Do I fall under NIS 2?

What “do I fall under NIS 2?” actually asks

People usually mean three different things at once, and collapsing them produces bad answers.

1. Direct legal scope. Does Directive (EU) 2022/2555, as transposed by your Member State, put duties on your organisation: as an essential or important entity under Articles 2 and 3 (risk management and incident reporting), or under a narrower branch such as Article 2(4) domain name registration services (mainly Article 28 duties)? That is the question this guide answers.
2. Contractual flow-down. Even when you are out of direct scope, Article 21(2)(d) requires in-scope entities to address supply-chain security, and Recital 85 encourages contractual security measures with direct suppliers. That can create commercial requirements without making the supplier an essential or important entity.
3. Overlap with sibling regimes. For many banks and other financial entities, DORA is the sector-specific act. Under NIS 2 Article 4, where a sector-specific Union act imposes equivalent cybersecurity risk-management and incident-notification duties, the matching NIS 2 provisions (including Articles 21 and 23, and the related supervision and enforcement rules) do not apply; DORA Article 1(2) is the usual expression of that lex specialis for the financial sector. Other critical entities may sit under the CER Directive; product cybersecurity can sit under the Cyber Resilience Act. Always open the sector-specific playbook first when one exists.

This guide stays on question one. It paraphrases the structure of Articles 2 and 3 and the SME recommendation NIS 2 points to. It does not reproduce official titles of standards or normative text from ISO or other standards bodies, and it is not legal advice.

How to decide, step by step

1. 1

   Confirm you provide services or carry out activities in the EU

   The first filter is territorial. NIS 2 reaches entities that provide services or carry out activities within the Union, not only entities that are incorporated there. A US-headquartered cloud provider with EU customers can be in scope; a purely non-EU company with no EU activity is not, on the directive's own terms. Even then, two caveats remain: national transposition can draw a slightly different perimeter, and in-scope customers routinely push NIS 2-aligned security and incident clauses down the supply chain by contract.

2. 2

   Match your activity to Annex I or Annex II

   The directive does not regulate every company. It regulates entities whose activity sits in one of the sector lists. Annex I (sectors of high criticality) covers energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management offered B2B (managed and managed-security service providers), public administration, and space. Annex II (other critical sectors) covers postal and courier services; waste management where that is the undertaking's principal economic activity; manufacture, production and distribution of chemicals; food wholesale distribution and industrial production or processing; certain manufacturing (medical devices, computers and electronics, electrical equipment, machinery, motor vehicles, other transport equipment); digital providers (online marketplaces, online search engines, social networking platforms); and research organisations that primarily conduct applied research or experimental development with a view to commercial exploitation (educational institutions are out of that definition). If neither annex fits and you are not one of the size-independent special entity types in the next step, direct scope is unlikely. Borderline sector questions (for example, whether a niche SaaS is “cloud computing” under digital infrastructure) are facts your counsel and competent authority settle, not a checklist alone.

3. 3

   Check the size-independent special entity types first

   Size is the usual gate, but it is not the only gate. Under Article 2(2)(a), certain digital-infrastructure and trust-service roles are in scope regardless of size: TLD name registries, DNS service providers, and trust service providers (qualified and non-qualified). Providers of public electronic communications networks or publicly available electronic communications services sit here too. Those Article 2(2)(a) types also feed the essential/important classification under Article 3. Separately, Article 2(4) brings providers of domain name registration services into the directive regardless of size (a registrar or privacy/proxy service can hit 2(4) without being a TLD registry or DNS provider). That is a different branch: Article 2(4) exists mainly so the registration-database and WHOIS-style duties in Article 28 apply, and it does notby itself make the provider an essential or important entity under Article 3, so the Article 21 risk-management catalogue does not automatically follow from 2(4) alone. Public administration entities under Article 2(2)(f), critical entities identified under the CER Directive (EU) 2022/2557, legacy operators of essential services retained under Article 3(1)(g), and express Member-State designations also override a simple size test. Run these checks before you conclude that “we are too small.”

4. 4

   Apply the SME size thresholds (Recommendation 2003/361/EC)

   For entities that are in an Annex sector and are not a special type, the default rule is that NIS 2 reaches at least medium-sized enterprises. Size is measured with the SME definition in Commission Recommendation 2003/361/EC, which NIS 2 points to rather than inventing its own thresholds. Three details trip people up. First, staff is a hard ceiling, while the financial ceilings work as an either/or: an enterprise meets the financial side of a band if either its turnover orits balance-sheet total stays under the ceiling. Second, size aggregation follows Recommendation 2003/361/EC Articles 3 and 6: use the entity's own data if it is autonomous; add partner enterprises proportionally; add 100% of linked enterprises. A 30-person EU sales entity under a 400-person linked parent is not treated as small on its own numbers alone. NIS 2 Recital 16 also lets Member States disregard partner or linked enterprises where the entity is operationally independent, so confirm the national rule. Third, SME status under the Recommendation generally changes only when a ceiling is exceeded (or no longer exceeded) over two consecutive accounting periods, so a one-year spike does not always flip the band overnight.

5. 5

   Classify essential versus important under Article 3

   For entities that reach the directive through Article 2(1) or 2(2) (or another firm basis that feeds Article 3), Article 3 sorts them into essential or important. The rough pattern is: large entities in Annex I sectors are essential; medium entities and Annex II entities are important. Article 3 then lists overrides that a simple “Annex times size” table misses: qualified trust service providers, TLD name registries and DNS service providers are essential at any size; providers of public electronic communications networks or services that qualify as medium-sized are essential under Article 3(1)(c) (and large ones under Article 3(1)(a)); central public administration is essential; critical entities under the CER Directive and certain retained legacy operators of essential services are essential; and a Member State can designate an entity either way. The cybersecurity risk-management measures in Article 21 and the incident-reporting architecture in Article 23 apply to essential and important entities. Do not collapse every “in scope of the directive” result into that pair: a provider that stands only on Article 2(4) (domain name registration services) is mainly under the Article 28 registration-database duties and is not automatically essential or important. Between essential and important, the practical difference is supervision intensity: more proactive, ex-ante supervision for essential entities; more reactive, ex-post supervision for important entities.

6. 6

   Confirm against your Member State's transposition law

   NIS 2 is a directive, not a regulation. The directive sets the EU floor; the binding obligations for an organisation come from the national transposition law of the Member State where it is mainly established or provides the service. The EU deadline to transpose was 17 October 2024. Several Member States missed it. The Commission issued formal notices, reasoned opinions, and in July 2026 referred some states to the Court of Justice of the EU. National laws can also extend the EU baseline (additional sectors, tighter size rules, earlier registration). So the last step is always: open the national act and the competent authority page for your Member State, not only the English directive text. Our NIS 2 transposition tracker lists all 27 states with a dated source per row; the free checker surfaces the same note for the country you pick.

Six mistakes that produce the wrong answer

• Treating the directive text as the only law that binds you

  NIS 2 is a directive. Your obligations come from the national transposition act of the Member State that has jurisdiction over you. The English EUR-Lex text is the EU floor, not the last word.

• Using the subsidiary's headcount when you are part of a group

  The SME recommendation is applied at group level in the usual case. A 40-person local entity under a 500-person parent is not small for NIS 2 size purposes.

• Stopping at size and ignoring special entity types

  DNS providers, TLD registries, trust services and public electronic communications providers can be in scope at any size and feed essential/important classification. Domain name registration services under Article 2(4) are a separate size-independent branch (mainly Article 28). Size is the default gate, not the only gate.

• Assuming essential and important mean different security controls

  Article 21 risk-management measures apply to both essential and important entities. The practical split is mainly supervision intensity (ex-ante for essential, ex-post for important) and how enforcement is structured, not a lighter control catalogue for important entities. Do not confuse that pair with the separate Article 2(4) domain-registration branch, which is mainly about Article 28 duties.

• Ignoring DORA when you are a financial entity

  For many credit institutions and other DORA-covered financial entities, DORA is the sector-specific act. NIS 2 Article 4 then displaces the equivalent NIS 2 risk-management, reporting, supervision and enforcement provisions. Opening only the NIS 2 Article 21 playbook is the wrong first move.

• Ignoring contractual flow-down when you are out of direct scope

  Even a genuine out-of-scope supplier often faces NIS 2-aligned security, audit and incident clauses from in-scope customers. Direct scope and commercial scope are not the same question.

Frequently asked questions