ownership does not change the test. Article 3(4) of the Recommendation, which denies SME status to enterprises 25% or more controlled by public bodies, does not apply for NIS2. A company is not treated as large just because a municipality owns it.
Step 3: which entities are covered regardless of size?
Article 2(2) to (4) brings in, whatever their size:
- providers of public electronic communications networks or publicly available electronic communications services;
- trust service providers, TLD name registries and DNS service providers;
- entities providing domain name registration services;
- critical entities identified under the CER Directive, (EU) 2022/2557;
- central government bodies, and regional ones following a risk-based assessment;
- entities of an annex type the Member State identifies as the sole provider of an essential service, as critical at national or regional level, or because a disruption could significantly affect public safety, security or health, or create significant systemic risk.
The last group cannot be self-assessed: your authority identifies it and decides whether it is essential or important. If the Member State so provides, operators of essential services identified under NIS1 before 16 January 2023 are essential. Member States may also extend the directive to local public administration and education institutions.
Step 4: does NIS2 apply outside the EU, and which country’s law applies?
Article 2(1) covers entities that “provide their services or carry out their activities within the Union”, wherever they are established.
Under Article 26, the general rule is the Member State of establishment, so a company established in several countries can face several national laws. Electronic communications providers fall under each Member State they serve. Cloud, data centre, CDN, DNS, TLD, domain registration, MSP and MSSP providers and Annex II digital providers fall under the Member State of their main establishment, and a non-EU provider of those services must designate a representative in a Member State it serves. The detail is in NIS2 jurisdiction and main establishment.
National laws apply the same test and can add to it. Not every Member State transposed by the 17 October 2024 deadline, so check that yours is in force.
Who is excluded from NIS2?
- Public administration in national security, public security, defence or law enforcement (Article 2(7)).
- Entities a Member State exempts from Article 21 or 23 for activities in those areas or services provided only to those bodies (Article 2(8)), except trust service providers (Article 2(9)).
- Entities exempted from DORA under its Article 2(4) (Article 2(10)).
- Entities under equivalent sector-specific EU law. Where another EU act imposes at least equivalent risk-management or incident-notification requirements, the relevant NIS2 provisions do not apply (Article 4(1)); recital 28 names DORA for financial entities.
Essential or important: what does the result mean?
Scope decides whether NIS2 applies. Status decides how you are supervised. Every in-scope Annex I or II entity not listed as essential in Article 3(1) is important. Both carry the same Article 21 measures and incident reporting duties. Essential entities face proactive supervision and maximum fines of at least EUR 10 million or 2% of worldwide turnover, whichever is higher; important entities face supervision after the fact and at least EUR 7 million or 1.4%. See essential vs important entities.
Do you have to register under NIS2?
In practice, yes. Member States had to list essential and important entities by 17 April 2025 and review the list at least every two years. To build it, entities must submit their name, address, contact details including IP ranges, sector and subsector, and the Member States they serve, and report changes within two weeks. Member States may run this as self-registration. The duty sits with the entity: do not wait to be contacted.
What the scope check leaves open in practice
NIS2 attaches its duties to the entity, a natural or legal person (Article 6(38)), and Article 21 covers the network and information systems it uses “for their operations or for the provision of their services”. A listed activity rarely runs on separate systems: identity, email, laptops and cloud tenants are shared, so expect the programme to reach them.
Scope also moves with two strong years, an acquisition that links you to a larger group, or a new service line such as operating customer infrastructure. A sensible approach is to re-run the check at each account closing and after any change in group or services, and keep a dated record:
NIS2 SCOPE DECISION RECORD
Legal entity: [name, registration number]
Date / reviewed by: [date] / [name, role]
Group: [linked and partner (25%+) enterprises]
1. Annex type: [Annex I or II, sector, entity type, definition]
2. Size, this period: staff (AWU) [ ] turnover [ ] balance sheet [ ]
Previous period: staff (AWU) [ ] turnover [ ] balance sheet [ ]
Category: [micro / small / medium-sized / large]
3. Size-independent: [none / 2(2)(a) / 2(2)(f) / 2(3) / 2(4) / identified]
4. EU presence: [Member States served, jurisdiction basis]
Exclusions checked: [Art. 2(7) to 2(10), Art. 4]
Result: [out of scope / important / essential]
Registered with: [authority, date, reference]
Next review: [next account closing or change of services]Registration data goes stale fastest. On the CloudSoul platform, an automated platform with human-in-the-loop expertise, the scope record and registration details sit next to the controls and evidence they drive, and changes are flagged for review. The wider programme is on the NIS2 compliance page.
NIS2 scope checklist
- Match each activity of each legal entity to an Annex I or II type, using the legal definition.
- Calculate size from the latest approved accounts, adding linked and partner data.
- Check two consecutive periods before concluding you crossed a ceiling.
- Check the size-independent cases and any identification by your authority.
- List the Member States you serve and confirm which one has jurisdiction.
- Check the exclusions and any equivalent sector-specific EU law.
- Register, report changes within two weeks, and re-run the check at each account closing.
Sources
- Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 4, 6, 21, 26 and 32 to 34, recitals 7, 16 and 28, Annexes I and II, EUR-Lex.
- Commission Recommendation 2003/361/EC (SME definition), Annex, Articles 2 to 6, EUR-Lex.
- Directive (EU) 2022/2557 (CER Directive), EUR-Lex.
- European Commission, NIS2 Directive policy page.
Frequently asked questions
Does NIS2 apply to my company?
It applies if your company is an entity of a type listed in Annex I or II of the directive, is at least medium-sized under the EU definition, and provides services or carries out activities in the EU. Medium-sized starts at 50 staff, or at turnover and balance sheet total both above EUR 10 million.
Which entities are covered by NIS2 regardless of size?
Providers of public electronic communications networks or services, trust service providers, top-level domain name registries, DNS service providers, domain name registration services, critical entities under the CER Directive, central government bodies, and entities a Member State identifies because of their role, for example as the sole provider of an essential service.
Does NIS2 apply to companies outside the EU?
Only if they provide services or carry out activities in the EU. Non-EU providers of certain digital services, including cloud, data centre, managed and managed security services, that offer them in the EU must designate a representative in a Member State where they provide services.
What is the difference between NIS2 scope and essential or important status?
Scope decides whether the directive applies at all. Status decides the supervision regime and the fine ceiling. Large Annex I entities and a few named categories are essential; all other in-scope Annex I and II entities are important.
Will the authority tell me if I am in scope?
Do not wait for it. Member States had to list essential and important entities by 17 April 2025, and the directive requires entities to submit their own details, such as contacts, IP ranges, sector and the Member States where they operate, and to report changes within two weeks.
