NIS2 scope: is your organisation in scope?

The scope test in one sentence

Article 2(1) of Directive (EU) 2022/2555 puts an organisation in scope when three things are true at the same time: it is a public or private entity of a type referred to in Annex I or Annex II; it qualifies as a medium-sized enterprise under Article 2 of the Annex to Recommendation 2003/361/EC, or exceeds the ceilings for medium-sized enterprises set in paragraph 1 of that Article; and it provides services or carries out activities in the Union.

Two refinements matter most: size is measured across corporate groups, not per legal entity, and many entity types are in scope regardless of size.

The 18 sectors

NIS2 lists exactly 18 sectors in the Annexes to Directive (EU) 2022/2555 – 11 in Annex I (high criticality) and 7 in Annex II (other critical sectors). The annex you sit in does not change your security obligations. It changes which side of the essential/important line you start on, and therefore how you are supervised.

Annex I – sectors of high criticality

1. Energy
2. Transport
3. Banking
4. Financial market infrastructures
5. Health
6. Drinking water
7. Waste water
8. Digital infrastructure
9. ICT service management (business-to-business)
10. Public administration
11. Space

Annex II – other critical sectors

1. Postal and courier services
2. Waste management
3. Manufacture, production and distribution of chemicals
4. Production, processing and distribution of food
5. Manufacturing
6. Digital providers
7. Research

Read the annexes against what you actually do, not how the company describes itself: Annex I includes ICT service management (business-to-business) and Annex II includes digital providers. For a sense of why the list is drawn this wide, ENISA analysed 4,875 incidents between 1 July 2024 and 30 June 2025 for its 2025 Threat Landscape.

The size test, and why “50 staff” is the wrong shorthand

The directive borrows its thresholds from Recommendation 2003/361/EC, by reference to medium-sized. Article 2 of that Annex sets the categories: SMEs employ fewer than 250 persons with turnover not exceeding EUR 50 million and/or a balance sheet total not exceeding EUR 43 million; a small enterprise employs fewer than 50 persons with turnover and/or balance sheet total not exceeding EUR 10 million; a microenterprise employs fewer than 10 persons with figures not exceeding EUR 2 million.

For an Annex I or II activity covered by the general size rule, the threshold is normally reached with 50 or more staff, or with both annual turnover and balance-sheet total above EUR 10 million. An enterprise with fewer than 50 staff can remain small if either financial measure stays within EUR 10 million. Apply the accounting-period, partner and linked-enterprise rules, then check the regardless-of-size exceptions and national implementation.

Size categories and the NIS2 position

Category	Staff	Financial criteria (with staff criterion)	NIS2 position
Micro	Fewer than 10	Turnover and/or balance-sheet total not exceeding EUR 2 million	Normally out of scope unless Article 2(2) to 2(4) applies
Small	Fewer than 50	Turnover and/or balance-sheet total not exceeding EUR 10 million	Normally out of scope, same caveat
Medium	Fewer than 250	Turnover not exceeding EUR 50 million and/or balance sheet total not exceeding EUR 43 million	In scope if a covered Annex I/II activity; class depends on Article 3
Large	250 or more	Or above the medium-sized ceilings	In scope if a covered Annex I/II activity; normally essential if Annex I

Partner and linked enterprises count towards your figures

Articles 3 and 6 of the same Annex distinguish autonomous, partner and linked enterprises. Partner holdings generally start at 25%, subject to specified exceptions; their figures are usually included proportionately. Linked enterprises are generally aggregated in full. A twenty-person subsidiary may therefore exceed the small-enterprise threshold, but its answer depends on the group figures and applicable aggregation rules.

The second subparagraph of Article 2(1) adds a twist: Article 3(4) of the Annex to that Recommendation shall not apply here. Article 3(4) is the rule that would otherwise deny SME status where 25% or more of the capital or voting rights is held by public bodies. Switching it off means public ownership alone does not push an entity out of the SME categories – size is answered on the aggregated figures, and public bodies are caught by the sector rules instead.

In scope regardless of size

Article 2(2) covers the following whatever their size; Articles 2(3) and 2(4) add two more categories.

Covered regardless of size

Article	Entities covered
2(2)(a)	Providers of public electronic communications networks or of publicly available electronic communications services (i); trust service providers (ii); TLD name registries and DNS service providers (iii)
2(2)(b)	The sole provider in a Member State of a service essential for critical societal or economic activities
2(2)(c)	Entities where disruption of the service could significantly impact public safety, public security or public health
2(2)(d)	Entities where disruption could induce significant systemic risk, in particular with cross-border impact
2(2)(e)	Entities critical because of their specific importance at national or regional level
2(2)(f)	Public administration entities of central government, or at regional level where a risk-based assessment shows significant impact
2(3)	Entities identified as critical entities under the CER Directive (EU) 2022/2557
2(4)	Entities providing domain name registration services

The exclusions are narrower than people hope. Article 2(7) takes out public administration entities working in national security, public security, defence or law enforcement; Article 2(10) takes out entities exempted from DORA under DORA Article 2(4). Running the other way, Article 2(5) lets Member States extend the Directive to local-level public administration and to education institutions, in particular where they carry out critical research activities.

Essential or important

The two classes are defined in Article 3, and only one of them has a list. Article 3(1) names the essential entities.

Essential entities under Article 3(1)

Article 3(1)	Essential entity
(a)	Annex I entities exceeding the ceilings for medium-sized enterprises – the large ones
(b)	Qualified trust service providers, TLD name registries and DNS service providers, regardless of size
(c)	Providers of public electronic communications networks or of publicly available electronic communications services that qualify as medium-sized
(d)	Public administration entities of central government under Article 2(2)(f)(i)
(e)	Entities a Member State identifies as essential under Article 2(2)(b) to (e)
(f)	Critical entities under Directive (EU) 2022/2557
(g)	Where a Member State so provides, entities it identified as operators of essential services under the original NIS Directive before 16 January 2023

Article 3(2) then defines important entities as Annex I or Annex II entities that are not essential under Article 3(1). “Important” is the residual class, not a second list to check yourself against: an in-scope Annex I or II entity outside Article 3(1) is important. Domain registration services also have specific Article 28 duties; do not assume that Article 2(4) alone creates the full essential/important classification.

Check sector-specific rules too

Article 4 of NIS2 provides for sector-specific Union rules with equivalent risk-management or reporting requirements to take precedence over the corresponding NIS2 provisions. DORA is treated as such a sector-specific act for relevant financial entities under DORA Article 1(2). Appearing in an NIS2 annex does not mean a financial entity must duplicate every incident report under both regimes. Check the applicable national and sector rules.

What the classification actually changes

Not the security measures. Both classes owe the same Article 21 obligations and the same Article 23 reporting duties, so arguing your way from essential to important does not shrink the control set – the ten measures are identical, and they are set out in the Article 21 guide.

What changes is supervision. Article 32(2) gives competent authorities their powers over essential entities as part of ordinary supervision. For important entities, Article 33(1) requires Member States to ensure authorities act “where necessary, through ex post supervisory measures” when “provided with evidence, indication or information that an important entity allegedly does not comply”. That is the legal basis for the shorthand: essential entities are supervised proactively, important entities reactively.

So do the fines. Under Article 34(4), an essential entity infringing Article 21 or 23 faces administrative fines of a maximum of at least EUR 10 000 000 or at least 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which it belongs, whichever is higher. Article 34(5) requires an important-entity national maximum of at least EUR 7 000 000 or 1.4%, again whichever is higher. These are minimum levels for national maximum fines, not EU-wide caps. National law, the undertaking’s turnover and the circumstances determine exposure.

You have to register, and keep it current

Article 3(3) required Member States to establish a list of essential and important entities, and of entities providing domain name registration services, by 17 April 2025, reviewed at least every two years. Member States may establish self-registration mechanisms, so the list is often populated by entities coming forward rather than by an authority finding them.

Article 3(4) sets out what you submit: at least name, address and up-to-date contact details including email addresses, IP ranges and telephone numbers; the relevant sector and subsector; and the Member States where you provide in-scope services. Changes must be notified without delay and no later than two weeks after the change. The IP range requirement catches people out – a scoping exercise has to end in an accurate external footprint, not just a legal opinion.

How to run the check

1. Map your activities against Annex I and Annex II service by service.
2. Aggregate headcount and financials across partner and linked enterprises under the Recommendation, including its exceptions before applying the size test.
3. Ask whether any Article 2(2), 2(3) or 2(4) trigger applies regardless of size – the step most often skipped.
4. Classify under Article 3(1). If an in-scope Annex I or II entity is not essential, it is important under Article 3(2). Check domain-registration duties separately.
5. Read your national transposition for Article 2(5) extensions and the registration channel.
6. Register under Article 3(4), and give the two-week change notification a named owner.

If the answer is close, treat it as “verify”, not “assume out”. The cost of being wrongly out of scope is not a missing policy document; it is the applicable national sanctions applied to a programme you never started. Once scope is settled, the compliance checklist is a practical way to organise evidence for review.