2026 Threat Intelligence: Most EU breaches now end in ransomware.

Free tool · 30 seconds

Am I in scope for NIS2?

NIS2 scope comes down to two things: your sector and your size. Pick them below to see whether you're an essential entity, an important entity, or out of NIS2 (GDPR only) — and which EU regimes govern your cyber liability.

Classified by the EU NIS2 size-cap rules. We keep your anonymous answers (sector and size only — never your name, email or IP) to improve this tool. Privacy.

Your verdict appears here — sector + size decide it, exactly as the NIS2 Directive does.

How this is decided

NIS2 (Directive (EU) 2022/2555) applies the EU size-cap rule (Commission Recommendation 2003/361/EC): entities in a high-criticality (Annex I) sector are essential if they exceed the large-enterprise ceiling (≥250 staff, or >€50M turnover, or >€43M balance-sheet total), otherwise important. Entities in other critical (Annex II) sectors are important when at least medium-sized (≥50 staff, or >€10M turnover or balance-sheet total). Size is met on any of those — note the balance-sheet ceiling is €43M at the large boundary, not €50M. Micro and small entities fall outside NIS2 (GDPR still applies) unless they are a size-independent provider (DNS/TLD, trust service, public comms, public administration), which are essential at any size. This tool is an indicative classification, not legal advice — the exact Annex sub-sector mapping and member-state transposition can still change the outcome. Confirm with counsel.