NIS2 Compliance Proof for MSPs Is an Evidence Pack Because No Certificate Exists

A client has sent you a questionnaire and asked for NIS2 compliance proof. There is no certificate to send, because Directive (EU) 2022/2555 never created one. What the directive does create is an obligation on your client to form a view about you, which is a smaller thing than sixty rows of a spreadsheet. Before any of that matters, there is a prior question the questionnaire does not ask, which is whether you are a regulated entity yourself.

What Do I Send When a Client Asks for NIS2 Compliance Proof

Send a short covering note and four attachments, and say in the note that none of them is a NIS2 certificate, because the directive does not create one. The work runs in this order.

1. Establish whether you are a regulated entity yourself. Managed service providers sit in sector 9 of Annex I, and Article 2(1) puts scope at 50 staff, or at more than €10 million on turnover and balance sheet total at the same time.
2. If you are below that, the questionnaire binds you through your contract rather than through the directive. That is a different negotiating position from a statutory duty, and it is worth knowing before you answer.
3. Your client’s duty under Article 21(2)(d) and Article 21(3) is to assess you. It is not a duty to collect certificates from you, which is why a proportionate answer is a complete answer.
4. The pack is your scope position, your controls mapped to the Annex to Implementing Regulation (EU) 2024/2690, the incident notification commitment your client can actually rely on, and your own supply chain policy.

The wording to paste into your reply sits in the sample below. Everything between here and there is the reasoning that lets you send it with a straight face.

Managed Service Providers Are Named in Annex I Sector 9, Not Annex II

Managed service providers and managed security service providers appear by name in sector 9 of Annex I, under the heading ICT service management (business-to-business). Annex II covers postal and courier services, waste, chemicals, food, manufacturing, digital providers in the narrow sense of online marketplaces, search engines and social networking platforms, and research.

Article 6(39) defines a managed service provider as an entity providing services related to the installation, management, operation or maintenance of ICT products, networks, infrastructure, applications or other network and information systems, through assistance or active administration, on customer premises or remotely. Article 6(40) adds that a managed security service provider is an MSP carrying out or assisting with activities relating to cybersecurity risk management.

Filing providers under Annex II, which at least one MSP-facing guide does, is not a cosmetic slip. Only entities of a type listed in Annex I become essential entities under Article 3(1)(a), so a large provider misfiled under Annex II would come out as important instead, and that is the difference between the ex ante supervision of Article 32 and the ex post regime of Article 33. At the medium threshold the substantive duties under Articles 21 and 23 are the same either way. Being named in the annex does not put you in scope by itself. Size does that.

Scope Starts at 50 Staff, or at €10 Million on Both Financial Measures

NIS2 applies from the medium-sized enterprise threshold upwards. Article 2(1) borrows the definitions in the Annex to Recommendation 2003/361/EC, where a small enterprise employs fewer than 50 people and whose annual turnover and/or annual balance sheet total does not exceed €10 million. Only one of the two financial ceilings has to hold. A provider crosses into scope at 50 staff, or by exceeding €10 million on turnover and €10 million on balance sheet total at the same time. A 40-person provider running €12 million of turnover and a €14 million balance sheet total is in scope and will be surprised to hear it.

Above that line the directive splits providers in two. Either 250 or more staff, or turnover above €50 million together with a balance sheet total above €43 million, exceeds the medium ceilings and makes you an essential entity under Article 3(1)(a). Anything from medium up to that point is an important entity under Article 3(2). Article 34 attaches the numbers to that split, with a maximum of at least €10 million or 2% of total worldwide annual turnover for essential entities and at least €7 million or 1.4% for important entities, whichever is higher in each case.

Two rules inside the Recommendation change the answer for real companies. Article 6 of its Annex consolidates staff and financial figures across linked and partner enterprises, so a 30-person subsidiary of a large group can lose SME status on paper alone. Article 4(2) then says that crossing a ceiling only changes your status if it holds over two consecutive accounting periods, and NIS2 switches off only Article 3(4) of that Annex, the rule that would otherwise strip SME status from a company where public bodies control 25% or more of the capital or voting rights. A provider with a municipal or state co-owner keeps its SME status for NIS2 purposes. If the headcount, the accounts and the ownership chart are not all in front of you, the NIS2 applicability checker walks the same thresholds in about two minutes. The longer treatment of the scope test sits in does NIS2 apply to my company.

Below the Threshold the Questionnaire Binds You Contractually, Not Statutorily

If you are small or micro and no national authority has designated you, the questionnaire binds you only as far as your contract does. Article 2(2)(a) catches certain entities regardless of size, and the list is providers of public electronic communications networks and services, trust service providers, and TLD name registries and DNS service providers. Managed service providers are not on it.

That is not a guarantee. Article 2(2)(b) to (e) lets a member state pull a small provider in where it is the sole provider of a service essential to critical societal or economic activities, where disruption could significantly affect public safety, security or health, where it could induce systemic risk, or where it is critical at national or regional level. The decision belongs to the state, not to you, so the honest position is probably out of scope, subject to checking whether your national authority has designated you.

Knowing which side of that line you sit on changes the conversation with the client. A contractual obligation has a scope you agreed to and can discuss. A statutory one does not.

A UK provider is a partial exception rather than a clean one. NIS2 does not apply in the United Kingdom, the domestic Network and Information Systems Regulations 2018 remain in force, and the Cyber Security and Resilience Bill introduced in the House of Commons on 12 November 2025 is still in passage. Serving EU clients is the part that catches people out. Article 26(1)(b) places managed service providers and managed security service providers under the jurisdiction of the member state where they have their main establishment in the Union, and Article 26(3) requires a provider of that type with no establishment in the Union to designate a representative in a member state where it offers services, failing which any of those states may take legal action against it directly. Size still governs, so a small UK provider stays out. A UK provider above the threshold serving EU clients answers to an EU authority as well as to its contract.

Article 21(2)(d) Asks Your Client to Assess You, Not to Collect Certificates From You

Article 21(2)(d) requires entities to hold measures covering supply chain security, including security-related aspects of the relationships between the entity and its direct suppliers or service providers. Article 21(3) then says what they weigh, which is the vulnerabilities specific to each direct supplier, the overall quality of their products and cybersecurity practices, and their secure development procedures, alongside the results of the coordinated security risk assessments of critical supply chains carried out under Article 22(1).