Does NIS2 apply to my company? A practical way to check

TL;DR — NIS2 is an EU cybersecurity law that applies based mainly on three things: where you operate, what services you provide, and your company size. The fastest practical check is: list your legal entities and EU operations, map your services to NIS2 sectors, count employees and turnover/balance sheet, then ask whether you are in an "essential" or "important" sector or have been specifically designated by a national authority. Reading time: ~7 min

What it is and where it sits

NIS2 is the EU's Network and Information Security Directive 2 (a law that sets cybersecurity and incident-reporting duties for certain organizations). It does not replace your contracts, ISO 27001, SOC 2, GDPR, or cyber insurance; it sits alongside them as a legal obligation.

The practical point: NIS2 is not triggered because you "use software" or "store personal data." It is triggered because your company provides certain kinds of services or infrastructure that the law treats as important to society or the economy, and because you meet size or designation criteria.

From a business architecture point of view, NIS2 sits above your technical stack. It affects the company that operates the service, not a single server or app. But to answer whether it applies, you usually need facts from several places:

• Legal/finance: legal entity name, country of establishment, employee count, annual turnover, annual balance sheet total.
• Operations: which countries you serve, whether you have EU customers or EU establishment.
• Product/engineering: what the service actually does in plain language.
• Security/IT: whether you run critical systems, incident response, supplier management.

A simple way to think about it:

[Company] ---- 1. operates service ----> [Sector check]
[Company] ---- 2. size & entity facts ----> [Threshold check]
[Authority] <---- 3. designation? ---- [Company]
[Sector check] ---- 4. combine ----> [NIS2 likely applies?]
[Threshold check] ---- 5. combine ----> [NIS2 likely applies?]

What talks to it? In practice, your decision process pulls from:

• your accounting system or annual report for size thresholds,
• your company registry records for legal entities,
• your website, contracts, and product docs for service descriptions,
• and sometimes notices from a national regulator (the authority that enforces the law in a member state).

What it replaces? Usually nothing directly. If you were under the older NIS rules in your country, NIS2 broadens and updates the scope. For many companies, the real change is that sectors are wider, management accountability is clearer, and supply-chain/security controls are more explicit.

How it actually works

The mechanism is concrete: you do a scope test.

The four-question test

1. Do you operate in the EU? This can mean you are established in an EU member state, or in some cases you provide covered services there.
2. Are you in a covered sector? Examples include energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space, postal/courier, waste, chemicals, food, manufacturing of certain critical products, digital providers, and research.
3. Are you big enough? A common practical threshold is whether you are at least a medium-sized enterprise (generally 50+ employees and either more than EUR 10 million turnover or balance sheet total), though there are exceptions.
4. Could you be covered anyway? Some entities can be covered regardless of size, for example because they provide especially critical services, are the sole provider in a country/region, or are specifically identified by a national authority.

One realistic example

Let’s walk through a realistic software-agency customer: a SaaS company that provides managed cloud backup and DNS hosting for business customers, has a German subsidiary, 85 employees total in the group, and EUR 14 million annual turnover.

Step 1: Gather the company facts

Open the latest signed annual accounts or management report and write down:

• full legal entity names,
• countries of establishment,
• employee count,
• annual turnover,
• annual balance sheet total.

If you use an accounting system, export the annual report or trial balance summary. If your finance team keeps this in a spreadsheet, use that. You are not looking for perfect legal analysis yet; you are collecting evidence.

Create a simple worksheet like this:

entity,country,employees,turnover_eur,balance_sheet_eur,services
Acme Backup GmbH,Germany,32,6200000,4100000,"managed backup; DNS hosting"
Acme Cloud Ltd,Ireland,18,2900000,1500000,"customer support; billing"
Acme Holdings SAS,France,35,4900000,8200000,"group management"

What this does: gives you a factual base for the size test and entity mapping. Gotcha: NIS2 analysis may depend on how the group is structured and how national law treats linked/partner enterprises, so do not assume each entity stands alone without checking.

Step 2: Describe the service in plain English

Do not start with your marketing slogan. Start with what customers actually rely on.

Bad: "AI-powered resilience platform."

Good: "We host authoritative DNS zones for customers and provide managed backup and restore for business systems."

This matters because NIS2 sectors are functional. Regulators care what you do, not what your homepage headline says.

Step 3: Map the service to a covered sector

In this example, DNS hosting strongly points toward digital infrastructure. Managed backup may or may not be independently decisive, but DNS hosting is already a strong signal.

If your company provides one of these, stop and look carefully:

• DNS service
• TLD name registry
• cloud computing service
• data centre service
• content delivery network
• managed service provider or managed security service provider
• public electronic communications network/service

These are common software/infrastructure cases where NIS2 often becomes relevant.

Step 4: Apply the size test

Our example group has 85 employees and EUR 14 million turnover. That is above the common medium-size threshold. So if the entity is in a covered sector, NIS2 likely applies unless a national implementation creates a narrower or broader result.

Step 5: Check for exceptions and national implementation

NIS2 is an EU directive, which means each member state implements it in national law. The broad structure is shared, but the exact authority, registration process, and some scope details are country-specific.

So the practical final step is:

• identify the member state(s) where the relevant entity is established,
• find that country's competent authority or NIS2 guidance,
• check whether your service type is named or interpreted there,
• check whether registration or self-identification is required.

For our example, the answer is: very likely yes, NIS2 applies or should be treated as likely applicable until confirmed by counsel/regulator guidance.

When to use it (and when not to)

Use this check when you need a practical decision, not a law-school essay: budgeting security work, answering a board question, filling in a customer security questionnaire, or deciding whether to get specialist legal advice now.

You probably do not need a full NIS2 program yet if...

• you are a very small company,
• your product is a normal business app and not part of a covered sector,
• you do not operate critical infrastructure or managed digital infrastructure,
• and no regulator, major customer, or procurement process has flagged NIS2.

But even then, do not ignore it completely. Large customers may flow NIS2 expectations down to suppliers through contracts and security questionnaires.

Trade-offs

NIS2 readiness has real benefits, but each benefit costs something.

• Benefit: clearer legal position for sales and procurement. Customers ask fewer vague compliance questions. Cost: legal review time, internal workshops, and documentation effort.

• Benefit: better incident response and governance. You know who reports what, and when. Cost: management training, on-call processes, tabletop exercises, and sometimes outside counsel.

• Benefit: stronger security baseline. Risk management, access control, backup, supplier review, and vulnerability handling become more disciplined. Cost: tooling, staff time, policy maintenance, and possible platform changes.

• Benefit: less last-minute panic when a regulator or enterprise customer asks. Cost: you may do work before you are 100% certain the law applies.

• Benefit: board-level visibility. NIS2 pushes accountability upward. Cost: executives must spend time on cybersecurity oversight and may face personal accountability under national law.

There is also some lock-in risk: once you build your compliance evidence around one GRC tool (governance, risk, and compliance software) or one managed provider, switching later can be painful. Keep your evidence exportable: policies in normal document formats, asset lists in CSV, incident logs in standard formats.

In practice

Below are two simple artifacts you can adapt today to turn the question into a repeatable internal process.

Example 1: a scope-check worksheet template

question,answer,evidence,owner,status
"Which legal entity provides the service?","Acme Backup GmbH","commercial register extract; MSA template","Legal","done"
"In which EU countries is the entity established?","Germany","company registry","Legal","done"
"What service is provided in plain English?","Authoritative DNS hosting and managed backup for business customers","website; order form; architecture overview","Product","done"
"Does the service map to a NIS2 sector?","Likely yes: digital infrastructure","national guidance note; legal memo","Compliance","in review"
"Employee count?","85 group-wide","annual accounts FY2025","Finance","done"
"Turnover or balance sheet above medium threshold?","Yes","annual accounts FY2025","Finance","done"
"Any regulator notice or designation?","No known notice","email check with legal@company","Legal","done"
"Final preliminary conclusion","Likely in scope","scope review meeting notes","Compliance","in review"

What it does: gives you a lightweight evidence trail you can share with management or counsel. Gotcha: keep the wording factual; avoid unsupported legal conclusions in early drafts.

Example 2: an internal decision memo template

## NIS2 preliminary applicability memo

**Date:** 2026-10-30
**Prepared by:** Compliance lead

### 1. Entity and geography
The relevant operating entity is Acme Backup GmbH, established in Germany.

### 2. Service description
The company provides authoritative DNS hosting and managed backup services to business customers in the EU.

### 3. Sector mapping
The DNS hosting activity likely falls within digital infrastructure under NIS2.

### 4. Size test
The group has 85 employees and annual turnover of EUR 14 million, exceeding the common medium-size threshold.

### 5. Exceptions / designation
No authority notice has been received. No evidence currently suggests exclusion from scope.

### 6. Preliminary conclusion
NIS2 is likely applicable. Next step: confirm against German national implementation and determine registration/reporting obligations.

### 7. Actions
- Legal to confirm scope with external counsel
- Security to map current controls to NIS2 requirements
- Management to assign executive owner

What it does: turns scattered facts into a board-ready summary. Gotcha: label it "preliminary" until you have checked the relevant member state's implementation.

⚠️ Do not tell customers or regulators "we are definitely out of scope" based only on a website reading of NIS2. A wrong statement can create contractual, regulatory, and reputational problems. If the answer affects bids, regulated operations, or incident reporting, get country-specific legal confirmation.

If you want one practical workflow inside your company, use this order:

1. Finance exports size data.
2. Legal lists entities and countries.
3. Product writes a one-sentence service description.
4. Compliance maps service to sector.
5. Management reviews the preliminary answer.
6. External counsel or national guidance confirms edge cases.

Further reading

• The text of Directive (EU) 2022/2555 (NIS2)
• European Commission materials on NIS2
• ENISA guidance on NIS2 implementation
• The European Commission SME definition user guide
• National cybersecurity authority guidance for the member state where your entity is established

This article was written by an AI system and published pending human review. Verify anything you intend to act on.