NIS2 (Directive (EU) 2022/2555) applies to medium-sized and large organisations that operate in one of 18 critical sectors listed in its Annexes I and II and provide services in the EU. Some providers, such as telecoms, trust service providers, DNS providers and TLD registries, are covered regardless of size. Answer three short questions below to see if you are an essential entity, an important entity, or out of scope.
Last reviewed: 19 October 2026 · Reviewed by [Name, role] · Enactia Ltd, Nicosia, Cyprus
Free tool · About 2 minutes · No sign-up
Step 1 of 3 · Your sector
Select all that apply. These are the sectors listed in Annex I and Annex II of the NIS2 Directive.
Please select at least one option.
Include your group: data from partner and linked companies counts, under the EU SME definition (Recommendation 2003/361/EC).
Please answer all three size questions.
These can bring an organisation into scope regardless of size, or change its category. Select all that apply.
Please select at least one option (or “None of these”).
NIS2 scope comes down to three tests:
If you pass the sector and size tests, or fall under a special case, NIS2 applies. Your category, essential or important, then depends mainly on your sector and size. For edge cases, see our scope decision guide.
| Essential entities | Important entities | |
|---|---|---|
| Who | Large organisations in Annex I sectors; qualified trust service providers, TLD registries and DNS providers of any size; medium and large telecom providers; central government; CER critical entities | Medium-sized organisations in Annex I sectors; medium and large organisations in Annex II sectors; other covered entities that are not essential |
| Security measures (Art. 21) | Required | Required |
| Incident reporting (Art. 23) | 24 h early warning, 72 h notification, final report within 1 month | Same |
| Management accountability (Art. 20) | Yes | Yes |
| Supervision | Proactive (ex ante): audits, inspections, scans | Reactive (ex post): after evidence of non-compliance |
| Maximum fines (Art. 34) | At least €10 million or 2% of worldwide annual turnover, whichever is higher | At least €7 million or 1.4% of worldwide annual turnover, whichever is higher |
Read more: NIS2 fines and penalties · essential vs important entities: scope decision guide
Annex I — sectors of high criticality (11): energy; transport; banking; financial market infrastructure; health; drinking water; waste water; digital infrastructure; ICT service management (business-to-business); public administration; space.
Annex II — other critical sectors (7): postal and courier services; waste management; manufacture, production and distribution of chemicals; production, processing and distribution of food; manufacturing (medical devices, computers and electronics, electrical equipment, machinery, motor vehicles, other transport equipment); digital providers (online marketplaces, search engines, social networks); research.
Member States can also extend NIS2 to local public administration and education institutions. Check how your country applies it in our NIS2 transposition tracker. Banks and financial market infrastructures should also read NIS2 vs DORA.
| Category | Employees | Financial test | NIS2 effect |
|---|---|---|---|
| Small or micro | Fewer than 50 | Turnover or balance sheet €10M or less | Usually out of scope (unless a special case) |
| Medium-sized | 50–249 | Or: turnover and balance sheet both over €10M | In scope if in an Annex I or II sector |
| Large | 250 or more | Or: turnover over €50M and balance sheet over €43M | Essential if in an Annex I sector |
Thresholds follow Commission Recommendation 2003/361/EC. Figures from partner and linked enterprises, such as a parent company, are included.
NIS2 is Directive (EU) 2022/2555, the EU law on a high common level of cybersecurity. It replaced the original NIS Directive. Member States had to transpose it into national law by 17 October 2024, and its rules apply from 18 October 2024.
NIS2 applies to medium-sized and large public or private organisations in the sectors listed in Annexes I and II that provide services or carry out activities in the EU. Some organisations are covered regardless of size, including telecom providers, trust service providers, DNS providers, TLD registries and central government.
Usually not. Small and micro enterprises are generally outside NIS2, unless they are a telecom provider, trust service provider, TLD registry, DNS provider or domain registration service, a critical entity under the CER Directive, or have been designated by their national authority, for example as the sole provider of an essential service.
Both must apply the same security measures and incident reporting rules. Essential entities face proactive supervision and maximum fines of at least €10 million or 2% of worldwide turnover. Important entities face reactive supervision and maximum fines of at least €7 million or 1.4%.
For a significant incident, organisations must send an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report within one month of the notification (Article 23).
Yes. Article 20 requires the management body to approve and oversee cybersecurity risk-management measures and to take training. Management can be held liable for infringements, under the rules set by national law.
Indirectly. Organisations in scope must manage supply-chain security (Article 21(2)(d)), so their suppliers can expect security questionnaires, audits and contract clauses even if NIS2 does not apply to them directly.
The European Commission proposed targeted amendments to NIS2 on 20 January 2026, covering scope, simplification and ransomware reporting. At the time of our last review, the proposal was still going through the EU legislative process and was not yet law.
Sources: Directive (EU) 2022/2555 (NIS2) on EUR-Lex · Commission Recommendation 2003/361/EC (SME definition) · Directive (EU) 2022/2557 (CER)
This page and the checker give general information and are not legal advice. National implementing laws may add sectors, entities or requirements.
