Whether NIS2 applies to your company comes down to two questions, your sector and your size, with a layer of exceptions where size does not count. Which EU member state you operate in then shapes how and when the obligations bite. The checker below works through the scope criteria in Article 2 of the NIS2 Directive (EU) 2022/2555 and the sectors listed in Annexes I and II.
It takes about two minutes. Answer the questions and you get a clear in-scope or out-of-scope result, the entity classification that applies to you (essential or important), and the penalty ceiling that comes with it.
Built for compliance officers, risk managers and COOs at EU-based companies who need a documented starting point for a NIS2 assessment. This is not legal advice. For complex group structures or cross-border operations, verify the output with qualified legal counsel before relying on it for formal reporting.
The Checker Settles Sector and Size, Not Jurisdiction
The checker applies the scope criteria in Article 2 of NIS2, the sector definitions in Annex I and Annex II, and the size floor drawn from the Annex to Recommendation 2003/361/EC. The headcount test always applies. Of the two financial ceilings, only one has to be met, so a company stays small at fewer than 50 staff with turnover or balance sheet total within €10 million, and crosses into scope once both exceed it. It also applies the size-independent categories in Articles 2(2) to 2(4), which bring certain entities into scope regardless of headcount or revenue. Those include providers of public electronic communications networks and services, trust service providers whether qualified or not, top-level domain registries and DNS providers, entities providing domain name registration services, sole providers of a service essential to a member state, entities whose disruption could induce significant systemic risk, public administration entities, and critical entities designated under the CER Directive (EU) 2022/2557.
Two limits are worth stating plainly. Size is calculated from the figures you enter for a single period, while Article 4(2) of the SME Annex changes a size tier only where the position holds over two consecutive accounting periods, so a first year above a ceiling does not settle the question on its own. Group structure is the other. Where linked or partner enterprises push a small company over the threshold on combined figures, the checker relies on you entering the consolidated numbers, and an out-of-scope result based on standalone figures is not final. The full scope explainer works through both calculations.
Where your organisation is a DNS provider, TLD registry, cloud provider, data centre, CDN, managed service provider, managed security service provider, or a provider of online marketplaces, search engines or social networking platforms, the result screen sets out the Article 27 registry submission and the Article 26 jurisdiction rule that attach to those categories specifically.
A proposal to amend NIS2 is moving through the legislative process, published by the Commission on 20 January 2026 as COM(2026) 13 final under procedure 2026/0012(COD). This tool reflects the directive as it stands. The proposed changes are covered in the FAQ below, and none of them are law yet.
Frequently Asked Questions
Does NIS2 apply to companies outside the EU?
Yes, in some cases. NIS2 reaches entities that provide covered services within the EU regardless of where they are established. For the digital categories named in Article 26(1)(b), such as DNS providers, cloud providers, managed service providers and online marketplaces, a company based outside the Union that offers those services inside it falls under the jurisdiction of the member state of its main establishment in the Union, and Article 26(3) requires it to designate a representative in a member state where it offers services if it has no establishment there. Where no representative is designated, any member state in which the entity offers services may bring legal proceedings against it. Simply selling goods into the Union is usually not enough on its own, because that is not one of the listed services. The market, not the head office, decides.
What is the difference between an essential entity and an important entity under NIS2?
The category follows from sector, size and in several cases activity type, not from sector alone. Large entities in Annex I sectors are essential. Medium entities in Annex I are important. Entities in Annex II are important whether they are medium or large. On top of that, Article 3(1) makes some entities essential regardless of size, including qualified trust service providers, TLD registries and DNS providers, medium-sized providers of public electronic communications, central government public administration entities, CER critical entities, and entities a member state has designated under Article 2(2)(b) to (e). Note the word qualified in that list. A non-qualified trust service provider is in scope regardless of size but is classified by size like anyone else. The substantive obligations under Article 21 are the same for both categories. The difference is supervision. Essential entities face proactive oversight under Article 32 and can be inspected without a prior incident. Important entities are supervised under Article 33, after an incident or complaint.
My company has fewer than 50 employees. Are we exempt?
Usually yes, but not always, and there are three ways the answer turns out to be no. First, headcount is only half the test. A small enterprise employs fewer than 50 people and stays within €10 million on turnover or on balance sheet total, so a 40-person company that exceeds €10 million on both is not small and is in scope. Second, Articles 2(2) to 2(4) list categories in scope regardless of size, including sole providers of a service critical to a member state, entities whose disruption would carry significant cross-border effects, DNS providers, TLD registries and trust service providers. Third, size is measured across the group. Under Articles 3 and 6 of the Annex to Recommendation 2003/361/EC, linked and partner enterprises are aggregated, in full for linked enterprises and pro rata for partners, so a small subsidiary of a large group can clear the threshold on the group’s numbers even when its own payroll would keep it under. One rule runs the other way. Article 2(1) NIS2 disapplies Article 3(4) of that Annex, so a company keeps its SME status even where public bodies control 25% or more of the capital or voting rights.
Which sectors does NIS2 cover?
Annex I lists eleven high-criticality sectors: energy (electricity, oil, gas, hydrogen, district heating), transport (air, rail, water, road), banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure (internet exchange points, DNS providers, TLD registries, cloud providers, data centres, CDNs, trust service providers, public electronic communications networks), ICT service management (managed service providers, managed security service providers), public administration, and space.
Annex II lists seven other critical sectors: postal and courier services, waste management, manufacture and distribution of chemicals, food production and distribution, manufacturing (medical devices, computers and electronics, electrical equipment, machinery, motor vehicles and other transport equipment), digital providers (online marketplaces, online search engines, social networking platforms), and research organisations.
What are the penalties if NIS2 applies and we are not compliant?
Essential entities face fines up to €10 million or 2% of global annual turnover, whichever is higher. Important entities face fines up to €7 million or 1.4% of global annual turnover, whichever is higher. Those figures in Article 34 are floors for the national maximum, so a member state can set higher ceilings when it transposes.
Personal liability is the part most boards miss. Under Article 20(1), the management body has to approve the cybersecurity risk measures and can be held liable for the entity’s failures. For essential entities, Article 32(5)(b) lets a competent authority ask a court to bar a chief executive or legal representative from management functions until the gaps are fixed. Several member states have added their own management liability provisions in transposition, so the ceiling that binds you is the national one rather than the EU floor.
When did NIS2 become law, and where does enforcement stand in 2026?
NIS2 entered into force on 16 January 2023, and the transposition deadline for member states was 17 October 2024. Most member states have since enacted national implementing legislation. On 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify full transposition, asking for a lump sum and daily penalties under Article 260(3) TFEU (we track the case in our note on the NIS2 court referral). The Dutch Senate had adopted the Cyberbeveiligingswet the day before, on 7 July 2026, with entry into force on 15 August 2026, which is how close to the wire these cases run. The correct posture is to treat NIS2 as live and enforced rather than as something still being phased in. Our NIS2 transposition status for all 27 member states tracks the date each national law entered into force and how many days late each state was.
What is the January 2026 Commission proposal, and does it change my NIS2 status?
Not yet. On 20 January 2026 the Commission published COM(2026) 13 final, a targeted amendment to NIS2 within a wider cybersecurity package, aimed at clearer scope and simpler compliance. The Commission estimates it would ease compliance for 28,700 companies, including 6,200 micro and small enterprises.
The changes that touch scope are the ones to watch. The proposal would remove micro and small DNS providers through a size cap, remove chemical distributors while keeping chemical manufacturers in, add operators of submarine data cable infrastructure and European Digital Identity Wallet providers regardless of size, and create a lighter-touch small mid-cap category treated as important rather than essential. It also adds ransomware reporting detail under Article 23 and would require post-quantum cryptography migration in national strategies. The proposal is still in the legislative process under procedure 2026/0012(COD), with adoption expected in late 2026 or 2027 and a transposition period of one year to follow. Until then the directive in force applies, which is what this checker reflects.
Does NIS2 replace GDPR for cybersecurity incidents?
No. The two run in parallel and cover different obligations. GDPR governs personal data and requires breach notification to the data protection authority within 72 hours. NIS2 governs network and information system security and requires, under Article 23(4), an early warning to the national CSIRT within 24 hours, an incident notification within 72 hours, an intermediate report if the CSIRT asks for one, and a final report within one month of the notification. Trust service providers notify within 24 hours rather than 72 where the incident affects the provision of their trust services. Where an incident involves personal data, both sets of obligations apply at once.
We operate across several EU member states. Which authority do we report to?
As a rule, the authority in each member state where you are established, which means an entity with subsidiaries in three states answers to three authorities. Article 26 sets two exceptions that consolidate this. Providers of public electronic communications networks and services fall under the jurisdiction of each member state where they provide the service. DNS providers, TLD registries, cloud providers, data centres, CDNs, managed service providers, managed security service providers, online marketplaces, search engines and social networking platforms fall under the jurisdiction of their main establishment in the Union, which is normally where the decisions on cyber risk measures are mainly taken. For that second group the single-authority rule is the point of the provision.
A Confirmed Result Points Straight to Article 21
If the checker puts you in scope, the work starts with mapping your current security measures against the ten risk-management requirements in Article 21(2) of NIS2, and if you are one of the entity types in Article 27(1) the registry submission runs alongside it. Incident handling, supply chain risk and access control are where most mid-market organisations have the widest gaps. Where your member state has set a compliance or audit deadline, document what you have done and when, because supervisory authorities are moving from preparatory conversations to formal inspections. For the reasoning behind each question in the checker, read our full explainer on whether NIS2 applies to your company.
Not sure where your organisation stands on the EU AI Act? Take the free RegDossier AI Act Readiness Assessment to identify your highest-priority gaps.
This tool provides general guidance based on Directive (EU) 2022/2555 (NIS2), Article 2 and Annexes I and II. It is not legal advice. Consult qualified legal counsel for your specific situation.