NIS2 scope check
Answer four short questions and find out whether your organization falls under NIS2 as an Essential Entity, Important Entity, or is out of scope.
What sector does your organization operate in?
Select the NIS2 Annex I (Essential) or Annex II (Important) sector that best matches your main activity.
What each outcome means
The check above combines four answers: sector, size, EU activity and criticality. Below are the outcomes it can reach and the thresholds behind them, so you can read the logic without running the tool.
When is an organization an essential entity under NIS2?
An organization is an essential entity when it is active in the EU, works in one of the Annex I sectors, and is medium or large.
The Annex I sectors are energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration and space. Medium or large means 50 FTE or more, or turnover of €10 million or more, measured per Commission Recommendation 2003/361/EC.
An essential entity gets proactive supervision from its national competent authority, must take the risk management measures of Article 21, must report incidents under Article 23 including an early warning within 24 hours, faces maximum administrative fines of at least €10 million or 2% of global annual turnover whichever is higher, and its management body members carry personal liability under Article 20.
When is an organization an important entity under NIS2?
An organization is an important entity when it is active in the EU, works in one of the Annex II sectors, and is medium or large.
The Annex II sectors are postal and courier services, waste management, manufacture, production and distribution of chemicals, production, processing and distribution of food, manufacturing of medical devices, manufacturing of computers, electronic and optical products, manufacturing of electrical equipment, manufacturing of machinery and equipment n.e.c., manufacturing of motor vehicles, trailers and semi-trailers, manufacturing of other transport equipment, digital providers such as online marketplaces, search engines and social platforms, and research. The size threshold is the same as for essential entities.
An important entity gets reactive, ex post supervision, the same Article 21 risk management measures, incident reporting under Article 23, maximum administrative fines of at least €7 million or 1.4% of global annual turnover whichever is higher, and personal liability for management body members under Article 20. The compliance burden is comparable to an essential entity. Only the supervisory regime and the fine ceiling differ.
When is an organization out of scope of NIS2?
There are two routes out of scope.
The first is geography. NIS2 applies to entities that operate in, or provide services to, the European Union, so an organization with no EU operations and no EU services is not directly covered. It can still receive contractual security requirements from EU customers, coming out of their Article 21 supply chain obligations.
The second is size. NIS2 generally applies to medium and large organizations, so a small entity, meaning fewer than 50 FTE and turnover below €10 million, that does not provide a critical service is usually outside the main scope. Member States may still designate specific small entities as in scope.
What if your sector is not listed in Annex I or Annex II?
The outcome is borderline. A sector outside the Annex I and Annex II shortlist is not automatically out of scope, because national transposition laws can extend scope and Member States may designate entities outside the standard sector list. This is a case to put in front of an expert rather than read off a table.
Is a small organization that provides a critical service in scope?
The outcome is borderline. A small entity that provides a critical service can be designated in scope by a Member State, and the reverse happens too: certain medium and large entities can qualify for an exemption. Critical here means that a disruption of the service would have a significant impact on public safety, security, or economic activity in the EU.