Does NIS2 Apply to My Company? How to Check if You're in Scope
The Nisura Team · · Updated
In short: NIS2 applies to your company if you are a medium-sized or larger organisation — broadly, 50 or more employees, or more than €10 million in annual turnover — operating in one of the 18 sectors the Directive covers. A handful of entity types are in scope regardless of size, and even if you’re not directly covered, your enterprise customers are now legally required to assess your security as part of their supply chain.
Don’t assume you’re exempt
In a 2026 survey of 1,001 German companies, 92% of higher-revenue small businesses (10–49 staff but over €10M turnover) wrongly believed NIS2 didn’t apply to them — and 48% of all companies underestimated their obligations. The catch most people miss: turnover alone can put you in scope, even with a small headcount.
Source: Schwarz Digits Cyber Security Report 2026 (survey of 1,001 German companies), as reported by heise online.
The 2-part test
You’re in scope if both are true:
- 1. Sector — you operate in a covered sector (Annex I or Annex II).
- 2. Size — you’re medium-sized or larger (50+ staff, or >€10M turnover / balance sheet).
Plus: some entities are in scope at any size, and member states can add smaller high-risk organisations.
Skip the reading — run the test
Our free NIS2 Scope Checker runs exactly this 2-part test for you: pick your sector and size and it tells you whether you’re an essential entity, an important entity, or out of NIS2 (GDPR only) — with the fines and EU regimes that apply. No login, and only anonymous answers are kept.
Check my NIS2 scope →Step 1: Are you in a covered sector?
NIS2 covers 18 sectors, split into two annexes:
Annex I — sectors of high criticality: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration, and space.
Annex II — other critical sectors: postal & courier services, waste management, chemicals, food, manufacturing (medical devices, computers & electronics, machinery, motor vehicles and other transport equipment), digital providers (online marketplaces, search engines, social networking platforms), and research organisations.
If your core activity isn’t in either list, NIS2 generally doesn’t apply to you directly — but read the supply-chain section below, because it may still reach you.
Step 2: Are you big enough?
NIS2 uses a “size-cap” rule tied to the EU’s standard company-size definitions. It applies to medium and large enterprises:
- In scope: 50 or more employees, or more than €10 million in annual turnover or balance-sheet total.
- Generally out of scope: micro and small enterprises (fewer than 50 staff and €10 million or less) — unless a specific exception applies.
One subtlety most checklists miss: the size test is met on any of the three — staff, turnover, or balance-sheet total — so a firm with a lean headcount and modest turnover can still be in scope on its balance sheet alone. And the balance-sheet ceiling at the large boundary is €43 million, not the €50 million turnover figure (Commission Recommendation 2003/361/EC). Our free NIS2 Scope Checker accounts for all three, and for the size-independent providers below.
Essential or important — which are you?
If you pass both tests, NIS2 classifies you as an essential or important entity. It mostly comes down to size and sector:
| Large (≥250 staff or >€50M) | Medium (50–249 staff) | |
|---|---|---|
| Annex I (high-criticality) | Essential entity | Important entity |
| Annex II (other critical) | Important entity | Important entity |
The label matters: essential entities face proactive supervision (audits, inspections) and fines up to €10M or 2% of turnover; important entities face lighter, after-the-fact supervision and fines up to €7M or 1.4%. Both must meet the same core security duties. For the full breakdown, see our complete guide to NIS2.
In scope regardless of size
Some organisations are covered no matter how small they are, because of the role they play. These include:
- Providers of public electronic communications networks or services
- Qualified and non-qualified trust service providers
- Top-level-domain (TLD) name registries and DNS service providers
- Certain public administration entities
- Entities identified as “critical” under the CER Directive, and sole providers of a service essential to a member state
“I’m a supplier, not in a covered sector — am I safe?”
Not necessarily. NIS2’s supply-chain security requirement (Article 21) forces in-scope enterprises to assess and manage the security of their direct suppliers and service providers. So even if the Directive doesn’t bind you directly, your enterprise customers are now legally obliged to audit you — and a supplier who can’t prove its posture loses the contract. We cover this shift in why mid-market suppliers are losing enterprise contracts under NIS2.
You think you’re in scope — what now?
Start by confirming your classification with the free NIS2 Scope Checker — it gives you the essential/important verdict and the fine ceilings in seconds. Then get an objective read on where you actually stand: map your external attack surface and translate it into concrete financial and compliance exposure, no questionnaire required. See how the Nisura framework automates NIS2 evidence, or run a free CRQ simulation to see your projected exposure and NIS2 liability in euros in minutes.
Sources & official references
- European Commission — NIS2 Directive FAQs and the Commission Guidelines on the application of Article 3(1) and (2) (scope) of Directive (EU) 2022/2555.
- Directive (EU) 2022/2555 (EUR-Lex), Annexes I and II; company-size definitions per Commission Recommendation 2003/361/EC.
Frequently asked questions
Does NIS2 apply to my company?
NIS2 applies if you meet a 2-part test: (1) you operate in one of the 18 covered sectors (Annex I or II), and (2) you are medium-sized or larger — broadly 50+ employees or more than €10 million in turnover or balance-sheet total. Some entity types are in scope regardless of size.
What size company is subject to NIS2?
NIS2 uses a size-cap rule: it applies to medium and large enterprises — 50 or more employees, or more than €10 million in annual turnover or balance-sheet total. Micro and small enterprises are generally out of scope unless a specific exception applies.
Is my company essential or important under NIS2?
Large organisations in high-criticality (Annex I) sectors are essential entities; medium organisations in Annex I, and medium or large organisations in the other critical (Annex II) sectors, are important entities. Essential entities face stricter supervision and higher fines.
Does NIS2 apply to small suppliers?
Even if NIS2 does not bind a small supplier directly, its supply-chain security requirement forces in-scope enterprises to assess their suppliers. So enterprise customers must audit suppliers, and a supplier that cannot prove its security posture can lose the contract.
Which entities are in scope regardless of size?
Certain entities are covered at any size, including providers of public electronic communications, trust service providers, TLD name registries and DNS providers, some public administration entities, and sole providers of a service essential to a member state.