NIS2 guide

Does NIS2 apply to your business?

NIS2 is the EU's main cybersecurity law, Directive (EU) 2022/2555. It covers organisations of certain types that are medium-sized or larger, and a short list of types whatever their size. Many small businesses are outside it but still feel it, because their customers must check the security of their suppliers.

This guide takes you through the tests in the order the Directive sets them. Article numbers refer to the Directive unless it says otherwise.

Last checked 3 November 2026 against the Directive's text on EUR-Lex. This is general information, not legal advice. Each EU country puts NIS2 into its own law, and your national authority has the final word.

1. The short answer

NIS2 applies to you directly when all three of these are true (Article 2(1)):

Your organisation is one of the types listed in Annex I or Annex II of the Directive.
It is a medium-sized enterprise or larger, under the EU's definition of small and medium-sized enterprises.
It provides services or carries out activities in the EU.

A few types are covered at any size (section 4). If you are a small or micro business and not one of those types, NIS2 does not apply to you directly. A customer may still ask you to meet parts of it under your contract (section 6).

2. Test 1: your type of business

The Directive lists the types of organisation it covers in two annexes.

Annex I: sectors of high criticality	Annex II: other critical sectors
Energy (electricity, district heating and cooling, oil, gas, hydrogen); transport (air, rail, water, road); banking; financial market infrastructures; health; drinking water; waste water; digital infrastructure; ICT service management (business-to-business); public administration; space.	Postal and courier services; waste management; chemicals; food production, processing and distribution; manufacturing of medical devices, computer and electronic products, electrical equipment, machinery, motor vehicles and other transport equipment; online marketplaces, search engines and social networks; research organisations.

Read the full entry for your type, not only the heading. Most entries point to a definition in another EU law, and several have limits. Three examples from the annexes:

Food covers food businesses engaged in wholesale distribution and in industrial production and processing. Retail and catering are not named.
Waste management excludes businesses for which waste management is not their principal economic activity.
Manufacturing is defined by the EU's activity codes (NACE Rev. 2, divisions 26 to 30, plus medical devices).

IT companies should look at two entries. Digital infrastructure includes cloud computing, data centre and content delivery network providers. ICT service management covers managed service providers and managed security service providers. A managed service provider is a business that installs, manages, operates or maintains ICT products, networks, infrastructure or applications for customers, on site or remotely (Article 6, point 39). An IT support company that looks after its customers' systems may fit that description.

3. Test 2: your size

NIS2 uses the size categories in the Annex to Commission Recommendation 2003/361/EC. A business is in a category when it is under the staff limit and under at least one of the two money limits.

Category	Staff	Turnover or balance sheet total
Micro	Fewer than 10	€2 million or less
Small	Fewer than 50	€10 million or less
Medium	Fewer than 250	Turnover €50 million or less, or balance sheet total €43 million or less

In practice:

You pass the size test, as medium-sized or larger, if you have 50 or more staff, or if both your annual turnover and your balance sheet total are above €10 million.
You are large, above the medium-sized limits, if you have 250 or more staff, or if your turnover is above €50 million and your balance sheet total is above €43 million.

The Recommendation's counting rules matter at the edges:

Staff are counted in annual work units. Part-time and seasonal workers count as fractions. Owner-managers and partners who work in the business count. Apprentices and students on vocational training contracts do not (Article 5 of the Recommendation's Annex).
Figures come from your latest approved accounts, and turnover is counted without VAT (Article 4(1)).
Crossing a limit changes your category only if it happens in two accounting periods in a row (Article 4(2)).
Groups are counted together. If another business controls yours, or yours controls another, for example through a majority of voting rights, their figures are added in full. Holdings of 25% or more are added in proportion (Articles 3 and 6). So a 30-person subsidiary of a large group can count as large.

For groups, recital 16 of NIS2 lets national authorities take into account how independent a business is from its group, for example whether it runs its own systems and services. Whether your country does so is a question for its law or its authority. The Recommendation's rule that 25% public ownership stops a business being an SME does not apply for NIS2 (Article 2(1)).

4. Covered at any size

These are in scope whatever their size (Article 2(2) to 2(4)):

providers of public electronic communications networks or publicly available electronic communications services;
trust service providers;
top-level domain name registries and DNS service providers;
businesses that provide domain name registration services, which the Directive defines as registrars and their agents, such as resellers and privacy or proxy services (Article 6, point 22);
organisations identified as critical entities under the Critical Entities Resilience Directive, (EU) 2022/2557;
central government bodies, and regional public bodies after a risk assessment.

A country can also bring in a smaller business of an Annex I or II type. That happens if the business is the sole provider of an essential service in that country, if its disruption could seriously affect public safety, security or health or cause a systemic risk, or if it is critical at national or regional level (Article 2(2), points (b) to (e)). In those cases the authority identifies the business. You would not work it out from the Directive alone.

5. Essential or important

Organisations in scope fall into two groups (Article 3).

Essential entities are mainly large Annex I organisations. The group also includes qualified trust service providers, top-level domain registries and DNS service providers of any size, medium-sized or larger public electronic communications providers, central government bodies, critical entities, and anyone a country identifies as essential.
Important entities are every other organisation in scope. A medium-sized Annex I organisation is important. So is any Annex II organisation in scope, unless its country identifies it as essential.

Both groups must take the same security measures (Article 21) and report significant incidents the same way (Article 23). The differences are in supervision and fines:

Authorities can inspect and audit essential entities without waiting for a problem, including random checks and regular security audits (Article 32). Important entities are supervised after the event, when there is evidence that they may not comply (Article 33).
For breaking Article 21 or 23, the maximum fine must be at least €10 million or 2% of worldwide annual turnover, whichever is higher, for essential entities. For important entities it is at least €7 million or 1.4% (Article 34). Countries can set higher maximums.

Countries also keep a list of the organisations in scope. You give your authority your name, address and contact details (including email addresses, IP ranges and telephone numbers), your sector and the EU countries where you provide services. You tell it about changes within two weeks (Article 3(4)). The Directive lets each country set up its own way to register, so check your authority's website.

6. Suppliers outside the scope

If NIS2 does not apply to you, you have no duty under it to take its measures or report incidents, and its supervision and fines do not reach you. Your customers are a different matter.

Every organisation in scope must manage "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers" (Article 21(2)(d)). It must take into account each direct supplier's specific weaknesses and "the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures" (Article 21(3)). Recital 85 encourages it to write security measures into its contracts with direct suppliers.

So a small supplier to a NIS2 organisation may be asked for:

a security questionnaire, often with a request for evidence such as policies or a recent restore test;
contract clauses, for example on multi-factor authentication, backups, telling the customer quickly about incidents, and the customer's right to audit;
updated answers from time to time, for example when the contract is renewed.

Once you sign those clauses, they bind you as contract terms, not as NIS2 itself. A short set of written policies, with evidence that you follow them, answers most questionnaires. Our guide to the ten Article 21 measures lists what customers usually ask about. NIS2 also lets any organisation, in scope or not, report a significant incident, cyber threat or near miss to a national CSIRT or authority on a voluntary basis (Article 30).

7. UK businesses

NIS2 is EU law and is not part of UK law. The UK has its own rules, the Network and Information Systems Regulations 2018, which cover operators of essential services and relevant digital service providers. The Cyber Security and Resilience (Network and Information Systems) Bill would update them. On 3 November 2026 the Bill was still before Parliament.

NIS2 can still reach a UK business in these ways:

An EU subsidiary or branch. Organisations fall under the law of the EU country where they are established (Article 26(1)), whether through a subsidiary or a branch (recital 114). An EU subsidiary of a UK group is tested like any other business there, with the group's figures added (section 3).
Certain digital services offered in the EU. This covers DNS service providers, top-level domain registries, domain name registration services, cloud computing, data centres, content delivery networks, managed service providers, managed security service providers, online marketplaces, search engines and social networks. If such a business is not established in the EU but offers services there, it must name a representative in one of the EU countries where it offers them (Article 26(3)). The size test still applies, apart from the any-size types in section 4.
Public electronic communications. Providers fall under each EU country where they provide their services (Article 26(1)(a)).
Your EU customers. Even if none of the above applies, customers in scope may ask you to meet parts of NIS2 under contract (section 6).

Our guide NIS2 and UK businesses covers the UK's own rules and each of these routes in more detail.

8. What to do next

Find your type in Annex I or II, and read the full entry.
Work out your size from your last two sets of approved accounts, with any group figures added.
Check whether you are one of the any-size types in section 4.
Check your national law, your authority and its registration portal. If you work in several EU countries, Article 26 decides which country's law applies to you.
If you are in scope, start on the Article 21 measures and get ready for incident reporting. If you are not, prepare for your customers' questionnaires.

Our NIS2 Small-Entity Compliance Kit includes a Scope Check sheet that walks through these tests and records your conclusion, along with the policies and registers that the measures call for.

9. Sources

Directive (EU) 2022/2555 (NIS2), EUR-Lex: Articles 2, 3, 6, 21, 26, 30, 32 to 34, recitals 16, 85 and 114, Annexes I and II.
Commission Recommendation 2003/361/EC, EUR-Lex: the size categories (Annex, Articles 2 to 6).
The Network and Information Systems Regulations 2018, legislation.gov.uk.
Cyber Security and Resilience (Network and Information Systems) Bill, UK Parliament: stage on 3 November 2026.