Is your organisation in scope of NIS2?

The legal basis in brief

NIS2 is Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. As a directive, it does not bind organisations directly. Each Member State had to transpose it into national law by 17 October 2024 and apply those rules from 18 October 2024 (Art. 41(1)). Many did so late, and some still have not. Your actual obligations therefore come from the national law of the Member State that has jurisdiction over you.

The directive sets the common framework that all national laws share: the sectors, the size thresholds, the two categories of entity, the minimum security measures, the reporting stages and the minimum fine ceilings. National laws may go further, for example by adding sectors or covering more public bodies. They may not fall below the directive. Which countries have adopted a law, and since when, is shown in our transposition overview.

Step 1: Is your activity in a covered sector?

The directive lists 18 sectors in two annexes. Annex I covers sectors of high criticality: energy (electricity, district heating and cooling, oil, gas, hydrogen), transport (air, rail, water, road), banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space.

Annex II covers other critical sectors: postal and courier services, waste management, the manufacture, production and distribution of chemicals, the production, processing and distribution of food, manufacturing (medical devices, computer and electronic products, electrical equipment, machinery, motor vehicles, other transport equipment), digital providers (online marketplaces, online search engines, social networking platforms) and research organisations.

What counts is the activity you actually carry out, not the name of your company or the code in your company register. A machinery manufacturer that also runs a large data centre for third parties may fall under two sectors. Annexes I and II define many sub-sectors by reference to other EU acts, such as the electricity market rules or the medical devices regulation, so check the precise definition before you rule yourself out.

Step 2: Do you reach the size threshold?

As a rule, NIS2 covers entities that are at least medium-sized under Commission Recommendation 2003/361/EC (Art. 2(1)). In practice:

The recommendation also counts staff and figures of partner and linked enterprises. A small subsidiary of a large group can therefore count as large. The directive allows Member States some leeway for disproportionate results where an entity is independent of its group in its network and information systems, and several national laws use it. Check how your national law treats group structures before you rely on the figures of a single legal entity.

Entities covered regardless of size

Some entities fall under NIS2 whatever their size (Art. 2(2) to (4)). They include:

• providers of public electronic communications networks or publicly available electronic communications services,
• trust service providers,
• top-level domain name registries and DNS service providers,
• the sole provider in a Member State of a service essential for critical societal or economic activities,
• entities whose disruption could significantly affect public safety, public security or public health, or cause significant systemic risk,
• entities identified as critical entities under the CER Directive (EU) 2022/2557,
• public administration entities of central government, and regional ones according to national rules,
• entities providing domain name registration services, for the purposes of Article 28.

Member States may also cover public administration at local level and education institutions (Art. 2(5)). Whether they do so differs widely from one country to the next.

Essential or important entity

NIS2 distinguishes two categories (Art. 3). Essential entities include large entities in Annex I sectors, qualified trust service providers, TLD name registries and DNS service providers regardless of size, medium-sized or larger providers of public electronic communications, public administration entities of central government, critical entities under the CER Directive and any further entities a Member State designates. All other in-scope entities from Annex I or II are important entities. In practice this means medium-sized Annex I entities and medium-sized and large Annex II entities.

Both categories have the same core duties: risk-management measures under Article 21, incident reporting under Article 23 and the duties of the management body under Article 20. The differences lie in supervision and fines. Essential entities are subject to proactive supervision, important entities to supervision after the fact (Art. 32 and 33). The minimum fine ceilings differ as well; see the page on fines and supervision.

Special cases and what to document

Financial entities covered by the Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) apply DORA instead of the NIS2 rules on risk management and incident reporting, as DORA is a sector-specific act within the meaning of Article 4 NIS2. Similar rules may apply in other sectors with equivalent EU legislation.

For groups active in several Member States, jurisdiction matters. As a rule, an entity falls under the jurisdiction of the Member State in which it is established (Art. 26(1)). Certain digital providers, such as DNS service providers, cloud and data centre providers, managed service providers and online marketplaces, fall under the Member State of their main establishment in the Union. If you have subsidiaries in several countries, each may have to register under a different national law.

Whatever the outcome, document your assessment: the sectors you checked, the figures you used, the group structure and the result. If an authority asks why you did not register, a written assessment shows that you looked at the question seriously. Our NIS2 scoring gives you a first classification in a few minutes. Several authorities offer their own scope tools as well, which are listed in the transposition overview where known.