To assess if NIS2 applies to your business, confirm you operate in a listed sector, meet medium or large size thresholds, and review national rules for exceptions. Even small entities can fall in scope if they provide critical services or are designated by their Member State.
NIS2 sets a new, harmonised baseline for cybersecurity obligations across the European Union. For business owners and compliance leads, the key question is whether your company is required to comply. This decision hinges on concrete criteria: your sector, your company’s size (including linked and partner enterprises), and the specifics of national implementation. Use this guide to perform a first-pass eligibility check: NIS2 generally applies if you are a medium or large business in a critical sector, but important exceptions and national nuances mean every company must check its details closely.
- NIS2 covers specific sectors listed in Annex I and II, not just general industry labels.
- The main size test includes medium (50–249 employees or €10m+ turnover/balance) and large entities.
- Exceptions mean some smaller firms, especially if critical or uniquely positioned, also fall in scope.
- National rules and additional designations can add or refine coverage—always verify with your country’s regulator.
- Eligibility depends on actual services, not only the sector’s name or company structure.
What NIS2 eligibility means for businesses
NIS2 eligibility decides whether your business falls under detailed cybersecurity obligations, reporting requirements and supervision by national authorities. Eligible entities must comply with risk management, incident reporting, and supply chain security rules. NIS2’s coverage is broader than its predecessor, aiming for more resilient digital infrastructure across the EU by including more sectors and explicit size thresholds[4]. If your organisation matches the criteria, preparing for NIS2 requirements is mandatory—not optional—with significant penalties for non-compliance.
Step 1: Check whether your sector and activity are covered
The first and most critical eligibility test is sector alignment. Your company is potentially in scope if it operates in a sector or activity named in Annex I or Annex II of NIS2. Annex I includes essential sectors such as energy, transport, banking, healthcare, drinking and waste water, digital infrastructure, ICT service management, public administration and space. Annex II lists important sectors like postal and courier services, waste management, chemicals production, food, electronics, machinery, vehicle manufacturing, digital providers and research[6]. It’s vital to verify both your sector and the specific nature of your services, as generic sector names may not correspond exactly with NIS2 coverage[2].
How to ensure your activity matches an Annex
Businesses often mistake their broad industry for inclusion, but only specific services specified in Annex I or II are captured. For example, not all technology firms are covered—only those whose activities align with definitions in the Annexes. Use official checklists or sector breakdowns from the European Commission or national regulators to match your core activities, and be ready to justify your conclusion if challenged.
Step 2: Assess company size, including linked and partner enterprises
With sector confirmed, the next step is the size threshold. NIS2 generally applies to medium-sized (50–249 employees and/or turnover or balance sheet over €10 million) or large businesses (250+ employees, €50 million turnover or €43 million balance sheet)[5]. This calculation follows the EU SME definition, which requires counting the entire group—including linked and partner firms—not just the main entity. Many companies underestimate their count by omitting subsidiaries or affiliate contributions, risking misclassification[3]. For group structures, aggregate headcount and relevant financials across all qualifying entities to correctly determine scope.
Linked and partner enterprises: getting the calculation right
EU rules on SME status are strict. Linked enterprises are those with majority control or significant influence, while partner enterprises share a meaningful tie but not full control. Both must have their figures included in the size calculation. Companies must review group structures and ownership chains carefully to avoid under-reporting, as regulators will aggregate company sizes where ownership or partnership links exist.
When NIS2 can apply regardless of company size
NIS2 includes specific exceptions to the main size test. Some entities—such as trust service providers, certain communications and DNS operators, domain registration services, or sole providers of a critical service in a region—can be captured regardless of size[2]. This means micro or small enterprises may have obligations if their services are systemically important or if designated as critical by authorities. Always check for these exclusions before concluding that the size threshold automatically excludes you. The national competent authority can also designate individual firms as in-scope based on local risk assessments or criticality to society or the economy.
Exceptions, national designations and local implementation
The EU directive provides a baseline, but each Member State transposes it through national law[2]. This often means further rules: additional sectors, stricter thresholds or unique requirements for registration or compliance. Authorities may create public registers of in-scope entities and update classifications as the threat landscape evolves. Businesses must always check their country’s current transposition law, regulator guidance and any national designations or opt-in/opt-out provisions. Overlooking local implementation risks missed obligations and potential sanctions. National FAQs, sector lists and official designation notices are essential reference points when conducting your eligibility check.
How to confirm your NIS2 status
No single tool gives a definitive answer, but your approach should start with a structured self-check: match your services to the Annexes, aggregate your company size using the group rules, and review any sector- or size-independent obligations. Finally, read your Member State’s transposition law and check with the relevant regulator. Several online checklists and scope tools are available—such as the Dazr NIS2 Scope Checker or the official European Commission guidance—but these do not replace a precise factual analysis of your business. If in doubt, legal or specialist cybersecurity advice may be needed, especially for complex organisations with cross-border operations.
Typical problems in NIS2 scope assessment
Businesses most often err by assuming sector labels are sufficient, failing to look up the specific activities listed in the legal Annexes[2]. Corporate groups frequently neglect to combine headcount and turnover with linked or partner enterprises, leading to inaccurate size reporting[3]. A further pitfall is relying on the EU directive alone without consulting the national law that provides the practical and enforceable rules in your country[2]. These mistakes can lead to missed obligations and unnecessary compliance exposure.
Recent developments and updates
The European Commission’s NIS2 FAQs clarify that both the sector list and explicit size thresholds have widened the pool of covered entities and aim for consistent application throughout the EU, with leeway for national risk-based inclusion of some smaller entities[4]. The Irish NCSC and other regulators have published guidance that refines the exact size metrics and stresses evaluating both employee count and relevant financials under the SME framework[5]. Staying current with updates from both European and national authorities remains key to accurate eligibility assessment.
Conclusion
Determining NIS2 eligibility requires a careful, stepwise assessment: start with your sector and core activities, apply the SME/group size definition, then check for size-independent inclusion or national extensions. Always confirm your conclusion with national law and regulator guidance. While general checklists help, only a full, well-documented process ensures your business both avoids unnecessary compliance and steers clear of dangerous oversights. If you are in doubt, prioritise early action—NIS2 penalties and obligations can be substantial.
Sources
[2] Is My Company in Scope for NIS2? A Practical Checklist | aneo (Aneo B.V., 2026-08-30)
[3] NIS2 scope: is your organisation in scope? | nis2audit (nis2audit, 2026-07-06)
[4] Directive on measures for a high common level of cybersecurity across the Union (NIS2 Directive) - FAQs (European Commission)
[5] NCSC: NIS2 FAQ (Irish NCSC)
[6] Scope: Who Must Comply — NIS2 · The Directive, Applied | DSI Academy (DSI Academy)
