{
  "id": "nis2-scope",
  "title": "NIS2 scope: sectors, size rule and size-independent cases",
  "description": "Annex I and II sectors, the medium-size rule, the cases covered regardless of size, and the essential/important categories.",
  "verified": "2026-10-19",
  "license": {
    "name": "CC BY 4.0",
    "url": "https://creativecommons.org/licenses/by/4.0/"
  },
  "attribution": "ClevSec (https://clevsec.one)",
  "disclaimer": "For informational purposes only; not legal advice. Check the cited sources and your national law.",
  "human_readable": "https://clevsec.one/blog/does-nis2-apply-to-my-company/?ref=agent",
  "sources": [
    "https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng",
    "https://eur-lex.europa.eu/eli/reco/2003/361/oj/eng"
  ],
  "annex_i_high_criticality": [
    "Energy",
    "Transport",
    "Banking",
    "Financial market infrastructures",
    "Health",
    "Drinking water",
    "Waste water",
    "Digital infrastructure",
    "ICT service management (business-to-business)",
    "Public administration",
    "Space"
  ],
  "annex_ii_other_critical": [
    "Postal and courier services",
    "Waste management",
    "Manufacture, production and distribution of chemicals",
    "Production, processing and distribution of food",
    "Manufacturing",
    "Digital providers",
    "Research"
  ],
  "size_rule": {
    "reference": "Art. 2(1); Recommendation 2003/361/EC",
    "in_scope_from": "medium-sized: 50 or more staff, or annual turnover and balance sheet total both above EUR 10 million",
    "large": "250 or more staff, or turnover above EUR 50 million and balance sheet total above EUR 43 million",
    "note": "Partner and linked enterprises count under the Recommendation; recital 16 lets member states consider independence."
  },
  "size_independent": [
    "providers of public electronic communications networks or publicly available electronic communications services",
    "trust service providers",
    "TLD name registries and DNS service providers",
    "entities providing domain name registration services",
    "sole provider in a member state of an essential service",
    "entities whose disruption could significantly affect public safety, security or health, or induce significant systemic risk",
    "entities critical at national or regional level",
    "central government and certain regional public administration entities",
    "critical entities under Directive (EU) 2022/2557"
  ],
  "categories": {
    "essential": "Large Annex I entities; qualified trust service providers, TLD registries and DNS service providers regardless of size; medium-sized public electronic communications providers; central government; designated entities (Art. 3(1))",
    "important": "All other in-scope Annex I or II entities (Art. 3(2))"
  },
  "fines": {
    "essential": "Maximum of at least EUR 10 million or 2% of worldwide turnover, whichever is higher (Art. 34(4))",
    "important": "Maximum of at least EUR 7 million or 1.4% (Art. 34(5))"
  }
}