NIS2 Size Thresholds: The Size-Cap Rule, Medium and Large Enterprises and Partner Companies

The same test one class higher (250 or more staff, or a turnover above EUR 50 million and a balance sheet total above EUR 43 million) separates essential from important entities in Annex I.

The rule sits in Article 2(1) of Directive (EU) 2022/2555 and borrows its ceilings from the Annex to Commission Recommendation 2003/361/EC. The Directive binds the Member States (Article 46), so an organisation applies the size test of the NIS2 Directive through the national law that transposes it.

Size is counted in annual work units and from the latest approved accounts, partner and linked enterprises are added, four of the five national laws compared here adjust the size test, three routes bring in entities of any size, and one pending proposal would add a new size class. The table below summarises the size test point by point.

What Is the NIS2 Size-Cap Rule?

The size-cap rule is the uniform scope criterion of Article 2(1) of Directive (EU) 2022/2555: the Directive covers public or private entities of a type listed in Annex I or II that qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed its ceilings, and that provide services or carry out activities in the Union. Recital 7 of the Directive text on EUR-Lex calls it a "uniform criterion" replacing the NIS1 designation of operators of essential services.

Three conditions apply cumulatively: the entity is of an Annex I or II type, it is medium-sized or larger, and it provides services or carries out activities in the Union. An organisation that fails any one of the three stays outside NIS2 unless a size-independent route applies, and the parent page explains all three conditions as the NIS2 size rules and the entity test.

Why Does NIS2 Use the SME Definition of Recommendation 2003/361/EC?

NIS2 borrows the SME definition of Recommendation 2003/361/EC of 6 May 2003 (OJ L 124, 20.5.2003, p. 36) so that one EU-wide size test applies in every Member State. The instrument is a Commission Recommendation, notified under document number C(2003) 1422, not a regulation, and NIS2 makes its Annex binding for scope purposes by reference. One part of that Annex is switched off: Article 2(1), second subparagraph, of NIS2 disapplies Annex Article 3(4) on public-body control, which the section on publicly owned companies below explains.

What Are the Size Thresholds for Medium-Sized and Larger Enterprises?

Recommendation 2003/361/EC sets three size classes by staff headcount and two financial ceilings, and NIS2 starts at the medium-sized class: fewer than 250 persons with a turnover not exceeding EUR 50 million and/or a balance sheet total not exceeding EUR 43 million. Micro and small enterprises fall outside the size-cap and enter NIS2 only through the size-independent routes below. The table below sets the three classes of the Recommendation text on EUR-Lex beside the enterprises that exceed its medium-sized ceilings.

How Do Headcount, Turnover and Balance Sheet Combine?

An enterprise is at least medium-sized when it has 50 or more staff, or when its annual turnover and its balance sheet total both exceed EUR 10 million. The same pattern applies at the top: an enterprise exceeds the medium-sized ceilings with 250 or more staff, or with a turnover above EUR 50 million and a balance sheet total above EUR 43 million (Article 3(1)(a) NIS2 with Annex Article 2(1)).

One financial figure alone never decides the class. The "and/or" wording of Annex Article 2 means an enterprise stays within a ceiling as long as either its turnover or its balance sheet total stays within it, so a high turnover with a modest balance sheet does not move the enterprise up. Staff headcount works differently: headcount alone lifts an enterprise into the next class. "Large" is plain English for "exceeds the medium-sized ceilings"; the Directive itself never uses the term "large enterprise". The four examples below apply both tests.

Which Ceiling Separates Essential from Important Entities?

The medium-sized ceilings also split Annex I entities: an Annex I entity that exceeds them is essential, one that only reaches them is important, and Annex II entities are important at both sizes unless a Member State designates them. The two categories are listed below.

• Essential: Annex I entities above the medium-sized ceilings (Article 3(1)(a)); see essential entities under NIS2.
• Important: medium-sized Annex I entities and Annex II entities of qualifying size (Article 3(2)); see important entities under NIS2.

Both categories carry the same Article 20, 21 and 23 duties; the difference lies in supervision (Article 32 ex ante and ex post, Article 33 ex post only) and in the fine maximums.

How Are Staff, Turnover and Balance Sheet Counted?

Three figures decide the size class, and the Annex to Recommendation 2003/361/EC fixes how each is counted: staff in annual work units, turnover excluding VAT and other indirect taxes, and the balance sheet total, all from the latest approved annual accounts. All three include partner and linked enterprises.

Annual Work Units: Who Counts as Staff

Staff headcount is measured in annual work units (AWU): one person working full time for the whole reference year counts as one unit. Annex Article 5 of Recommendation 2003/361/EC sets three counting rules, listed below.

• Part-time work, seasonal work and work for part of the year count as fractions of one unit.
• Apprentices and students in vocational training are not counted.
• Periods of maternity or parental leave are not counted.

A company with more than 50 people on its payroll can therefore stay below 50 AWU once part-time contracts, apprentices and parental leave are taken into account.

Reference Period, the Two-Year Rule and New Enterprises

The figures come from the latest approved accounting period, calculated on an annual basis (Annex Art. 4(1)). An enterprise gains or loses a size class only when it exceeds or falls below a ceiling over two consecutive accounting periods (Annex Article 4(2)), so a single strong year does not bring an enterprise into NIS2. A newly established enterprise without approved accounts uses a bona fide estimate made in the course of the financial year (Annex Article 4(3)). Germany applies the same two-year reading: the BSI FAQ on § 28 BSIG states that a first-time crossing of a threshold counts only after two consecutive financial years, except for newly founded companies.

How Do Partner and Linked Enterprises Change an Entity's Size?

An entity is measured together with its group: Recommendation 2003/361/EC adds a share of the figures of partner enterprises and all figures of linked enterprises before the thresholds are applied. A subsidiary with 20 staff is therefore not a small enterprise when its parent has 400 staff.

Autonomous, Partner and Linked Enterprises

Three relationships exist under Article 3 of the Annex: autonomous (no holding of 25 % or more either way), partner (25 % or more of capital or voting rights without control) and linked (majority control). The three types are defined below.

• Autonomous enterprise: neither holds 25 % or more of another enterprise's capital or voting rights, nor is held at that level by another (Annex Article 3).
• Partner enterprise: holds 25 % or more of the capital or voting rights of another enterprise, or is held at that level, without being linked (Annex Article 3(2)).
• Linked enterprise: holds a majority of the voting rights, has the right to appoint or remove a majority of the board, exercises a dominant influence by contract or articles of association, or controls a majority of voting rights under a shareholder agreement (Annex Article 3(3)(a) to (d)).

Two investor types, business angels and small local authorities, do not make an enterprise a partner: business angels investing less than EUR 1,250,000 in the same enterprise (Annex Article 3(2)(a)) and autonomous local authorities with an annual budget under EUR 10 million and fewer than 5,000 inhabitants (Annex Article 3(2)(d)), provided they are not linked to it.

How Group Figures Are Added

Partner figures are added pro rata to the percentage of capital or voting rights, whichever is greater, and linked figures are added at 100 % (Annex Art. 6(2)). The 100 % rule covers the data of directly or indirectly linked enterprises not already included through consolidation. Both calculated examples below use staff figures; turnover and balance sheet are added in the same proportion.

Independence from the Group under Recital 16

Recital 16 of NIS2 lets Member States take into account an entity's independence from its partner or linked enterprises, in its network and information systems and the services it provides, when they apply Article 6(2) of the Annex. A recital is not an operative article, so the effect depends on whether the national law writes an independence clause into its text. Germany, Austria and Italy do so, as the national section below shows.

Publicly Owned Companies and the Public-Body Control Rule

Article 3(4) of the Annex, under which an enterprise 25 % or more controlled by public bodies cannot be an SME, does not apply for NIS2 (Art. 2(1), second subparagraph). Municipal and state-owned companies, such as a municipal water utility or a regional transport operator, are therefore measured on their own and their group figures like any private company. Public ownership alone never makes a company large under NIS2.

How Do National Laws Apply the Size Thresholds?

The five national laws in the table below apply the Directive's size-cap through their own provisions, and the laws of Germany, Austria, Estonia and Italy depart from it in four places: group independence clauses (Germany, Austria, Italy), negligible side activities (Germany), linked enterprises covered regardless of size (Italy) and, in Estonia, a stricter combination of headcount and money. Germany, Austria and Denmark restate the Directive's thresholds. The transposition status of all 27 Member States is listed in the NIS2 transposition tracker.

A size result calculated under the Recommendation alone is therefore checked against the national act, which binds the organisation (Article 46), and each country page names that act, the authority and the registration channel.

When Does Size Not Decide Whether NIS2 Applies?

Size does not decide scope in three groups of cases: entity types the Directive covers regardless of size, entities a Member State identifies under Article 2(2)(b) to (e), and critical entities under Directive (EU) 2022/2557. A fourth group sits outside NIS2 whatever its size, under the exclusions of Article 2(7). The cases are compared below.

Small and micro entities enter NIS2 only through these routes, which is how Member States reach small entities with a key role, as recital 7 asks. Article 6(1) of Directive (EU) 2022/2557 required Member States to identify critical entities by 17 July 2026, and Article 2(5) NIS2 lets national law add local public administration and education institutions. Every route is explained article by article on the page on entities covered regardless of size.

How to Check Your Organisation's Size Classification

Run the size test in five steps, in this order, and keep the figures and the legal basis of each step on file. The five steps are listed below.

1. Identify the entity type in Annex I or II, starting from the NACE codes and Annex I and II where the Annex refers to them.
2. Count staff in annual work units and take turnover (excluding VAT) and the balance sheet total from the latest approved accounts (Annex Articles 4(1) and 5).
3. Add 25 % or larger partner holdings pro rata and linked enterprises at 100 % (Annex Article 6(2)).
4. Apply both tests, 50 AWU or EUR 10 million and EUR 10 million, then 250 AWU or EUR 50 million and EUR 43 million, to two consecutive closed financial years (Annex Article 4(2)).
5. Check the national law for independence or negligible-activity clauses, run the NIS2 scope check, and complete the NIS2 registration with the Article 3(4) data if the entity is in scope.

What Changes Are Proposed for the Size Thresholds?

One pending proposal would change the size rules: COM(2026) 13 of 20 January 2026 (procedure 2026/0012(COD)) would add a small mid-cap class taken from Recommendation (EU) 2025/1099, and as of 23 October 2026 it is pending, with the European Parliament at the stage "Awaiting committee decision" according to the EP Legislative Observatory. A small mid-cap under Recommendation (EU) 2025/1099 of 21 May 2025 is not an SME, has fewer than 750 persons, and has a turnover not exceeding EUR 150 million or a balance sheet total not exceeding EUR 129 million. Under the proposal, Annex I entities would be essential only above the small mid-cap ceilings, Annex I small mid-caps would be important, and DNS service providers would follow the size-cap instead of being covered regardless of size.

The Commission estimated in its press release IP/26/105 that the proposal would ease compliance for 28,700 companies, including 6,200 micro and small enterprises, and that the small mid-cap category would cover 22,500 companies. Separately, Article 40 NIS2 requires a Commission review by 17 October 2027 that assesses the relevance of entity size; both are tracked under NIS2 amendments and review.

Size Threshold Questions

Five questions recur about the NIS2 size thresholds.

Does NIS2 apply to companies with fewer than 50 employees?

Only in three situations: an enterprise with fewer than 50 staff is outside the size-cap unless, after its partner and linked figures are added, it reaches 50 staff or both its turnover and its balance sheet total exceed EUR 10 million, or a regardless-of-size route applies.

Is a company with 50 employees automatically in scope?

Yes, if the 50 are annual work units in the latest approved accounts and the organisation is of an Annex I or II type that operates in the Union. A change of size class counts only after two consecutive accounting periods.

Do subsidiaries of a large group fall under NIS2?

Often yes: a subsidiary with fewer than 50 staff counts its parent's and sister companies' figures at 100 %, so a member of a large group is usually medium-sized or larger, unless a national independence clause applies. In Germany the BSI treats an intra-group IT provider with administrative access to group companies' systems as one of the managed service providers, a national interpretation.

Which official tools help calculate enterprise size?

The Commission's revised user guide to the SME definition (2020) and its SME self-assessment tool, both on the Commission SME definition page, explain the counting. ANSSI's MesServicesCyber simulator states the NIS2 thresholds in the correct and/or form.

Does crossing a threshold once bring an entity into scope?

No: a status changes only when a ceiling is crossed in two consecutive accounting periods (Annex Art. 4(2)).