Who Does NIS2 Apply To? Sectors, Size Rules and the Entity Test Step by Step

At least medium-sized means 50 or more persons, or an annual turnover above EUR 10 million and a balance sheet total above EUR 10 million.

The two annexes list 18 sectors: 11 sectors of high criticality in Annex I and 7 other critical sectors in Annex II. Every entity in scope is either an essential entity or an important entity, and the obligation reaches it through the national law that transposes the Directive. How the Directive itself is built is explained under NIS2 Directive on the home page.

This page turns Articles 2, 3 and 26 into a six-step entity test with the legal basis for each step, a category matrix, the scope deviations in the German, Austrian and Italian laws, and the status of the proposed scope changes as of 23 October 2026.

What Decides Whether NIS2 Applies to an Organisation?

Three cumulative conditions decide whether NIS2 applies under Article 2(1): the entity is of a type listed in Annex I or Annex II, it qualifies at least as a medium-sized enterprise under Recommendation 2003/361/EC, and it provides services or carries out activities in the Union. Recital 7 of the Directive text on EUR-Lex calls this test the size-cap rule, a uniform criterion that replaces the designation of operators of essential services under NIS1 (Directive (EU) 2016/1148).

The size-cap rule has exceptions in both directions. Article 2(2) to (5) bring in entities of any size, such as telecoms providers, DNS service providers and central government bodies. Article 2(7) to (10) and the lex specialis rule of Article 4 take entities or provisions out again. The category of an entity in scope, essential or important, follows from Article 3, not from Article 2, so a scope result always has two parts: whether the Directive applies, and in which category.

Is NIS2 Mandatory, and Which Law Binds the Entity?

NIS2 is mandatory for every entity that meets its scope test, but the obligation reaches the entity through the national law that transposes the Directive, because the Directive is addressed to the Member States (Article 46). The duties, the competent authority and the fines that bind an organisation therefore come from the national act, not from the Directive text.

The Directive entered into force on 16 January 2023 (Article 45). Member States had to adopt and publish their measures by 17 October 2024 and apply them from 18 October 2024 (Article 41(1)). National laws may go further than the Directive, since Article 5 sets minimum harmonisation. Infringement procedures run against Member States: on 8 July 2026 the European Commission decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to notify measures transposing NIS2, with a request for a lump sum and daily penalties (Commission press release IP/26/1499).

The Entity Test Step by Step

The NIS2 entity test runs in six steps: match the activity to an Annex entity type, check the size, check the cases where size does not matter, work out the category, identify the supervising Member State and rule out the exclusions. Steps 2 and 3 are alternatives: an entity that fails the size test can still be in scope through a size-independent route. Table 1 gives the question, the provision and the possible result of each step.

Step 1: Match the Activity to an Annex Entity Type

Step 1 is to check whether the organisation carries out an activity that Annex I or Annex II lists as an entity type, defined in most cases by another EU act or by an Article 6 definition. A DNS service provider, for example, is defined in Article 6(20), and a postal service provider by Article 2(1a) of Directive 97/67/EC.

Annex I covers 11 sectors of high criticality and Annex II covers 7 other critical sectors, as Table 2 shows. Sectors differ widely in breadth: energy has 5 subsectors and 19 entity types (Annex I point 1), and transport has 4 subsectors and 10 entity types (Annex I point 2). The entity types of each sector, with their defining acts, are listed under all 18 NIS2 sectors.

NACE codes decide only in two places. Annex I point 5 refers to NACE Rev. 2 division C21 (pharmaceuticals), and Annex II point 5(b) to (f) refers to divisions C26 to C30. Every other entity type follows its defining act, so a statistical activity code never settles scope on its own.

Step 2: Check Whether the Entity Is at Least Medium-Sized

Step 2 is the size test: an entity of an Annex type is in scope if it has 50 or more persons, or an annual turnover above EUR 10 million and a balance sheet total above EUR 10 million, measured under the Annex to Recommendation 2003/361/EC (Article 2(1)). Staff are counted in annual work units, and one financial figure alone never lifts an entity into scope. A company with 40 staff, EUR 12 million turnover and a EUR 6 million balance sheet total stays small, because its balance sheet stays within EUR 10 million. The Recommendation text on EUR-Lex of 6 May 2003 (OJ L 124, 20.5.2003, p. 36) sets the ceilings.

An entity is measured together with its group. Partner enterprises, held at 25 % or more, are added pro rata, and linked enterprises under majority control are added at 100 % (Annex Articles 3 and 6(2)). A change of size class counts only when a ceiling is crossed in two consecutive accounting periods (Annex Article 4(2)), so one strong year does not bring an entity into NIS2. Article 2(1), second subparagraph, of NIS2 disapplies Annex Article 3(4), the public-body control rule. Municipal and state-owned companies are therefore measured on their own and their group figures, like any private company.

Step 3: Check the Cases Where Size Does Not Matter

Step 3 is to check the cases that NIS2 covers regardless of size: public electronic communications providers, trust service providers, TLD name registries and DNS service providers (Article 2(2)(a)), and central government public administration (Article 2(2)(f)(i)). Recital 7 explains the purpose: small and micro enterprises with a key role also fall within scope.

A Member State may also identify an entity of any size under Article 2(2)(b) to (e). The four grounds are a sole provider of an essential service, a significant impact on public safety, security or health, a significant systemic risk, and specific national or regional importance. Critical entities under the CER Directive (Directive (EU) 2022/2557) are in scope regardless of size (Article 2(3)); Article 6(1) of that Directive required Member States to identify them by 17 July 2026. How the two directives divide the work for those entities is compared under NIS2 vs the CER Directive.

Domain name registration services, meaning registrars and their agents such as resellers and privacy or proxy services (Article 6(22)), are in scope regardless of size (Article 2(4)). Regional public administration entities are covered after a risk-based assessment (Article 2(2)(f)(ii)). Article 2(5) lets Member States add public administration entities at local level and education institutions, in particular those carrying out critical research activities.

Step 4: Work Out the Entity Category

Step 4 is to place the entity in one of the two categories of Article 3: essential under one of the seven routes in Article 3(1)(a) to (g), or important under Article 3(2) if it is of an Annex type and does not qualify as essential. The step 2 ceilings, one class higher, split Annex I: an Annex I entity with 250 or more persons, or a turnover above EUR 50 million and a balance sheet total above EUR 43 million, is essential.

Table 3 sets out the category for each group of entities, including the small telecoms providers and the registrars that a reading of Annex I alone misses.

Both categories carry the same obligations under Articles 20, 21 and 23. They differ in supervision, which is ex ante and ex post for essential entities (Article 32) and ex post only for important entities (Article 33), and in the fines. Member States must provide a maximum of at least EUR 10,000,000 or 2 % of total worldwide annual turnover, whichever is higher, for essential entities (Article 34(4)), and at least EUR 7,000,000 or 1.4 %, whichever is higher, for important entities (Article 34(5)). How audits, inspections and orders differ between the two categories is set out under NIS2 supervision and enforcement.

Step 5: Identify the Member State That Supervises the Entity

Step 5 is to find the Member State with jurisdiction: as a rule the Member State in which the entity is established (Article 26(1)), with three exceptions. Telecoms providers fall under every Member State in which they provide their services (Article 26(1)(a)). The 11 types of Article 26(1)(b) (DNS service providers, TLD name registries, domain name registration services, cloud computing, data centre, content delivery network, managed service and managed security service providers, online marketplaces, online search engines and social networking services platforms) fall under the Member State of their main establishment in the Union. Public administration entities fall under the Member State that established them (Article 26(1)(c)).

The main establishment is where cybersecurity risk-management decisions are predominantly taken, otherwise where cybersecurity operations are carried out, otherwise the establishment with the most employees in the Union (Article 26(2)); the location of servers does not decide (recital 114). Other entities active in more than one Member State fall under separate and concurrent jurisdiction, with ne bis in idem (recital 113). A provider of the 11 types of Article 26(1)(b) that is not established in the Union but offers services there designates a representative (Article 26(3)), and the designation never shields the entity itself (Article 26(4)).

Step 6: Rule Out Exclusions and Sector-Specific EU Acts

Step 6 is to check whether an exclusion removes the entity, or a sector-specific EU act replaces parts of NIS2 for it. Public administration entities that carry out activities in national security, public security, defence or law enforcement are excluded (Article 2(7)), and recital 8 limits this to entities predominantly active in those areas. The judiciary, parliaments and central banks are not public administration entities at all (Article 6(35)), and a trust service provider is never excluded (Article 2(9)).

Member States may exempt specific entities in those areas from Article 21 or 23 (Article 2(8)), and NIS2 does not apply to entities exempted from Regulation (EU) 2022/2554 (DORA) under its Article 2(4) (Article 2(10)). Where a sector-specific act imposes at least equivalent measures or reporting, the matching NIS2 provisions, including the supervision chapter, do not apply (Article 4). For financial entities, DORA displaces Articles 20, 21 and 23 and Chapter VII of NIS2, while Articles 7, 9 and 16 still apply. The details of that overlap are compared under NIS2 vs DORA.

The annexes carve out further activities: root name servers, individual vessels, drinking water and waste water activities that are a non-essential part of the general activity, and waste management that is not the principal economic activity. Micro and small entities stay outside NIS2 unless a step 3 route applies.

Where National Laws Draw the Scope Differently

The three national laws in Table 4 draw the scope differently at five points: negligible side activities, the group data of independent entities, the public bodies covered, the category of critical-infrastructure operators, and enterprises linked to an in-scope entity.

The Directive allows such deviations, because it sets minimum harmonisation (Article 5) and leaves options such as local public administration and education institutions to the Member States (Article 2(5)). Every national act and its status is tracked in the NIS2 transposition tracker.

Selected national scope deviations as of 23 October 2026; the national law decides.

The national law, not the Directive, decides the result for an entity under it. The German BSIG uses its own terms: "besonders wichtige Einrichtung" for an essential entity and "wichtige Einrichtung" for an important entity, while the Austrian NISG 2026 uses "wesentliche Einrichtung" for the essential category.

Scope Topics in Detail: Categories, Size, Exclusions and Jurisdiction

Each step of the test has its own page with the full legal detail, listed in the table below. The eight pages follow the topics of the six steps, each with the provisions it explains.

Proposed Scope Changes and the Status on 2026-10-23

As of 23 October 2026, the scope of NIS2 is the text of 2022: no amending act has been adopted, Member States had to list their essential and important entities by 17 April 2025 and review the lists at least every two years (Article 3(3)), and the Commission must review the Directive by 17 October 2027 (Article 40). Competent authorities also notify the number of entities per sector and subsector every two years (Article 3(5)).

The Commission proposed COM(2026) 13 (procedure 2026/0012(COD)) on 20 January 2026; the proposal is pending. As of 23 October 2026 the EP Legislative Observatory lists the procedure as "Awaiting committee decision", with the ITRE draft report PE792.221 of 24 September 2026 and the amendments PE796.471 of 13 October 2026, and no committee vote. Under the proposal, Annex I entities would be essential only above the small mid-cap ceilings of Recommendation (EU) 2025/1099 (fewer than 750 persons, and a turnover not exceeding EUR 150 million or a balance sheet total not exceeding EUR 129 million), and Annex I small mid-caps would be important. DNS service providers would follow the size-cap rule, providers of European Digital Identity Wallets and European Business Wallets would be essential regardless of size, electricity producers with a generation capacity of 1 MW or less would fall outside Annex I point 1(a), and every non-EU essential or important entity offering services in the Union would designate a representative. Each proposal is tracked under NIS2 amendments and review.

The Commission estimated in its press release IP/26/105 that the proposal would ease compliance for 28,700 companies, including 6,200 micro and small enterprises, and that the small mid-cap category would lower compliance costs for 22,500 companies. Separately, the Article 40 review must assess the relevance of the size of entities and of the Annex sectors, subsectors and entity types, and it repeats every 36 months.

What the Scope Test Does Not Decide

The scope test answers whether NIS2 applies and in which category; it does not make suppliers directly liable, it does not register the entity, and it is not a legal opinion on a named organisation. The three limits are explained below.

Are Suppliers of In-Scope Entities Covered?

Suppliers are not directly obliged by NIS2 unless they pass the test themselves; the in-scope entity must address security in its relationships with its direct suppliers and service providers (Article 21(2)(d)). What that duty means for contracts and supplier assessments is set out under NIS2 supply chain security.

A managed service provider below the size test is outside NIS2 unless a Member State identifies it, but its customers in scope reach it through their contracts.

Does Being in Scope Mean the Entity Is Registered?

No: an entity in scope must itself submit its Article 3(4) data (name, address and up-to-date contact details including email, IP ranges and telephone, sector and subsector, and the Member States where it provides services) and report changes within two weeks. Being in scope and being on the national list are two separate facts.

The 11 types of Article 26(1)(b) also had to submit registry data by 17 January 2025 (Article 27(2)) and report changes within three months (Article 27(3)). Portals and national deadlines are covered under NIS2 registration.

Who Confirms Whether an Entity Is in Scope?

Each entity checks its own status against the national law; only the cases in Article 2(2)(b) to (e) need an identification decision by the Member State, and the national list under Article 3(3) is drawn up by the authorities, not by the entity.

Four official aids support the check. The French ANSSI offers the MesServicesCyber simulator, and the German BSI offers the non-binding NIS-2-Betroffenheitsprüfung. For the size step, the Commission publishes its revised user guide to the SME definition (2020) and an SME self-assessment tool. The Commission Guidelines on Article 3(4), published on 14 September 2023, give the template for the registration data.

The result of a self-check is the start of the work, not its end. The obligations that follow are set out step by step under NIS2 compliance requirements.