Which Member State supervises NIS2 for your organization under Article 26
Under Article 26, the Member State where your organization is established supervises you under NIS2, and for most digital providers it is the Member State of your main establishment in the Union. If you run a multinational, you have to determine which single national authority and national law apply to your cybersecurity obligations. For most entities the general rule is simple: the Member State where you are established. Electronic communications providers follow the Member State where they provide services, and public administration entities follow the Member State that established them. The point of the rule is to avoid one entity being supervised by several authorities for the same obligations.
The harder case is the digital providers listed in Article 26(1)(b), including DNS service providers, TLD registries, domain registration services, cloud, data center, CDN, managed and managed security service providers, online marketplaces, search engines and social networks. For these, the Member State of main establishment in the Union is the one that counts. Article 26(2) tests this in order: first, where cybersecurity risk-management decisions are predominantly taken; second, where cybersecurity operations are carried out; third, the EU establishment with the most employees. Confirm with your legal counsel which Member State your board actually decides security policy in, because that answer, not your registered address, usually drives the result.
Multinationals often have decisions made in one country, security operations run from another and staff spread across several EU offices, so the three tests can point to different places. Document the decision record (board minutes, risk acceptance sign-offs, delegated authorities) and the location of the security operations team, and reconcile them before you tell a supervisor where you are established. Non-EU providers that offer services in the Union without an EU establishment must designate a representative in a Member State where they offer services, and the Commission's January 2026 proposal (COM(2026) 13) would simplify these jurisdictional rules, but it is not yet adopted law, so plan against the current text.
Which entities and facts decide the supervising Member State
Article 26 sends most entities to the Member State where they are established, but a short list of digital providers follows a different test. The cards below separate the two routes and the facts that move an entity from one to the other, so you can check which national authority will supervise your organization before you engage a supervisor.
General establishment rule
Most in-scope entities fall under the Member State where they are established. For a single-site organization, the answer is usually obvious, but a group with subsidiaries in several Member States needs to confirm which legal entity is in scope and where it is registered. Check each subsidiary separately rather than assuming the parent's location settles it.
Public administration entities
Public administration entities fall under the Member State that established them, not under the state where they deliver services. A regional or municipal body therefore answers to the authority of its own Member State. Confirm the establishing authority in your founding instrument or national register before assuming a cross-border supervisor.
Main establishment for digital providers
DNS providers, TLD registries, domain registration services, cloud, data center, CDN, managed and managed security service providers, online marketplaces, search engines and social networks follow the main establishment rule. Their supervisor is the Member State of their main establishment in the Union, regardless of where customers sit. Map every EU entity against this list before concluding that the general rule applies.
Where risk decisions are taken
The first test for main establishment is where cybersecurity risk-management decisions are predominantly taken. Board approval of security policy, budget and risk acceptance usually counts most, so record where those meetings and sign-offs occur. If decisions are taken in a non-EU head office, the next test applies, so document the reasoning in writing.
Where cybersecurity operations run
If no EU establishment takes the predominant risk decisions, the test moves to where cybersecurity operations are carried out. Security operations centers, incident response teams and day-to-day monitoring are the activities to locate. A provider that outsources a SOC to a vendor in another EU state should confirm which location the regulator would treat as operational.
Headcount and non-EU providers
If neither decisions nor operations settle the question, the EU establishment with the most employees is the main establishment. Non-EU providers that offer services in the Union without an EU establishment must designate a representative in a Member State where they offer services. Ask counsel to confirm employee counts per establishment and the representative appointment, because the answer determines who may take legal action.
How to work through the Article 26 tests step by step
This sequence tells you which Member State supervises an entity under Article 26, and it leaves a written record of each decision so you can show a supervisor how you reached the answer.
Confirm the entity type and sector
Start by deciding which category the entity falls into under Article 26(1): a general entity, an electronic communications provider, a public administration entity, or one of the providers listed in Article 26(1)(b), such as DNS providers, TLD registries, domain registration services, cloud, data center, CDN, managed and managed security service providers, online marketplaces, search engines and social networks. Legal or compliance staff should confirm this against the sector mapping in the Annexes and the entity's actual services. The output is a one-page classification memo naming the entity type and the paragraph of Article 26(1) that applies. If the entity is not on the Article 26(1)(b) list, the general establishment test in the next step decides jurisdiction.
Map every EU establishment
List each place in the Union where the entity is established, including subsidiaries, branches and offices with real operations. Confirm the list with corporate records and the legal team, because a registered address alone may not show where activity happens. For general entities, the Member State where the entity is established generally holds jurisdiction. Record the result as a register of EU establishments with the country, legal form and the activities carried out at each site. If the entity has no EU establishment but offers services in the Union, note that now, because Article 26(3) applies in the final step.
Apply the general establishment rule
For entities outside Article 26(1)(b), jurisdiction generally rests with the Member State where the entity is established. Where an entity has more than one EU establishment, confirm with counsel how the national transposition law treats that case, since the Directive itself does not settle every multi-site question in this step. Electronic communications providers follow the Member State where they provide services, and public administration entities follow the Member State that established them. The output is a jurisdiction note naming the supervising Member State, with the legal basis cited to Article 26(1) and the national law that implements it.
Test where cybersecurity risk decisions are taken
For Article 26(1)(b) providers, the main establishment is first identified by where cybersecurity risk-management decisions are predominantly taken. Gather board minutes, delegations of authority and the records of who approves security budgets, risk acceptance and major security policies. Interview the executives who hold those mandates. If decisions are made in one Member State and the evidence is clear, record that location as the main establishment and stop here. The output is a decision-location memo that lists each decision type, the body that takes it, the place where that body meets, and the supporting documents.
Test where cybersecurity operations run
If the decision test does not settle the question, move to the second fallback in Article 26(2): the Member State where cybersecurity operations are carried out. Document where security monitoring, incident response, vulnerability management and security engineering are run, including any outsourced operations center and its legal seat. Confirm whether the operations team works from one site or several. The output is an operations map showing each function, its location, the staff or provider who performs it, and the contract that governs it. Include the location of any managed security provider that runs these functions for you.
Compare EU headcount as the last fallback
If neither the decision location nor the operations location identifies a main establishment, apply the final fallback in Article 26(2): the EU establishment with the most employees. Build an org chart of EU staff by establishment, counting employees and stating the method used, such as headcount on a fixed date. Check the result with HR records and note any contractors who are excluded from the count. The output is an EU headcount table by establishment and a conclusion that names the main establishment and the supervising Member State. Keep the table with the decision memo and operations map.
Address the EU representative duty
If the entity is an Article 26(1)(b) provider that offers services in the Union without being established there, Article 26(3) requires it to designate a representative in a Member State where it offers services. Confirm which Member States receive services, appoint the representative in writing, and record the mandate, contact details and the date of appointment. Check with counsel whether the national transposition law sets further formal steps. The output is a signed representative appointment and a note of the Member States covered. Without a representative, any Member State where the provider offers services may take legal action, so the appointment should be on file before a supervisor asks for it.
File the jurisdiction record and review it
Bring the classification memo, establishment register, decision memo, operations map, headcount table and any representative appointment into one jurisdiction file. Have management approve the conclusion in writing and store the file where supervisors can request it. Because the Commission's 20 January 2026 proposal (COM(2026) 13) includes measures to simplify the jurisdictional rules and is not yet adopted law, set a recurring review of the conclusion and check the status of the proposal against the Commission's published pages. The output is an approved jurisdiction file with a review owner and the date of the last review.
What non-EU providers must do when they offer services in the EU
A non-EU provider that already has an establishment in the Union is not caught by the representative duty in the same way. Article 26(1)(b) places the listed digital providers under the Member State of their main establishment in the Union, and Article 26(2) decides what that means in practice. The test asks where cybersecurity risk-management decisions are predominantly taken, then where cybersecurity operations are carried out, and finally which EU establishment has the most employees. Because the question is factual, the answer can change when the organization restructures its security function.
- Main establishment test: Document where risk decisions are taken, such as the board or security committee minutes that approve the risk register.
- Operations location: Identify where the security operations centre or incident response team actually works, since this is the second test.
- Headcount fallback: Record EU employee numbers by establishment in case the first two tests do not settle the question.
- Designation to the authority: Confirm with the competent authority of the Member State concerned whether it expects a formal notification of the main establishment.
- Change control: Re-run the analysis when decision-making or operations move.
Confirm your classification against the national transposition law of the Member State you believe is competent, because implementation details vary.
A non-EU provider that offers services in the Union without any EU establishment falls under Article 26(3). It must designate a representative in one of the Member States where it offers services. The representative is the point of contact for the national authority, so the choice of Member State matters. Article 26(3) does not require the provider to be established there, but the representative must be reachable and able to receive communications on the provider's behalf.
- Where to name the representative: Choose a Member State where the provider offers services, and where the authority can reach the representative in practice.
- Scope of the duty: The obligation covers the listed providers, including cloud, data center, CDN, managed service, online marketplace, search engine and social network providers.
- Written mandate: Put the representative's powers, contact details and language arrangements in a written mandate.
- Notification: Confirm with the chosen authority how the representative must be notified and whether details must be kept current.
- Multiple Member States: Decide whether one representative covers all services or whether more than one is needed.
Confirm with qualified EU counsel how the national law of your chosen Member State defines the representative role, since transposition rules differ.
A non-EU provider with no EU customers in scope is in a different position. NIS2 applies to the services a provider offers in the Union, so the question is whether the provider offers covered services in the Union at all. Offering a service on a global website is not the same as targeting EU customers, and the answer depends on the facts of each service. The provider should document the analysis rather than assume the outcome.
- Service mapping: List each service, its customers and whether any are located in or served from the Union.
- Targeting evidence: Keep records such as EU-language offerings, EU pricing, or EU-based support, which show whether services are offered in the Union.
- Customer contracts: Check whether contracts or onboarding flows bring EU customers in scope in practice.
- Periodic review: Re-test the analysis when new markets, partners or products are added.
- Written conclusion: Record the conclusion and the reasoning so that an authority or customer can see it.
This is an illustrative analysis only. Ask qualified counsel to confirm the position for your specific services and Member States.
How an assessor or national authority tests jurisdiction
This table sets out what a national competent authority or assessor checks to decide which Member State supervises an entity, the evidence each check expects, and the findings that most often cause problems. Read each row as one step of the test, and treat the decision-location and representative rows as the places where group documents most often disagree.
| Test step | Evidence the authority expects | Common finding |
|---|---|---|
| Entity type and Article 26(1) route | Legal form, sector classification and the paragraph of Article 26 the entity falls under, mapped to its services | Entity assumes the general establishment rule applies when a digital provider category sends it to the main establishment rule |
| Decision-location record | Board minutes, delegated authority records and documents showing where cybersecurity risk-management decisions are predominantly taken | Decisions are taken in one country but group policies name another as the place of control |
| EU headcount and operations records | Employee counts by Member State, locations of cybersecurity operations such as monitoring and incident response, and the fallback order in Article 26(2) | Operations are run from outside the EU, so the test falls back to the EU establishment with the most employees, which is not recorded |
| Establishment claims across group documents | Consistent statements in registration filings, privacy notices, contracts, policies and annual reports | Inconsistent establishment claims across group documents, such as a privacy notice naming one country and a supplier contract naming another |
| Services offered in the Union (non-EU providers) | Evidence of services offered to EU users or customers, including language, currency, domains and marketing targeting | Services are offered in several Member States without a documented view of where the entity is treated as offering them |
| Representative appointment letter | Written designation of an EU representative in a Member State where services are offered, with the representative's accepted mandate | Missing representative designation, or a letter that does not state the Member State or cover the services in scope |
| Contact details and notification route | Current contact points for the competent authority, updated after any change of establishment or representative | Contact details left unchanged after a restructuring, so authorities write to a site that no longer decides cybersecurity matters |
Evidence that establishes your supervising Member State
Article 26 turns on where decisions are taken, where operations run and where staff sit, so the evidence has to show those facts for the whole group, not just the parent. The cards below are the records a supervisor is likely to ask for first, and each one needs an owner who updates it when structures change.
Group structure and legal entity register
Maintain a current chart of every legal entity in the group, with its country of registration, parent and ownership percentage. This shows which entities are established in which Member State, which is the starting point for any Article 26 analysis. Check that the chart matches the registry extracts you would file with authorities and that dissolved or merged entities are dated, not deleted. Assign an owner who must update the register within a set internal deadline after any transaction.
Board minutes on cybersecurity decisions
The main establishment test asks where cybersecurity risk-management decisions are predominantly taken, so minutes and resolutions are primary evidence. Record which body approved risk acceptances, budgets and security policies, the location of the meeting and the attendees. If decisions are taken by a group committee in another country, the minutes must show that clearly. Review a sample of minutes each year to confirm the pattern still reflects reality.
RACI and EU operations records
Where no decision location is clear, the directive falls back to where cybersecurity operations are carried out. A current RACI matrix, shift rosters and on-call records show which EU team monitors, responds and recovers. Include managed service providers in this record, since outsourced operations still count toward the answer. Update the matrix whenever a service moves, a contract changes or a team is reorganized.
EU headcount by establishment
The last fallback in the main establishment test compares the number of employees in each EU establishment. Keep a headcount register by legal entity and country, measured on a consistent date with the method documented. Record contractors separately if your methodology excludes them. Refresh the figures at a fixed interval and whenever hiring or relocation changes the ranking.
Representative designation and acceptance
A provider listed in Article 26(1)(b) that offers services in the Union without an EU establishment must designate a representative in a Member State where it offers services. Keep the signed designation, the representative's written acceptance, the Member State and the contact details supplied to the authority. Confirm with counsel which Member State applies if you offer services in several. Re-confirm the designation after any change to the representative or the services offered.
Dated jurisdiction review record
Bring the other artifacts together in a memo that states which Member State supervises each entity, the rule relied on and the facts behind it. Date the memo, name the approver and list the trigger events that require a new review, such as a merger, a new office or a change to the Commission's proposed amendments. Note that the January 2026 proposal to simplify the jurisdictional rules is not yet adopted law, so the review should be repeated once its status changes.
What establishing jurisdiction costs in money and effort
This table breaks down the cost components of settling which Member State supervises an entity, who is paid for each one, and whether it is one-time or recurring. Read it as a checklist for requesting quotes, since no fees are stated here and the real cost depends on group structure and the number of jurisdictions involved.
| Cost component | Who is paid or who does the work | One-time or recurring | What drives it up or down |
|---|---|---|---|
| Internal legal and governance review | Internal legal, compliance and management body time, sometimes supported by an adviser | One-time, then revisited on structural change | Number of EU establishments, complexity of decision-making records, and how well documented the current structure already is |
| Group restructuring analysis | External counsel or consultants, plus internal finance and tax input | One-time, only where the main establishment answer is unclear | Number of group entities, where cybersecurity decisions are taken, and whether intra-group operations move between countries |
| Appointment of an EU representative | Third-party service provider engaged under a written contract | Setup and recurring service fee | Number of Member States where services are offered, the scope of mandate, and the provider's responsibilities and reporting duties |
| Legal review of representative mandate and contracts | External counsel in the Member State concerned | One-time, with updates on renewal or change | Number of national laws reviewed, language of documents, and whether the mandate needs bespoke drafting |
| Notifications and register updates | Internal compliance staff, sometimes with counsel | Recurring when details change | Frequency of changes in management, addresses, service footprint, and the national reporting format |
| Periodic re-checks of jurisdiction | Internal compliance, with external review at intervals agreed with counsel | Recurring | Pace of corporate change, acquisitions, new EU services, and any amendments to NIS2 that affect the rules |
| Monitoring the January 2026 proposal | Internal legal or external adviser time | Recurring while the proposal is pending | Progress through the European Parliament and Council, and whether the jurisdictional simplification is adopted |
Questions about NIS2 jurisdiction and the EU representative
Does a non-EU company need to appoint an EU representative under NIS2?
Yes, if it is one of the provider types listed in Article 26(1)(b), offers services in the Union, and is not established in any Member State. Under Article 26(3), it must designate a representative in a Member State where it offers services. If it does not, any Member State where it provides services may take legal action against it. The obligation is tied to the provider categories, not to company size, so a non-EU cloud, managed service or online marketplace provider should check this first. Confirm the exact national transposition rules in each Member State where you offer services, because how the representative is named and what the representative must do can vary.
How do we decide which EU country supervises us if we have offices in several states?
Start with the main establishment test for the provider types that use it. Article 26(2) looks first at where cybersecurity risk-management decisions are predominantly taken. If that cannot be settled, it looks at where cybersecurity operations are carried out, and then at the EU establishment with the most employees. The drivers are where the board or security leadership actually decides, where the security operations center sits and where staffing is concentrated. Document the reasoning with org charts, decision records and operating locations, because a supervisor may ask why one state was chosen. Ask a legal adviser to review the analysis if the group structure is complex or the answers point in different directions.
Does the January 2026 NIS2 proposal change the jurisdiction rules?
The Commission proposed targeted amendments to NIS2 on 20 January 2026 (COM(2026) 13). The proposal includes measures to simplify the jurisdictional rules, but it is not adopted law. It needs approval by the European Parliament and the Council before it can change anything. Until then, the rules in Article 26 apply as written, and national transposition laws govern. Plan against the current text, and track the proposal's progress so that any change can be assessed when it is adopted. Ask counsel whether the proposal would alter the Member State you have chosen.
How long does a jurisdiction analysis take and what does it need from our team?
The duration depends on how many entities, establishments and EU locations are involved, and on how quickly the team can produce accurate records. No fixed timeline applies to every organization, so ask any consultant or adviser for a duration tied to a written scope. The analysis needs the legal entity chart, the locations of board and risk decisions, the locations of security operations, headcount by EU establishment, and the services offered in each Member State. Expect the security, legal and HR functions to contribute. The work is usually faster when those records already exist and slower when decisions are made informally.
Can we do the jurisdiction analysis in-house?
Often yes, for a single group with clear decision-making and a small number of EU locations. The organization owns its jurisdiction determination and is accountable for the outcome, so the analysis must be written down and approved by management. Internal teams usually need legal input on the national rules and on how the representative must be appointed. Outside help is most useful when the group structure is complicated, when the main establishment answer is disputed internally, or when the business needs a documented position for a regulator. Any implementation partner can prepare the systems, records and evidence, but the determination itself remains the organization's decision.
When do we need a legal adviser for NIS2 jurisdiction?
Bring in a qualified legal adviser when the answer affects liability, when the group has entities in several Member States, or when a regulator has already made contact. Counsel is also the right person to confirm how each national transposition law implements Article 26, how a representative must be designated and what that person must do. A legal adviser issues legal opinions, not technical reports. Technical teams and implementation partners can supply the facts, such as where decisions are recorded and where security operations run, but the legal reading should come from counsel.
What does DeployOpen contribute to a jurisdiction question?
DeployOpen works on the technical side of the question. It can document where security systems, logs and operations actually run, map the evidence that shows where cybersecurity operations are carried out, and prepare records that support the Article 26(2) analysis. It does not decide jurisdiction, provide legal advice, or act as a representative. The scope, deliverables and timeline are agreed in writing before work starts, and any quote follows from that scope. Ask counsel to confirm the legal conclusion before relying on it.
Who owns the jurisdiction decision and what can be outsourced
The organization owns the jurisdiction determination. Its management body and legal counsel decide where the entity is established, where cybersecurity risk-management decisions are predominantly taken, where cybersecurity operations run, and how many employees sit in each EU establishment. These answers determine which Member State supervises the entity under Article 26, and the entity remains accountable for them whatever advice it receives. Management should approve the determination and keep it current as the group changes.
- Establishment facts: Record where the entity is registered and where it has real and effective activity, and confirm this with local counsel in each relevant Member State.
- Main establishment reasoning: Document where risk decisions are taken, with minutes or delegations that show the decision-makers.
- Operations and headcount: Keep current records of where security operations are carried out and how many employees each EU establishment has.
- Representative appointments: For non-EU providers, decide and record which Member State hosts the designated representative.
- Change monitoring: Track the Commission's January 2026 proposal to simplify these rules and reassess the determination if it is adopted.
Confirm the final determination in writing with counsel and the management body before relying on it.
An implementation partner can prepare the evidence pack and the analysis that supports the determination. Typical work includes mapping group structures, collecting records of where decisions and operations sit, drafting the jurisdiction memo for counsel to review, and organizing the documents a supervisor would ask for. The partner works from the facts the organization supplies and does not make the legal call. Scope and deliverables should be fixed in writing before work starts.
- Fact gathering: Collect entity structure, office locations, staffing and governance records into one reviewable file.
- Analysis draft: Prepare a memo applying the Article 26 tests to those facts, clearly marked as draft for counsel.
- Evidence organization: Index decision records, delegation documents and operations records so they can be produced quickly.
- Ongoing records: Set up a review schedule so the file is updated when offices, staff or decision bodies change.
- Exclusions: The partner does not issue legal opinions, register the entity with authorities or represent it in supervisory proceedings unless separately engaged for that purpose.
Ask the partner to state in the statement of work which outputs are drafts and which party signs off on each.
National competent authorities decide which Member State supervises an entity in practice and how they apply the rules to it. Where an entity is subject to a certification or assessment scheme, an independent auditor or certification body issues any report. NIS2 itself creates no certificate of compliance, so no one can grant a jurisdiction certificate. Supervisory authorities and the Commission handle disputes, cross-border cooperation and any future amendments.
- Authority decisions: The competent authority of the Member State concerned makes the supervisory determination and can request information.
- Independent review: An auditor or assessor may test whether the records support the stated position, but it issues reports only on the scope it was engaged to examine.
- Cross-border cooperation: Authorities in several Member States may need to coordinate when an entity's position is contested.
- Legal changes: The Commission's proposal of 20 January 2026 is not adopted law. Parliament and the Council must approve it before it changes Article 26.
- Dialogue: Entities can ask their chosen authority in advance how it reads the rules for their structure.
Before you rely on a determination, confirm with the relevant national authority how it applies Article 26 to your structure.
Where organizations get the supervising Member State wrong
Most Article 26 errors start with a simple assumption: that the registered seat settles which authority supervises the entity. The gaps below show where that assumption fails, and each one ends with a check you can run before your next filing or supervisory contact.
Relying on the registered seat alone
Many organizations assume the Member State named in the company register is the supervising one. Article 26(1) starts from establishment, but the test is applied to the facts of how the entity operates, so the registration document is only a starting point. Check whether the legal seat, the actual management location and the operating activities point to the same country. If they do not, document the reasoning before a regulator asks.
Ignoring where risk decisions are taken
For DNS, TLD, cloud, data center, CDN, managed and online platform providers, Article 26(2) looks first at where cybersecurity risk-management decisions are predominantly taken. Boards that approve security budgets, accept residual risk or pick security tooling in a different country than the operating unit can shift the answer. Map who actually signs off on risk decisions, and record the location of each decision-making body.
Forgetting EU operations sites
If the main establishment test is not met by decision-making, Article 26(2) moves to where cybersecurity operations are carried out, such as a security operations center or incident response team. Organizations with a small headquarters and a large monitoring team elsewhere in the Union often overlook this fallback. Inventory every site that runs monitoring, patching or response for in-scope services, and confirm which Member State hosts them.
Missing the representative duty
A provider listed in Article 26(1)(b) that offers services in the Union without an EU establishment must designate a representative in a Member State where it offers services. Without one, any Member State where it provides services may take legal action. Confirm whether you are a non-EU provider in scope, which Member States you serve, and who is named as representative and how that person is reachable by authorities.
Skipping reanalysis after reorganization
Mergers, carve-outs, relocations of security teams and new outsourcing arrangements can change the answer under Article 26 without any change to the legal entity. The analysis is a point-in-time judgment that must be repeated when the facts move. Set a trigger list, such as a change in board location, a managed SOC contract or a new data center region, that forces the jurisdiction analysis to be reopened and signed off.
Inconsistent statements across group documents
Group entities often describe their security governance differently in registrations, policies, contracts with customers and reports to authorities. When one document places decisions in one country and another places operations elsewhere, supervisors see conflicting evidence. Compare the jurisdiction statements in your NIS2 policies, supplier contracts and national registration filings, and align them to one reasoned position, with the same facts behind each.
What the January 2026 proposal could change and what to watch
On 20 January 2026 the Commission proposed targeted amendments to NIS2 in COM(2026) 13, and that proposal includes measures to simplify the jurisdictional rules in Article 26. The proposal is not adopted law. It has to pass the European Parliament and the Council before any change applies, so the text that binds your entity today is still the directive as transposed into national law. Keep your Article 26 analysis tied to that adopted text, and record which Member State you have treated as your supervisor and on what basis (establishment, main establishment, or the location of your EU representative).
Treat the proposal as a planning input, not a reason to pause. Assign an owner, such as the general counsel or the compliance lead, to follow the file through the Commission's proposal page and to log each change in Parliament and Council positions. Pay particular attention to any change to how the main establishment is determined for cloud, data center, CDN, managed service and online platform providers, because those rules decide which single authority may supervise you across the Union. Confirm with your national competent authority how it is applying the current rules while the proposal is pending, since national practice can move faster than the EU text.
Build the watch list into your jurisdiction file now. For each group entity, record the establishment facts that drive Article 26 today, including where cybersecurity risk decisions are taken, where operations sit and where EU headcount is located, and set a review date to recheck them after each legislative milestone. Ask your legal advisers to state in writing how they would reanalyze your position under the amended text if it is adopted, so that a change in supervisor does not catch the organization without a plan for incident reporting and supervisory contacts.
How to build a defensible jurisdiction record
This sequence turns the Article 26 analysis into a dated, signed record that shows which Member State supervises the entity, why, and who decided. It gives an assessor or supervisor a single file to test against the facts.
Confirm the entity type and sector
Start by establishing which Article 26 category the entity falls into. Decide whether it is an electronic communications provider, a public administration entity, or one of the providers listed in Article 26(1)(b) such as DNS, TLD, cloud, data center, CDN, managed or managed security service providers, online marketplaces, search engines or social networks. Confirm the sector and whether the entity is in scope at all, since the rule only applies once scope is settled. The output is a one-page entity classification memo, signed by legal or compliance and reviewed by the management body, that names the Article 26(1) limb relied on.
Map all establishments in the Union
List every place where the entity is established in the EU, including subsidiaries, branches and offices, and record the Member State of each. For non-EU providers, record every Member State where services are offered, even if no establishment exists there. Pull this data from the corporate register, the group structure chart and the service footprint, not from memory. The output is an establishment register with legal entity name, country, registration reference and date of last verification.
Locate where cybersecurity decisions are taken
For the Article 26(2) first test, identify where cybersecurity risk-management decisions are predominantly taken. Ask who approves security policies, risk acceptance, budget for controls and major security changes, and where those people sit. Interview the decision owners and collect board minutes, delegation-of-authority letters and governance charters. The output is a decision-location finding that names the Member State and the evidence showing the decisions are predominantly taken there.
Locate cybersecurity operations
If the decision test does not resolve the question, move to the second test in Article 26(2), which asks where cybersecurity operations are carried out. Document where the security operations center, incident response team, vulnerability management and monitoring functions run, including any outsourced providers and the countries they operate from. Confirm the answer with system access logs, on-call rosters and service contracts. The output is an operations-location finding with the same evidence standard as the decision finding.
Apply the employee count fallback and document the result
If neither decision nor operations location settles the matter, apply the final fallback in Article 26(2): the EU establishment with the most employees. Count headcount per establishment as of a fixed reference date and keep the calculation method. Then write the Article 26(2) determination as one record that states which test resolved the main establishment, the Member State concluded, the evidence relied on and the reviewer. Ask counsel to confirm the reasoning for any edge case. The output is a signed jurisdiction determination record.
Appoint and document an EU representative where required
If the entity is a provider listed in Article 26(1)(b) that offers services in the Union without being established there, designate a representative in a Member State where it offers services, as Article 26(3) requires. Confirm the appointment in writing, record the representative's contact details and the designation date, and obtain the representative's written acceptance. Confirm with the national competent authority or counsel how it expects the designation to be communicated. The output is a signed representative appointment letter filed with the jurisdiction record.
Set a review trigger tied to reorganizations
Define the events that reopen the determination. Typical triggers include mergers, acquisitions, relocation of security leadership, outsourcing of the SOC, changes in EU headcount by establishment, and changes in service footprint. Assign an owner to monitor each trigger and schedule a review at least when a trigger occurs. The output is a review procedure with named owners and a change log that records each review and its outcome.
Keep the record current and ready for supervisors
Store the establishment register, decision and operations findings, the Article 26(2) determination, the representative appointment and the review log together in one controlled repository with version history. Check that the file still matches current facts at each review trigger, and confirm that the national rules in the relevant Member State do not add procedures. Note that the Commission's 20 January 2026 proposal (COM(2026) 13) includes measures to simplify the jurisdictional rules, so verify the status of those changes before relying on the current wording. The output is a complete, dated file that can be produced on request.
How DeployOpen supports the technical evidence for jurisdiction
DeployOpen does not decide which Member State supervises your entity, and it does not issue reports or certificates on that question. The determination under Article 26 is a legal and governance matter for the organization, usually with counsel. What DeployOpen can do under a fixed written scope is prepare the technical record that supports the position your organization takes. That record is useful for any entity, and it is essential for a provider listed in Article 26(1)(b), where the main establishment test turns on where cybersecurity risk-management decisions are predominantly taken and where cybersecurity operations are carried out.
In practice, the technical work starts with a system inventory that records where each platform, cloud account, data center, backup target and monitoring function runs, which legal entity owns it, and which EU location it sits in. Alongside that, DeployOpen can help assemble access and operations records: who approves changes, which identity groups hold administrative rights, where on-call and security operations staff are based, and where incident tickets are opened and closed. Configuration exports, change logs and access review records from self-hosted tools can show these facts without relying on memory. Confirm with your counsel which of these records the Article 26(2) analysis actually needs, because the three-step test is applied to facts about decision-making, not only to infrastructure.
The documentation pack should be structured so that counsel and, if asked, a competent authority can follow the reasoning from facts to conclusion. A practical structure separates the inventory, the decision-making evidence, the operations evidence, and a dated memo from the organization stating its position. Ask any partner to confirm in writing which artifacts will be produced, who keeps them current, and how changes in location or staffing will be recorded. If your organization offers services in the Union without an EU establishment, the same pack should also show where any Article 26(3) representative has been designated, which is a decision your organization must make and document itself.
