Article 2 Scope

A private company in an Annex I sector, such as energy, transport or health, is in scope once it qualifies as a medium-sized enterprise or exceeds those ceilings, and it provides services or carries out activities in the Union. Sector membership opens the question, but size decides whether the entity is in scope. Entities above the medium-sized ceilings are essential by default, which changes how supervision works, so the size calculation should be documented before registration.

• Headcount: Staff numbers are measured under the rules of Recommendation 2003/361/EC, so confirm with the national authority how staff are counted.
• Turnover and balance sheet: The medium ceilings are a turnover figure and a balance sheet figure, and the test depends on how they combine with headcount.
• Linked and partner enterprises: Data from linked enterprises and partners must be aggregated under the Recommendation before the result is final.
• Essential status: Entities above the ceilings in Annex I are generally essential, so the consequences of misclassification are significant.
• Proof: Approved annual accounts, headcount records, an ownership chart and a written size determination form the core evidence file.

Illustrative example: a regional energy supplier with headcount and turnover above the medium ceilings would document both calculations and keep the file current each financial year.

An Annex II entity, such as a food producer, chemicals company or postal operator, is in scope only if it is medium-sized or larger. Entities just under the line fall outside, but a modest change in staffing or revenue can move them into scope. Because the Annex II default is important rather than essential, the practical stakes of crossing the line are different from those in Annex I, yet the obligations under Article 21 and Article 23 still apply once the entity is in scope.

• Combined tests: Staff counts are read together with turnover or balance sheet totals, so passing one figure does not settle the outcome.
• Year-on-year movement: Plan for changes in the figures used by the national authority, and model at least the next financial year.
• Default classification: In-scope Annex II entities are important unless the Member State designates them essential.
• Group and partner data: Figures from partner or linked enterprises can push an entity over the ceiling.
• Proof: Headcount registers, approved accounts, the group ownership chart and any written determination or registration confirmation.

Illustrative example: a food manufacturer with headcount just below the staff ceiling would test turnover and balance sheet against the medium limits and record the result for each year.

Ask counsel to model the test for the coming two financial years before deciding whether the entity is in scope.

Public administration splits into central government and other levels of government, and the rules differ for each. Central government entities are covered regardless of size. Local government and education institutions are covered only where the Member State extends NIS2 under Article 2(5). Bodies working in national security, public security, defense or law enforcement are excluded under Article 2(7), so the first question is what the body does, not only who runs it.

• Central government: Covered regardless of size, subject to how the national transposition law defines central government.
• Local government: An optional extension, so the answer depends on the national law of the relevant Member State.
• Education and research: Also optional, with particular attention to institutions carrying out critical research.
• Security carve-out: Entities working in national security, public security, defense or law enforcement fall outside NIS2.
• Proof: The national transposition law or designation list, the body's statutory mandate and the competent authority's written confirmation.

Illustrative example: a municipal authority in one Member State may be covered if that state extended NIS2 to local level, while a comparable authority elsewhere is not.

Confirm the national position in writing, since the same type of body can be treated differently across Member States.

A financial entity is not automatically outside NIS2 because it is regulated. Article 2(10) excludes entities exempted from DORA under Article 2(4) of Regulation (EU) 2022/2554. Where DORA covers the entity, DORA is the sector-specific act that sets the rules for ICT risk management and incident reporting, and the interplay with NIS2 is decided under the sector-specific rule. The outcome depends on the exact DORA exemption position, not only on the license type.

• Exempt or covered: Check the entity against the exemption list in DORA Article 2(4) and record the reasoning.
• Displacement: Where DORA applies as the sector-specific act, its ICT risk and incident reporting rules are the primary frame, and the remaining NIS2 duties should be confirmed with the supervisor.
• Adjacent services: ICT providers serving financial entities may still need their own NIS2 analysis under their own sector.
• Proof: The license or authorization record, a written DORA scope analysis, supervisor correspondence and the sector-specific displacement analysis.
• Cross-border finance: Entities operating in several Member States may face different national readings, so each jurisdiction needs its own check.

Illustrative example: a payment institution would start with its DORA exemption status and only then review NIS2 duties that remain.

Ask counsel and the relevant financial supervisor to confirm the position in writing before relying on it.

A group is assessed one legal entity at a time. Each subsidiary runs its own size test, with partner and linked enterprise data taken into account under the Recommendation. Jurisdiction follows establishment, so the Member State where each entity is established, or where a digital provider has its main establishment, decides which authority supervises it. A parent outside the EU does not decide the outcome on its own, but a non-EU provider offering services in the Union must address EU representation.

• Entity-level sizing: Each subsidiary is tested separately, with linked enterprise data considered.
• Independence: Recital 16 lets Member States consider an entity's independence from partner or linked enterprises in its systems and services when applying the size calculation.
• Establishment: The general establishment rule and the main establishment rule for digital providers determine the supervising Member State.
• Non-EU parent: Providers offering services in the Union from outside the EU may need to appoint an EU representative.
• Proof: A group structure chart, subsidiary register extracts, establishment evidence, any EU representative appointment and per-entity size workings.

Illustrative example: a group with a non-EU parent and subsidiaries in three Member States would produce a separate size file and jurisdiction note for each subsidiary.

Ask counsel to map every subsidiary and Member State before the first registration deadline.