How do we work out which Member State's NIS2 rules apply to us, and whether we need an EU representative?

Start

We work across borders and are unsure which NIS2 rules reach us

NIS2 does not apply to a company in general. It applies to entities, and the rule that says which Member State has jurisdiction over each entity depends on where it is established and on what kind of entity it is. Being a customer-facing business in the EU is not the test. Work entity by entity.

• Then: List each legal entity, where it is established and what it does

Step

List each legal entity, where it is established and what it does

Take the group structure and write one line per legal entity: its country of establishment, the services it provides and the Member States it serves. The pack says NIS2 applies to each legal entity in a group and that each registers on its own. Establishment means real activity through stable arrangements; a branch or a subsidiary can both count.

• Then: Have you decided which of these entities are in scope?

Decision

Have you decided which of these entities are in scope?

Jurisdiction only matters for an entity that is in scope. Scope is a separate question with its own test: sector, size and the national designations. If the answer is not known for an entity, settle it first.

• Yes: Is the entity established in the Union?
• No, or not known: Decide scope for each entity first, then come back

Outcome

Decide scope for each entity first, then come back

Run the scope assessment for each entity that might carry out an activity in the Directive's annexes. Return here with the entities that are in scope or might be. Do not work out jurisdiction for an entity that is clearly out of scope.

Decision

Is the entity established in the Union?

The general rule in the Directive is that an entity falls under the Member State where it is established. An entity with no establishment in any Member State is handled by a different rule, which applies only to certain kinds of provider.

• Yes: Is it a communications provider, a public body or a digital provider?
• No, or not known: Is it one of the listed digital provider types?

Decision

Is it a communications provider, a public body or a digital provider?

The Directive makes exceptions to the general rule for three groups: providers of public electronic communications networks or services, public administration entities, and DNS, domain name, cloud computing, data centre, content delivery, managed service, managed security service, online marketplace, search engine and social networking platform providers.

• Yes, or not known: Is it one of the listed digital providers?
• No: Use the Member State where it is established

Step

Use the Member State where it is established

For an ordinary entity the Member State of establishment has jurisdiction. If one entity is established in, or serves, more than one Member State, the Directive's recitals expect each of them to have concurrent jurisdiction and to cooperate. Ask counsel how that applies to you.

• Then: Record the Member State and the reason, for each entity

Decision

Is it one of the listed digital providers?

The listed digital providers fall under one Member State, chosen by where their main establishment in the Union is. Other Member States may still act on a request for help from that one. The other two exception groups have their own simpler rules, which the next step sets out.

• Yes: Find the main establishment in the Union
• No: Use the rule for its group

Step

Find the main establishment in the Union

The Directive puts it in the Member State where decisions on the cybersecurity risk-management measures are predominantly taken. If that cannot be found, or those decisions are taken outside the Union, it is where cybersecurity operations are carried out; failing that, where its establishment with the most employees in the Union is. Where the physical systems sit is not the test. Record the facts you relied on.

• Then: Record the Member State and the reason, for each entity

Step

Use the rule for its group

A provider of public electronic communications falls under the Member State in which it provides its services. A public administration entity falls under the Member State that established it. Confirm which group the entity belongs to with counsel before you rely on the result.

• Then: Record the Member State and the reason, for each entity

Decision

Is it one of the listed digital provider types?

Only these types must designate a representative in the Union when they are not established there: DNS service, TLD name registry, domain name registration, cloud computing, data centre, content delivery network, managed service, managed security service, online marketplace, online search engine and social networking platform providers.

• Yes: Does it plan to offer services to people in Member States?
• No: No representative duty under this rule; do not appoint on a guess

Decision

Does it plan to offer services to people in Member States?

The Directive's recitals say mere access to a website or an email address from the Union is not enough. A language or currency used in Member States with a way to order in it, or naming customers in the Union, can show the plan. If it is not known, answer yes and ask counsel.

• Yes, or not known: Designate a representative in a Member State where you offer services
• No: No representative on this ground; revisit if you offer services

Step

Designate a representative in a Member State where you offer services

The Directive says the representative must be established in one of those Member States. Its recitals say the representative acts under a written mandate from the entity, including for incident reporting. The entity then falls under the jurisdiction of the Member State where the representative is. Without one, any Member State where it provides services may take legal action. Registration also needs the representative's details.

• Then: Record the Member State and the reason, for each entity

Outcome

No representative on this ground; revisit if you offer services

Record the facts that show you do not plan to offer services in the Union. Review the record when you add a language, a currency, an EU price list or EU customers to your marketing. Do not say you are outside NIS2 for all purposes: a customer may still ask you for terms.

Outcome

No representative duty under this rule; do not appoint on a guess

The representative rule names only the digital provider types above. Having customers in the EU does not by itself make a company appoint a NIS2 representative. Whether any Member State claims a hold over you is a question for counsel. Customers who are in scope may still ask for security terms in your contract. If the entity is a provider of public electronic communications networks or services, a different rule applies: it falls under the Member State where it provides those services, whether or not it is established in the Union. Take that to counsel.

Step

Record the Member State and the reason, for each entity

For each in-scope entity write the Member State, the rule that put it there and the facts behind it, and have counsel confirm. The pack's Member State check sheet is the place that holds the answer for each point and its official source.

• Then: Does any entity answer to more than one Member State?

Decision

Does any entity answer to more than one Member State?

An entity serving or established in several Member States can face separate and concurrent jurisdiction. A group can also have different entities answering to different Member States. In both cases you may deal with more than one authority.

• Yes, or not known: Plan how you deal with each authority
• No: Check what each Member State's law adds and register where required

Step

Plan how you deal with each authority

Keep one contact for each authority and tell them about each other where the law allows. The Directive expects the authorities to cooperate. Its recitals also say Member States that exercise jurisdiction should not impose enforcement measures or penalties more than once for the same conduct. That is a recital, not an Article, and it does not remove your duty to each authority. Keep the same facts in every registration.

• Then: Check what each Member State's law adds and register where required

Step

Check what each Member State's law adds and register where required

Each Member State transposes the Directive in its own law, so the route, deadline and extra fields differ. Take the method in the national-law question and the registration question, and keep the official source for every answer.

• Then: Has the group structure, a service or the place of decisions changed?

Decision

Has the group structure, a service or the place of decisions changed?

Jurisdiction follows facts that move: a new entity, a new country served, or cybersecurity decisions that shift to another place. Review the record at least yearly and on any such change.

• No: Each entity has a Member State, a reason and a counsel-checked record
• Yes: List each legal entity, where it is established and what it does (back to an earlier step)

Outcome

Each entity has a Member State, a reason and a counsel-checked record

Keep the list, the reasons and counsel's confirmation. Do not state that you are "compliant in Europe", or that one Member State's approval covers the others. Review when the structure changes.