Who Does NIS2 Apply To? Sectors, Size and Entity Types

One of the first questions businesses ask about NIS2 is simply: does it apply to us? The answer depends on the sector you operate in, your size, the type of service you provide, and the national law of each EU member state where you operate. This guide summarises the general structure of the directive's scope so you can prepare a sensible question for legal advisers and decide what to do next. It is general information and not legal advice.

What It Is

NIS2 (Directive (EU) 2022/2555) lists covered sectors in two annexes. Annex I covers sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration, and space. Annex II covers other critical sectors: postal and courier services, waste management, manufacture and distribution of chemicals, food production and distribution, manufacturing of certain products (such as medical devices, computers and electronics, electrical equipment, machinery, and vehicles), digital providers (online marketplaces, search engines, and social networking platforms), and research. As a general rule, the directive applies to medium-sized and large organisations in these sectors; under the EU SME definition, an organisation is broadly at least medium-sized if it has 50 or more employees, or if both its annual turnover and its balance sheet total exceed EUR 10 million. Some entities are covered regardless of size, such as certain providers of public electronic communications, trust service providers, DNS service providers, and top-level domain registries, and member states may designate others. Covered organisations are classed as essential or important entities. Broadly, large organisations in Annex I sectors are essential, while medium-sized Annex I organisations and those in Annex II are important, subject to size-independent rules and national designation. The classification affects supervision and penalties rather than the basic measures expected.

Who It Is For

This guide is useful for:

Managers of mid-sized companies in manufacturing, logistics, digital services, food, chemicals, or health-related supply chains
Managed service and ICT providers working for business customers
Suppliers to covered entities that are receiving security questionnaires
Groups operating in several EU member states that need a consistent view

What It Helps Clarify

Reviewing the scope structure helps clarify:

Whether any of your activities match an Annex I or Annex II sector
Whether you meet the size threshold, or fall into a category covered regardless of size
Which member states' national laws and authorities are relevant
Whether your obligations are direct, or arise indirectly through customer contracts

What's Included

List every activity and service line, not just the main business description
Match each activity against the Annex I and Annex II sector descriptions
Check headcount, turnover, and balance sheet, taking group structure and partner or linked enterprises into account as the EU SME definition requires
Identify every member state where you provide covered services or have establishments
Check the national transposition law and authority guidance in each relevant country
Record the outcome, reasoning, and date, and review it when your business changes
If out of scope, list customers that are in scope and the security requirements they pass on

What's Not Included

A legal determination of whether NIS2 applies to your organisation
Interpretation of a specific national transposition law
Registration with authorities on your behalf
Certification or compliance approval

When to Choose It

Use this guide early, before investing in a large programme, and again whenever you enter a new sector or country, acquire a business, or cross a size threshold. If the answer is unclear, for example because an activity sits on the boundary of a sector description, take legal advice rather than assuming. Even organisations outside direct scope often benefit from preparing, because covered customers must manage risks in their supply chain. This article is general information and not legal advice.

Our Approach

Approach scope as a documented decision rather than a quick yes or no. Gather the facts first: activities, size data, group structure, and countries. Then take the question to legal advisers with that evidence. In parallel, look at the security measures NIS2 expects; they reflect widely recognised good practice, so improving them is useful whichever way the scope question is answered. Our Security Baseline Review can give you a written view of agreed assets and severity-graded observations, with readiness-gap observations against an agreed reference where included in the confirmed scope. That evidence can support conversations with customers, management, and advisers. It is decision-support material that helps you bring focused questions to legal advisers and, where relevant, certification bodies. If you are a supplier, ask your covered customers which specific controls they need you to demonstrate, and prioritise those.

Security Baseline Review

View the Security Baseline Review service page