Does NIS2 apply to us? Scope check steps

Does NIS2 apply to us? The short answer and what changes it

NIS2 applies to organizations in one of the 18 sectors listed in Annex I or Annex II of Directive (EU) 2022/2555, unless a size-independent rule or a sector-specific law says otherwise. As a rule, an entity must be at least a medium-sized enterprise and provide services or carry out activities in the EU. The national law that transposes the Directive into the Member State where the entity is established is the final test, because Member States may extend the scope or adopt stricter rules. Customers, contracts and regulators often ask this question because NIS2 flows down the supply chain, so an organization outside scope may still be asked to meet security obligations by an in-scope customer. The answer depends on three things: the sector and entity type, the size of the entity measured against the Recommendation 2003/361/EC thresholds, and the group structure, since Recital 16 lets Member States consider independence from partner and linked enterprises. A subsidiary of a large group may look small on paper yet be treated differently under national law. Only the organization and its national competent authority can confirm scope. Ask your legal counsel to read the transposing law of each Member State where you operate, and check whether any sector-specific rules, such as DORA for financial entities, displace NIS2 for part of your activity.

The scope decision belongs to the organization. It is recorded in its own documentation and, where required, its registration with the competent authority. DeployOpen does not issue scope determinations, legal opinions or registration confirmations. Where a sound answer depends on your entity list, group chart and turnover and headcount figures, we can help you assemble the facts a counsel or authority will ask for, and document the reasoning. Changes matter too: the Commission proposed targeted amendments on 20 January 2026 that would add a new small mid-cap category, but that proposal is not adopted law, so re-check scope against the law in force on the date you decide.

How to run the NIS2 scope check in five steps

This sequence turns the question "does NIS2 apply to us" into a documented yes, no or unclear for each test, so the organization can show how it reached its conclusion before it commits budget or registers with a national authority.

Confirm the sector and entity type
Start by matching the organization's core activities to the sectors in Annex I (11 sectors of high criticality) and Annex II (7 other critical sectors) of Directive (EU) 2022/2555. Write down the specific entity type that matches each activity, not just the sector name, because the annexes list entity types within each sector. Compliance or legal staff should own this step, with a technical lead confirming the services actually delivered. The output is a short table of matched sectors and entity types, each marked yes, no or unclear, with the document excerpts or service descriptions used to decide.
Apply the size rule under Recommendation 2003/361/EC
For an entity matching an annex category, test whether it is at least a medium-sized enterprise under Commission Recommendation 2003/361/EC, which sets staff and turnover or balance sheet ceilings for small and medium enterprises. Count staff and financial figures at the level the recommendation requires, and check whether the entity has partner or linked enterprises that change the calculation. Where the entity belongs to a larger group, record how independence from that group was assessed, since the recommendation and recital 16 of NIS2 both bear on subsidiaries. The output is a documented size determination with the figures and the source of each figure.
Check size-independent categories
Even when an entity is below the medium-sized threshold, test whether it falls into a category covered regardless of size under Article 2(2) to (4). These include public electronic communications providers, trust service providers, TLD registries, DNS service providers, domain name registration services, and entities a Member State has identified as sole providers or critical. Assign this check to the person who knows the service portfolio, and confirm any Member State designation in writing with the national authority if the entity is unsure. The output is a yes, no or unclear for each category, with the service or designation that supports the answer.
Check whether DORA or another sector law displaces NIS2
Determine whether a sector-specific EU law takes precedence. Financial entities covered by DORA follow DORA's ICT risk-management and incident reporting rules instead of NIS2's under Article 4 and recital 28, so banks, insurers and other covered financial entities need a separate confirmation. Review other sector laws the entity is subject to, since the national transposition law may also set rules. Legal counsel should confirm the reading, and the output is a documented note on each displacing law, whether it applies in full or in part, and which NIS2 duties remain.
Confirm jurisdiction and registration duties
Establish which Member State has jurisdiction. Most entities fall under the Member State where they are established, but cloud, data center, CDN, managed service, DNS, TLD and online platform providers fall under the Member State of their main EU establishment, and non-EU providers must appoint an EU representative under Article 26. Then check the national transposition law and the national authority's registration process, including the registration details and IP ranges required by Article 3(4) and the two-week notification of changes. Ask the national authority or local counsel to confirm the current list and deadlines. The closing output is a jurisdiction and registration record that states the answer, the authority contacted, and the date the position was last confirmed.

Sector, size and the medium-sized threshold

A NIS2 scope check runs in parallel: the entity must fall within an Annex I or Annex II sector, clear the size rule or belong to a size-independent category, and be established where the national law applies. Each card below covers one test and the points where organizations most often misjudge their position.

Annex I or Annex II entity type

Start by matching your activity to an entity type listed in Annex I (11 sectors of high criticality) or Annex II (7 other critical sectors). Check the exact entity definition in the Annex, not the sector name alone, because a company can operate in an energy or transport sector without being a listed entity type. Record the matching Annex line and the reason it fits, since your supervisor will ask for the same reasoning.

Medium-sized ceiling test

As a rule, an entity must be at least a medium-sized enterprise under Recommendation 2003/361/EC to be in scope. Medium-sized means fewer than 250 staff with annual turnover up to EUR 50 million or a balance sheet up to EUR 43 million. Measure headcount and financials using the rules in the recommendation, and confirm the figures with your finance team before you conclude you are outside scope.

Small enterprise exclusion

A small enterprise has fewer than 50 staff and annual turnover or balance sheet total of no more than EUR 10 million. Falling below the medium-sized line generally takes an entity out of scope, but only under the general rule. Size-independent categories such as trust service providers, TLD registries and DNS service providers stay in scope regardless of headcount, so check those categories before relying on size.

Group membership and independence

Recital 16 allows Member States to consider an entity's independence from partner or linked enterprises when they apply the size calculation. A subsidiary of a large group can therefore be assessed differently from a standalone company with the same headcount. Ask your national authority or legal adviser how the national law treats linked and partner enterprises, and document the ownership and headcount figures you used.

Essential or important classification

Annex I entities above the medium-sized ceilings are generally essential, and most other in-scope entities are important unless the Member State designates them as essential. The label changes how supervision works: essential entities face ex ante supervision, while important entities face ex post supervision. The risk-management and reporting duties are the same for both, so confirm the label in your national law before planning your supervisory engagement.

Which entities are in scope regardless of size

Some organizations fall under NIS2 even when they are too small to meet the medium-sized test. Article 2(2) to (4) of Directive (EU) 2022/2555 names categories that are in scope whatever their headcount or turnover: public electronic communications providers, trust service providers, top-level domain (TLD) name registries, DNS service providers and domain name registration services. The Article also lets a Member State bring in entities it identifies as sole providers of a service that is essential to society, or as critical entities under its own assessment. If your organization operates in any of these roles, the size test does not give you an exit, and the size-based analysis in the rest of this section should not be used to rule you out.

The practical first step is to confirm which category, if any, describes your activity and then check how your national authority has applied it. The categories are defined in the Directive, but the list of identified entities is drawn up at national level, and the national transposition law sets the final test. Ask your national competent authority or sector regulator whether you appear on, or have been asked to register for, a list of sole or critical providers. Also check whether a DNS, registry or trust service activity you run for others is part of your core service or a side function, because that answer changes which authority supervises you and what evidence it will request.

Size-independent scope also changes how you plan. Where an entity is in scope regardless of size, the decision to treat it as essential or important is not automatically the same as for a large Annex I entity, so confirm the classification with your national law before you size the program. Record the basis for your decision, including the category you relied on, the national list you checked and the date you checked it. This record is the first document an authority will ask for when it reviews your scope, and it is cheap to keep current while the national rules are still settling.

DORA, other sector laws and which country applies

Financial entities that DORA covers do not follow NIS2's ICT risk-management and incident reporting rules. Article 4 of NIS2 and recital 28 provide that these entities apply DORA's requirements for ICT risk management and incident reporting in their place. The carve-out is about which rules govern ICT risk and incident reporting, so a financial entity should not assume it is outside NIS2 altogether until its national law and supervisor confirm how the overlap is handled.

Scope of DORA: Confirm whether your licence or activity falls within the financial entity types covered by Regulation (EU) 2022/2554, such as credit institutions, investment firms or insurers.
Replaced obligations: DORA's ICT risk-management and incident reporting rules take the place of the corresponding NIS2 duties for covered entities.
Remaining NIS2 questions: Ask your national authority whether any NIS2 registration or other duties still apply to your entity.
Critical ICT third-party providers: Vendors that serve financial entities may face separate obligations, so check their status before assuming the supply chain is covered.
Documentation: Keep a written record of the DORA analysis, including the date and the authority contacted, for supervisors.

Confirm the treatment of your entity type with your national competent authority and your legal counsel, because the transposition law sets the final position.

Why companies outside scope still get NIS2 requirements

A company can fall outside NIS2 and still receive NIS2 requirements in its contracts. The reason is Article 21(2)(d), which requires in-scope entities to manage security in their relationships with direct suppliers and service providers. Your customers cannot outsource that duty, so they pass it down to you as clauses, questionnaires and audit requests. Being outside scope does not change that flow. It only changes who is legally answerable to the national authority.

In practice, expect a security questionnaire before or during renewal, a request for evidence such as policies, access reviews, vulnerability management records and backup test results, and contract terms covering security baselines, incident notification to the customer within a set period, subcontractor disclosure and the customer's right to audit or assess you. Some customers will ask you to name your EU representative or confirm where your data is hosted. Read each request and sort it into two piles: items you already produce as normal operations, and items that need a new process or document. The second pile is where your planning effort goes.

Your response shapes the relationship, so decide how far you will go before the first questionnaire arrives. Confirm with each customer whether it is an in-scope entity under the national law where it is established, because the national transposition law, not the Directive alone, sets its obligations. Agree which evidence you will share and under what confidentiality terms, and which requests you will answer with a self-assessment rather than a full audit. Staying outside scope does not remove the contractual obligations, so treat these requests as a standing customer commitment rather than a one-off form.

Registration with the national authority and what to submit

This sequence takes an entity from a scope decision to a registration record on file with its competent authority, with a named contact who can answer questions and receive notices. Each step ends with a document or check that proves it is complete.

Confirm the entity is in scope and identify its Member State
Before registering, confirm that your entity falls within an Annex I or Annex II sector and meets the size and establishment tests. Under Article 2(1), the general rule is medium-sized status or above with services or activities in the EU, while some entity types apply regardless of size. Most entities register with the authority of the Member State where they are established, but cloud, data center, CDN, managed service, DNS, TLD and online platform providers follow the rule for their main EU establishment under Article 26. Your output is a short scope memo that names the Member State and the legal basis for each in-scope service.
Find the national registration portal and deadline
NIS2 is applied through national transposition laws, so the registration route, forms and deadlines are set by your Member State. Check the competent authority's website and the national transposition law for the portal, the submission deadline and any language requirements. Confirm the rule for your entity type with the authority itself or with counsel familiar with that law. The output is a note recording the portal address, the deadline your national law sets and the name of the authority that receives your submission.
Check the digital provider deadline if you are one
The digital providers listed in Article 27 were required to register by 17 January 2025. If your entity is one of them, confirm whether it was registered by that date and, if not, check with the authority how a late registration is handled under your national law. Entities outside Article 27 should not assume this date applies to them. The output is a written confirmation of your category and of the date your registration was made or is due.
Assemble the registration details, including IP ranges
Article 3(4) requires in-scope entities to give their competent authority registration details, including the IP ranges the entity uses. Gather the legal name, registered address, sector and subsector, contact details, the list of Member States where services are provided, and the public IP address ranges for your systems. Your network team should confirm these ranges against the current routing and cloud account inventory so they are accurate on submission. The output is a single registration record that operations and legal can both sign off.
Name the contact who receives authority communications
Assign a named contact who receives authority correspondence, answers information requests and is responsible for keeping the registration current. This person should have the authority to speak for the entity on security matters and access to the management body's decisions. Record the role, the mailbox and a deputy in case the primary contact leaves. The output is a named contact entry in the registration record, with the deputy recorded and the internal owner of the process documented.
Submit the registration through the national portal
Enter the assembled details into the national portal or send them through the channel your authority specifies, following its form and format. Keep a copy of the submitted record, the date of submission and any reference number the portal issues. If the portal asks for information not in your record, check whether it is required before you submit rather than entering an estimate. The output is a submitted registration with a confirmation or reference that you store with your compliance evidence.
Set a process to notify changes within two weeks
Article 3(4) requires in-scope entities to notify changes to their registration details within two weeks. Changes include new IP ranges, a new registered address, a new contact and a change in the Member States where services are provided. Assign an owner for each change type, link the process to cloud onboarding, network changes and personnel changes, and set a review that compares the registration with the live inventory. The output is a documented change procedure and a record of the last reconciliation between the registration and your systems.
Ask the authority for confirmation of your status
Once submitted, ask the competent authority to confirm in writing that your registration is recorded and that your entity type and supervision regime are as you understand them. Ask also what the authority expects to see from you next, such as entity list updates or information requests. Several authorities will not issue a certificate because NIS2 has none, so a written acknowledgement or portal status is the evidence to file. The output is that acknowledgement, held with the scope memo and the registration record.

Common misreadings that lead to the wrong answer

Most wrong answers to the scope question come from a handful of shortcuts: reading only the Directive, measuring one company instead of the group, and trusting a proposal as if it were law. Each card below names one of these errors and the check that catches it before it reaches a board paper or a supplier questionnaire.

Reading the Directive alone

NIS2 is a directive, so obligations reach an entity through the national transposition law of the Member State that applies. A reading of Directive (EU) 2022/2555 that stops at the Annexes can give the wrong answer, because the national law may be stricter under Article 5 or may extend coverage. Check the transposition law of each Member State where you operate, and record the article number that places you in scope.

Measuring only the legal entity

The size test looks at the enterprise, and a subsidiary of a large group can be assessed on its own headcount and turnover only if the rules allow it. Recital 16 lets Member States consider independence from partner and linked enterprises, so a small-looking subsidiary may still be captured. Pull the group structure, identify linked and partner enterprises, and document the calculation the national authority would accept.

Treating a non-EU parent as out of scope

A company headquartered outside the EU can still fall under NIS2 when it provides services or carries out activities in the EU. For cloud, data center, CDN, managed service, DNS and online platform providers, the relevant Member State is that of the main EU establishment, and non-EU providers must appoint an EU representative. Confirm where your EU customers are served, which establishment is main, and whether a representative is required.

Confusing the proposed mid-cap category with law

The Commission proposed a new small mid-cap category on 20 January 2026 in COM(2026) 13. That proposal still needs approval by the European Parliament and the Council, so it does not change who is in scope today. Scope decisions should rest on the rules currently in force in the relevant national law. Track the proposal as a possible future change and ask counsel to re-test your position if it is adopted.

Assuming public bodies and schools are exempt

Article 2(5) allows Member States to extend NIS2 to local public administration and education institutions, so a municipality or university can be in scope even if it looks unlike a company. Whether this applies depends entirely on the national transposition law, not on the Directive's default wording. Ask the national competent authority or the relevant ministry whether local public bodies and education institutions are covered, and keep the written answer on file.

Skipping the DORA displacement check

Financial entities covered by DORA follow DORA's ICT risk-management and incident reporting rules instead of NIS2's. Organizations that assume a bank or insurer is automatically covered by NIS2 often miss this displacement, or assume both regimes apply in full. Map each ICT obligation to the governing regime, confirm with the financial supervisor where the line falls, and note any sector-specific law that replaces NIS2 for that entity.

What to do if the answer is still unclear

If the scope check leaves you undecided, the usual next step is a written scope memo that records each test you ran: sector and entity type against Annexes I and II, the size-cap rule under Article 2(1) and the Recommendation 2003/361/EC thresholds, any size-independent category, any sector-specific law such as DORA that may displace NIS2, and the Member State where you are established. Record the facts you relied on, such as headcount, turnover and balance sheet figures for the relevant financial year, and whether group companies are linked to you in a way that affects the SME calculation. Have counsel review the memo, and where the national transposition law leaves room for interpretation, ask the competent authority of the relevant Member State for its view. Keep the memo current, because a change in size or structure can change the answer.

Be careful about the January 2026 proposal. The Commission's amendments to NIS2 (COM(2026) 13), including a new small mid-cap category, are a proposal and not adopted law. Until the European Parliament and the Council approve them, the current Directive and your national transposition law set the thresholds. If a borderline case depends on the proposed category, record it as a watch item, state the rule you are applying today, and review the memo when the legislative text changes. Confirm the current status on the Commission's pages before you rely on it.

An independent advisor can prepare the scope analysis, gather evidence, and draft the memo, and an outside view often helps with borderline cases. The advisor cannot make the determination for you. The organization's management body owns the decision on whether NIS2 applies, and it should approve the memo and record its reasons. When you request a quote, ask for a fixed-scope deliverable that lists the entity tests covered, the national law reviewed, and the decision record handed over to your board.

Questions buyers ask before deciding on NIS2 scope

Does a customer requirement mean we are in scope for NIS2?

Not necessarily. A customer clause tells you that your customer has to manage supply chain risk under NIS2, which is a different question from whether NIS2 applies to your own company. The Directive places its direct obligations on entities that fall within its Annexes I and II and meet its size and establishment tests. Many suppliers are outside scope but still receive security requirements passed down by in-scope customers under Article 21(2)(d). Ask your customer which entity they believe you are, and whether the requirement is contractual or a legal duty that applies to you directly. Then check your own sector, size and EU footprint against the national law where you are established, since that law is the final test.

What does a NIS2 scope check need from us?

A scope check needs accurate facts about your organization, not a long project. Prepare your legal entity structure, the sectors and services you provide, your headcount, annual turnover and balance sheet total, your group ownership and any partner or linked enterprises, and where your services are delivered in the EU. Your national competent authority or the transposition law will define the exact tests, so collect the texts of those laws early. The time a check takes depends mainly on how many entities and jurisdictions are involved and how quickly your finance and legal teams can confirm the figures. Ask any adviser for the scope check deliverable and its assumptions in writing before work starts.

Can we determine our NIS2 scope ourselves?

Yes, many organizations start with an internal check, provided someone with legal and governance authority owns the answer. The steps are to map your sector against Annexes I and II, apply the size rule of Article 2(1) using the SME definition in Recommendation 2003/361/EC, check the size-independent categories in Article 2(2) to (4), confirm whether a sector law such as DORA displaces NIS2 under Article 4, and check the national transposition law for your Member State. Where the answer is unclear, for example for a subsidiary of a large group where Recital 16 on independence applies, a legal opinion is usually the better purchase. An implementation partner can prepare the supporting data, but the organization must keep the decision and the record of it.

What does a consultant do that the authority does not?

A consultant helps you apply the rules to your facts, while the national competent authority decides how the law is enforced against you. NIS2 creates no certificate of compliance, so no consultant can issue a scope confirmation that binds an authority. A consultant or legal adviser can gather data, analyze the sector and size tests, document assumptions and prepare your registration information. The authority is the body that receives registrations, sets supervision and imposes measures. Be cautious of any vendor who presents a scope letter as an official determination. Ask instead who will sign the scope decision internally and which regulator guidance it relies on.

Does the proposed small mid-cap category change our answer?

Not today. On 20 January 2026 the Commission proposed targeted amendments to NIS2 (COM(2026) 13), including a new small mid-cap category that it says would lower compliance costs for 22,500 companies. The proposal still needs approval by the European Parliament and the Council, so it is not adopted law and the current size rules still apply. If you are close to a size threshold, record your current answer under the existing rules, note the proposal in your review plan, and check its status before any decision that depends on it. Follow the Commission's proposal page and your national authority's communications for changes as they are adopted.

What happens if we are in scope but missed registration?

You should register as soon as you identify the gap, because registration is a legal duty and the consequences of silence grow the longer it lasts. In-scope entities must give their competent authority registration details, including IP ranges, and notify changes within two weeks under Article 3(4). Digital providers listed in Article 27 had to register by 17 January 2025. The exact sanctions, supervision and any administrative fines depend on your national transposition law, and Article 34 sets maximum fine levels that national law applies. Your first step is to confirm the registration route and deadline with your authority, document how the omission happened, and prepare the information it requests. Legal advice is advisable before you contact the authority about a past gap.

How DeployOpen supports the scope decision

DeployOpen helps organizations work through the NIS2 scope check by scoping the self-hosted open-source platforms and systems that sit inside their own infrastructure. The organization decides whether it is in scope, and DeployOpen prepares the technical records and documentation that support that decision.

How we scope

Written scope agreed before work starts, covering the systems, entities and jurisdictions to be reviewed for Does NIS2 apply to us
Inventory of hosted platforms, cloud accounts and data centers, with their operating locations and owners
Confirmation of which decisions stay with the organization, including legal sign-off on sector and size classification

How we build

Documented network and asset records, including IP ranges, needed for registration with the national competent authority
Configuration of self-hosted platforms in the client's own cloud or data center to reflect the scope findings
Test records showing how each in-scope system is identified, bounded and reported in the scope analysis

How we hand over

Scope memo listing each system, its sector mapping and the evidence used to reach each conclusion
Register of assumptions and open questions for the organization's counsel and national authority to confirm
Handover session where the client's team walks through the scope file and its update process

How we support

Fixed-scope engagements with deliverables and timelines agreed in writing before work starts
Ongoing support available as a retainer when the entity list, subsidiaries or national law change
Quote follows from the written scope, so ask for the assumptions behind each line item

Does NIS2 apply to us? The short answer and what changes it

How to run the NIS2 scope check in five steps

Confirm the sector and entity type

Apply the size rule under Recommendation 2003/361/EC

Check size-independent categories

Check whether DORA or another sector law displaces NIS2

Confirm jurisdiction and registration duties