Does NIS2 apply to my company?
NIS2 applies if your organisation operates in one of the 18 sectors listed in Annex I or II of Directive (EU) 2022/2555 and is at least medium-sized (50+ employees or over €10M turnover). Some providers, such as DNS services, TLD registries and trust service providers, are covered regardless of size.
Last updated: 2026-09-30
The three-step test
- ▸Sector — Annex I (highly critical): Energy, Transport, Banking, Financial Markets Infrastructure, Health, Drinking Water, Wastewater, Digital Infrastructure, ICT Service Management (B2B), Public Administration, Space.
- ▸Sector — Annex II (other critical): Postal and Courier Services, Waste Management, Manufacture, Production and Distribution of Chemicals, Production, Processing and Distribution of Food, Manufacturing, Digital Providers, Research.
- ▸Size — medium or large under the EU SME definition (Recommendation 2003/361/EC): 50+ employees, or annual turnover and balance sheet above €10M. Micro and small entities are generally out of scope.
- ▸Exceptions (Article 2(2)) — some entities are in scope regardless of size, e.g. providers of public electronic communications, trust service providers, TLD name registries and DNS service providers, sole providers of an essential service in a member state, and central government public administration.
Essential or important entity?
| Your organisation | Classification |
|---|---|
| Large, Annex I sector | Essential entity |
| Medium, Annex I sector | Important entity |
| Medium or large, Annex II sector | Important entity |
Member states can also designate additional entities, and each national law sets its own registration procedure.
Depends on national law: Registration procedures and any additional designated entities depend on your member state's transposition law.
Related question
Is a company with fewer than 50 employees in scope for NIS2?
Usually not. Micro and small enterprises are generally excluded, unless they fall under a size-independent category in Article 2(2) — for example DNS service providers, TLD registries or trust service providers — or are designated by their member state.
Next steps
More answers:
For decision-support purposes only, not legal advice. Exact obligations depend on national transposition — use our free scope checker for a personalised assessment.