How NIS2 scope works
Three questions decide it (Directive (EU) 2022/2555, Arts. 2-3):
- Sector. Is your entity type listed in Annex I (energy, transport, banking, financial market infrastructure, health, drinking and waste water, digital infrastructure, ICT service management, public administration, space) or Annex II (postal, waste, chemicals, food, manufacturing of medical devices, electronics, electrical equipment, machinery, vehicles and other transport equipment, digital providers, research)?
- Size. Are you at least a medium-sized enterprise under Recommendation 2003/361/EC?
- Exceptions. Some entities are in scope whatever their size, and Member States can add more.
Size thresholds
| Category | Staff | and turnover | or balance sheet | NIS2 effect (if in an Annex sector) |
|---|---|---|---|---|
| Micro | < 10 | ≤ EUR 2 M | ≤ EUR 2 M | Out, unless size-independent |
| Small | < 50 | ≤ EUR 10 M | ≤ EUR 10 M | Out, unless size-independent |
| Medium | < 250 | ≤ EUR 50 M | ≤ EUR 43 M | Important (Annex I and II) |
| Large | Exceeds the medium-sized ceilings | Essential (Annex I), important (Annex II) | ||
The staff ceiling always applies; for the money you need to stay within either the turnover or the balance sheet ceiling. A company with 40 staff, EUR 12 million turnover and a EUR 8 million balance sheet is still small. One with 40 staff and EUR 12 million on both counts is medium-sized and in scope if its sector is listed. A category changes only when the ceilings are crossed in two consecutive accounting periods (Annex Art. 4(2)).
In scope regardless of size
- Always essential: qualified trust service providers, TLD name registries and DNS service providers (Art. 3(1)(b)); central government entities (Art. 3(1)(d)); critical entities under the CER Directive (Art. 3(1)(f)).
- In scope at any size: providers of public electronic communications networks or services (essential from medium-sized, Art. 3(1)(c)) and non-qualified trust service providers (Art. 2(2)(a)).
- Designated by the Member State: sole providers of an essential service, or entities whose disruption would hit public safety, security or health, create systemic risk or matter specifically at national or regional level (Art. 2(2)(b)-(e)).
- Domain name registration services are covered for the registration data duties of Article 28 (Art. 2(4)).
Essential or important: what changes
Both categories must take the risk-management measures of Article 21, have the management body approve and oversee them (Art. 20), and report significant incidents (Art. 23). The difference is supervision and fines. Essential entities are supervised proactively (Art. 32) and face fines of at least up to EUR 10 million or 2 % of worldwide turnover; important entities are supervised after the fact (Art. 33) with fines of at least up to EUR 7 million or 1.4 % (Art. 34). Financial entities under DORA follow DORA for ICT risk and incident reporting (Art. 4).
Out of scope, but still asked
Article 21(2)(d) makes NIS2 entities responsible for the security of their supply chain. Expect security questionnaires, contract clauses and audit rights from customers that are in scope, especially if you provide IT, software, hosting or components. Having your policies, ISO 27001 status and incident process documented saves days per questionnaire.
Country notes
- Netherlands: Cyberbeveiligingswet in force since 15 August 2026 (Rijksoverheid); registration via MijnNCSC; official NCSC self-check. Deep dive: Valt mijn organisatie onder de Cbw?
- Italy: D.Lgs. 138/2024, in force since 16 October 2024, with extra categories in Annexes III and IV; yearly registration on the ACN portal between 1 January and 28 February. Deep dive: La NIS2 si applica alla mia azienda?
- Belgium: NIS2 law of 26 April 2024, in force since 18 October 2024, supervised by the CCB; essential entities had a first conformity-assessment deadline of 18 April 2026 (CyFun or ISO/IEC 27001 route).
- Germany: NIS2UmsuCG (BGBl. 2025 I Nr. 301) in force since 6 December 2025; registration with the BSI; see the BSI FAQ.
What may change
On 20 January 2026 the Commission proposed targeted amendments to NIS2, including a "small mid-cap" category (fewer than 750 staff and turnover up to EUR 150 million or balance sheet up to EUR 129 million) whose members could at most be important entities. As of 1 October 2026 this is a proposal in the legislative procedure; the checker applies the current Directive.
Indicative only, not legal advice. National transpositions can add sectors or entities, and your competent authority decides on designation and registration.