Directive (EU) 2022/2555 entered into force 16 January 2023. Transposition deadline: 17 October 2024. National laws and competent-authority designations diverge across the 27 Member States.

Does NIS2 apply to your organisation?

Pick a sector, declare size and EU footprint. The tool maps your answer to the directive's scope rules, lists the obligations that would attach, and surfaces the competent authority and CSIRT in your primary Member State.

NIS2 entity scope decision form

Step 1 — Sector

Annex I lists the high-criticality sectors (essential by default at large size). Annex II lists the other critical sectors (important by default at large size). Choose 'none' if neither annex describes you.

Step 2 — Size

Article 2(1) anchors scope to the Annex to the Recommendation 2003/361/EC (medium = 50–249 employees AND turnover ≤ €50M OR balance ≤ €43M; large = ≥ 250 employees OR turnover > €50M).

Step 3 — EU footprint

An entity is in scope if it is established in the EU. Non-EU providers of certain services (DNS, TLD registry, cloud, data centre, CDN, managed services, online marketplace, search engine, social network) must designate a representative under Article 26.

Used to flag Article 26 representative-designation obligations for non-EU entities.

Step 4 — Primary Member State

Used to surface the competent authority + CSIRT designated under Articles 8 and 10. For multi-country providers Article 26(2) routes jurisdiction to a single MS.

Step 5 — NIS1 history (optional)

NIS1 OES / DSP designations grandfather scope considerations under NIS2 transitional rules (Article 41).

Last verified: 2026-06-11