Article 26Jurisdiction and territoriality
1. Entities falling within the scope of this Directive shall be considered to fall under the jurisdiction of the Member State in which they are established, except in the case of:
(a) providers of public electronic communications networks or providers of publicly available electronic communications services, which shall be considered to fall under the jurisdiction of the Member State in which they provide their services;
(b) DNS service providers, TLD name registries, entities providing domain name registration services, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, as well as providers of online marketplaces, of online search engines or of social networking services platforms, which shall be considered to fall under the jurisdiction of the Member State in which they have their main establishment in the Union under paragraph 2;
(c) public administration entities, which shall be considered to fall under the jurisdiction of the Member State which established them.
2. For the purposes of this Directive, an entity as referred to in paragraph 1, point (b), shall be considered to have its main establishment in the Union in the Member State where the decisions related to the cybersecurity risk-management measures are predominantly taken. If such a Member State cannot be determined or if such decisions are not taken in the Union, the main establishment shall be considered to be in the Member State where cybersecurity operations are carried out. If such a Member State cannot be determined, the main establishment shall be considered to be in the Member State where the entity concerned has the establishment with the highest number of employees in the Union.
3. If an entity as referred to in paragraph 1, point (b), is not established in the Union, but offers services within the Union, it shall designate a representative in the Union. The representative shall be established in one of those Member States where the services are offered. Such an entity shall be considered to fall under the jurisdiction of the Member State where the representative is established. In the absence of a representative in the Union designated under this paragraph, any Member State in which the entity provides services may take legal actions against the entity for the infringement of this Directive.
4. The designation of a representative by an entity as referred to in paragraph 1, point (b), shall be without prejudice to legal actions, which could be initiated against the entity itself.
5. Member States that have received a request for mutual assistance in relation to an entity as referred to in paragraph 1, point (b), may, within the limits of that request, take appropriate supervisory and enforcement measures in relation to the entity concerned that provides services or which has a network and information system on their territory.
NIS2, the European Union directive on network and information security, Article 26
Which Member State has jurisdiction over an entity in scope. The default is the Member State where it is established. There are three exceptions: providers of public electronic communications networks or publicly available electronic communications services fall under the State where they provide their services; public administration entities fall under the State that established them; and DNS service providers, TLD name registries, domain name registration service providers, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, online marketplaces, online search engines and social networking platforms fall under the State where they have their main establishment in the Union.
Main establishment is where decisions on cybersecurity risk-management measures are predominantly taken; failing that (or if those decisions are not taken in the Union), where cybersecurity operations are carried out; failing that, where the establishment with the most employees in the Union is.
An entity of those digital types that is not established in the Union but offers services there must designate a representative established in one of the Member States where services are offered, and falls under that State’s jurisdiction. Without one, any Member State where it provides services may take legal action for infringement.
For the digital types, a single main establishment in the Union fixes jurisdiction.
What is in the packs for this
From NIS2 Implementation & Readiness. Each one helps with this requirement.
NIS2 Scope & Entity Classification AssessmentExcel
Question SQ-10 and the Result record the Member State where the entity is established and where it provides services in scope, which decides whose law applies.
NIS2 Competent Authority Registration Data SheetExcel
Row MS-01 of the Member State Check records the Member State where the entity is established, whose law and authority apply.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.