NIS2: does it apply to my company? Annex I and II sectors, the size test, essential vs important

The NIS2 Directive, Directive (EU) 2022/2555, has been the applicable text since 18 October 2024, the date from which Member States had to apply their transposing laws (Article 41). It is a directive, so the obligations reach a company through national law, but the scope rules that decide whether a company is in at all are set by the directive itself and every national law follows them. This page sets out those rules in the order they are tested. It is not legal advice; the directive and your national transposition control.

The two tests, in order

A company is in scope if it passes both of two tests (Article 2(1)):

1. Sector test. It is an entity of a type listed in Annex I (sectors of high criticality) or Annex II (other critical sectors).

2. Size test. It qualifies as a medium-sized enterprise under Article 2 of the Annex to Commission Recommendation 2003/361/EC, or exceeds the ceilings for a medium-sized enterprise in paragraph 1 of that Article.

Fail either and the directive does not apply, unless one of the size-independent routes in Article 2(2) to (4) catches the company anyway. Those come after the two tests below.

Test one: the 18 sectors

Annex I, sectors of high criticality: energy (electricity, district heating and cooling, oil, gas, hydrogen); transport (air, rail, water, road); banking; financial market infrastructures; health; drinking water; waste water; digital infrastructure (internet exchange points, DNS providers, TLD registries, cloud, data centres, content delivery networks, trust services, public electronic communications networks and services); ICT service management business-to-business (managed service providers and managed security service providers); public administration; and space. That is eleven sectors.

Annex II, other critical sectors: postal and courier services; waste management; manufacture, production and distribution of chemicals; production, processing and distribution of food; manufacturing (medical devices and in vitro diagnostics, computer, electronic and optical products, electrical equipment, machinery and equipment, motor vehicles, other transport equipment, each tied to a NACE Rev. 2 division); digital providers (online marketplaces, online search engines, social networking platforms); and research organisations. Seven sectors.

The annexes do not list sectors loosely. Each row names a type of entity, often by reference to a definition in another EU act (a "distribution system operator as defined in Article 2, point (29), of Directive (EU) 2019/944", for instance), or to a NACE division for the manufacturing rows. A company matches a row or it does not; being adjacent to a sector is not enough. A software company that sells to hospitals is not in the health sector; a managed service provider that runs the hospital's systems is in ICT service management.

Test two: the size cap

Recommendation 2003/361/EC defines a medium-sized enterprise as one with fewer than 250 employees and either annual turnover not exceeding EUR 50 million or a balance sheet total not exceeding EUR 43 million; a small enterprise has fewer than 50 employees and turnover or balance sheet not exceeding EUR 10 million; a microenterprise fewer than 10 employees and not exceeding EUR 2 million (Annex, Article 2).

NIS2 draws its line at the bottom of the medium band. An entity is in if it is medium-sized or larger, which in practice means 50 or more employees, or turnover and balance sheet both above EUR 10 million. Under that line, the company is small or micro and the general rule leaves it out.

Two details of the Recommendation matter here. First, the headcount and financial figures are those of the enterprise together with its partner and linked enterprises (Annex, Article 6), so a 30-person subsidiary of a large group is counted with the group. Recital 16 of the directive lets Member States soften this where an entity's network and information systems are independent of the group's, but that is a national option, not the default. Second, NIS2 switches off Article 3(4) of the Recommendation (Article 2(1), second sentence), which is the rule that treats an enterprise as not an SME when 25 percent or more is held by a public body. For NIS2, public ownership does not by itself change the size result.

The size-independent routes

Article 2(2) applies the directive regardless of size to Annex I or II entities where the entity is a provider of public electronic communications networks or services, a trust service provider, a TLD name registry or a DNS service provider; is the sole provider in a Member State of a service essential for critical societal or economic activities; where disruption of its service could have a significant impact on public safety, security or health, or induce a significant systemic risk; or where it is critical because of its specific importance at national or regional level. The last four are Member State identifications, not self-assessments. Article 2(3) adds entities identified as critical under the CER Directive (EU) 2022/2557, and Article 2(4) entities providing domain name registration services.

Essential or important

Being in scope is the first question. The second is which of the two categories the entity falls into, because supervision and fines differ.

Under Article 3(1), an entity is essential if it is an Annex I type that exceeds the ceilings for a medium-sized enterprise (so, broadly, 250 or more employees, or above EUR 50 million turnover and above EUR 43 million balance sheet); a qualified trust service provider, TLD registry or DNS provider regardless of size; a provider of public electronic communications networks or services that is at least medium-sized; a central government public administration entity; an entity a Member State has identified as essential; or a CER critical entity. Everything else in scope is important (Article 3(2)). An Annex II manufacturer with 3,000 employees is important, not essential, because Annex II entities are never essential by size alone.

The obligations are the same for both: the ten risk-management measures in Article 21(2) and the incident reporting in Article 23 (an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, a final report within one month). What differs is enforcement. Essential entities are under proactive supervision; important entities are supervised after the event. Fines for breaching Article 21 or 23 must reach at least EUR 10,000,000 or 2 percent of total worldwide annual turnover for essential entities, and at least EUR 7,000,000 or 1.4 percent for important entities, whichever is higher in each case (Article 34(4) and (5)). Those are floors on the national maximum, so a Member State may set higher.

What to do with the answer

If both tests pass, the entity has to register with its national authority (the list Member States keep under Article 3(3) and (4)), put the Article 21 measures in place and be ready to report under Article 23. The registration deadline and the form of the register are national. If the sector test fails, the directive is out for now, but the same company may be pulled in by a customer that is in scope, since Article 21(2)(d) makes supply chain security one of the ten measures.

Bindler's NIS2 scope test and obligations register is in build: the two tests above, the essential-or-important result and the Article 21 and 23 register, each line with its article. Until it lists, the free browser tools cover the neighbouring EU rules (CSRD scope, AI Act class, EU Taxonomy eligibility, CBAM cost) and the workbooks page lists the shelf.

Sources

• Directive (EU) 2022/2555 (NIS2): Articles 2, 3, 21, 23, 34 and 41, Annex I and Annex II, and recitals 15 and 16: eur-lex.europa.eu/eli/dir/2022/2555/oj. Read from the Publications Office text (CELEX 32022L2555).
• Commission Recommendation 2003/361/EC concerning the definition of micro, small and medium-sized enterprises, Annex, Articles 2, 3 and 6: eur-lex.europa.eu/eli/reco/2003/361/oj.

Last checked against the sources on 28 September 2026.