Does NIS2 apply to us?

How this is worked out, and what it is not

1. NIS2's scope test as 17 rows, built from the Directive's own words. Rows are read from the top, and the first that matches the answers decides.
2. SQ-03: find what the entity does in Annex I or Annex II of NIS2 and name the sector, the type of entity and the activity it rests on. If activities fit both annexes, answer Annex I, which the table tests first and which gives the stricter result, note the other, and ask counsel.
3. SQ-08: give staff in annual work units, turnover and balance sheet total, counting partner and linked enterprises. The size is worked out from the ceilings of Recommendation 2003/361/EC. You choose a band for each figure, not the figure itself: the size test only compares each figure with these ceilings, so the band gives the same result and nothing more about your organisation is asked. Under 250 staff, give turnover or balance sheet or both: the size depends on them. A figure over its ceiling rules nothing out while the other is blank (Recommendation 2003/361/EC, Article 2: turnover and/or balance sheet), so the second figure is asked for whenever it could change the classification.
4. For a group of companies: NIS2 applies to each legal entity. Answer once for each entity in the group that carries out an Annex I or II activity, and count the group's figures in each one's size.

The result is a statement of what applies, in the workbook's words, never a score. The questions, the answers to choose from and the rule are the workbook's: the same answers give the same result in both. It is not legal advice.

• This document helps you apply NIS2's own tests to your facts. It is not legal advice. National law may add to the Directive or define terms more closely, so confirm the result with counsel before you rely on it. A Commission proposal of January 2026 to amend the Directive, including its scope, is pending before the European Parliament and the Council; it is a proposal, not law, and this document applies the Directive as it stands.
• Rule NR-12: "The national law, the competent authority and its forms must be checked against the Member State's official text, and with counsel, before this pack is relied on and at each annual review."
• Check the national law in force with your competent authority and counsel. A Member State may have transposed NIS2 by amending the law that transposed the earlier NIS Directive rather than by a new one: Cyprus, for example, amended its Security of Networks and Information Systems Law of 2020 (N.89(I)/2020) by Law 60(I)/2025, as the Digital Security Authority's consolidated text showed on 16 October 2026.
• The digital providers that Implementing Regulation (EU) 2024/2690 names (among them cloud, data centre and managed service providers) must also meet the detailed requirements in its Annex. For every other entity it does not apply.
• The Member State where the entity is established has jurisdiction, except for electronic communications providers, the digital providers of Article 26(1)(b) and public administration (Article 26(1)).