NIS2 scope: is your organisation in scope?

Two classes of entity

NIS2 splits in-scope organisations into essential entities and important entities. Both must meet the same core security obligations, but essential entities face proactive supervision, while important entities are supervised reactively (after an incident or evidence of non-compliance).

Covered sectors

The directive covers around 18 sectors, split across two annexes:

• High-criticality sectors (Annex I): energy, transport, banking, financial market infrastructure, health, drinking and waste water, digital infrastructure, ICT service management, public administration and space.
• Other critical sectors (Annex II): postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research.

The size threshold

As a general rule, NIS2 applies to medium-sized organisations and above in covered sectors — broadly those with at least 50 staff or €10 million in turnover. Large entities in high-criticality sectors are typically essential; medium ones and most Annex II entities are important.

How to check

1. Identify whether your activities fall in an Annex I or II sector.
2. Check whether you meet the size threshold, or an exception applies.
3. Determine your class (essential or important).
4. Confirm against your national transposition — the details vary by country.

If you are unsure, treat it as a "verify", not an "assume out". Being wrongly out of scope is a costly mistake.