Does NIS2 Apply to My Company? Sectors, Size Rules and Examples

This guide follows Directive (EU) 2022/2555 (NIS2). Your national law implements it and can extend scope, so check your country's version too. The free NIS2 Readiness Check starts with the same screening questions.

Question 1: Are you in one of the 18 sectors?

NIS2 covers entities "of a type referred to in Annex I or II" (Article 2(1)). Annex I lists sectors of high criticality, Annex II other critical sectors:

Read the annexes at the level of subsectors and entity types, not headlines. Two examples that catch technology companies:

• Digital infrastructure covers internet exchange points, DNS service providers (not root name servers), TLD registries, cloud computing providers, data centre providers, content delivery networks, trust service providers, and providers of public electronic communications networks or services.
• ICT service management (B2B) covers managed service providers and managed security service providers. If you run IT or security for other businesses, you are probably in this sector.

Question 2: Are you medium-sized or larger?

In the covered sectors, NIS2 applies to entities that qualify as medium-sized enterprises under Commission Recommendation 2003/361/EC, or exceed those ceilings (Article 2(1)). In practice:

Under the Recommendation, the figures of partner and linked enterprises count towards yours, so a small subsidiary of a large group can be in scope. Recital 16 of NIS2 notes that member states can take into account how independent such an entity is, for example in its network and information systems and services, to avoid disproportionate results. Check how your country applies this.

Question 3: Do you provide services or carry out activities in the EU?

NIS2 applies to entities that provide their services or carry out their activities within the Union (Article 2(1)). Some digital providers that are not established in the EU but offer services there must designate a representative in a member state (Article 26(3)).

Question 4: Does a size-independent rule apply?

Regardless of size, NIS2 also applies in these cases (Article 2(2) to (4)):

• providers of public electronic communications networks or publicly available electronic communications services;
• trust service providers;
• TLD name registries and DNS service providers;
• entities providing domain name registration services;
• an entity that is the sole provider in a member state of a service essential for critical societal or economic activities;
• an entity whose disruption could significantly affect public safety, security or health, or induce significant systemic risk;
• an entity that is critical because of its specific importance at national or regional level;
• public administration entities of central government, and certain regional ones;
• entities identified as critical entities under the Critical Entities Resilience Directive (EU) 2022/2557.

Member states can also extend NIS2 to local public administration and to education institutions (Article 2(5)).

Essential or important?

If you are in scope, Article 3 decides your category. Essential entities include large entities in Annex I sectors, qualified trust service providers, TLD registries and DNS service providers regardless of size, medium-sized providers of public electronic communications, central government entities, and entities designated by member states. All other in-scope entities in Annex I or II are important. Both categories must meet the same Article 21 measures and Article 23 reporting; the difference is supervision and the size of maximum fines. See our NIS2 summary.

Already covered by a sector law?

Under Article 4, where a sector-specific EU law imposes cybersecurity risk-management or incident-notification requirements at least equivalent to NIS2, the corresponding NIS2 provisions do not apply. DORA is the main example, for financial entities.

Worked examples

These examples illustrate the rules; borderline cases depend on the exact activity and your national law.

Not in scope? You may still feel NIS2

In-scope companies must manage supply chain security, taking into account their direct suppliers' vulnerabilities and security practices (Article 21(2)(d) and 21(3)). Expect security questionnaires and contract clauses from NIS2 customers. Our guide to answering security questionnaires helps.

Check in two minutes: the NIS2 Readiness Check screens your sector, size and EU activity, then scores your readiness across nine security domains.

In scope? The NIS2 Compliance Starter Kit gives you a gap-assessment workbook, an incident response plan template, a supply chain security policy template and a board briefing deck. See also our NIS2 compliance checklist.

Sources

• Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 4 and 26, Annexes I and II, recital 16, EUR-Lex
• Commission Recommendation 2003/361/EC concerning the definition of micro, small and medium-sized enterprises, EUR-Lex

Related tools