Does NIS2 apply to foreign subsidiaries?

Under the directive, yes for subsidiaries established in the European Union. Each one, as a rule, falls under the NIS2 law of the country where it is established, and its size is calculated with the group’s. The exception: digital service providers (cloud, managed services, DNS, data centres…) fall under the country of their main EU establishment. Subsidiaries outside the EU are not subject to NIS2.

For the general method, see Who does NIS2 apply to?.

The general rule: country of establishment

Article 26 of Directive (EU) 2022/2555 sets the principle: an entity falls under the jurisdiction of the Member State where it is established. A subsidiary is a separate legal person, so it is subject to its own country’s transposition law.

Applied to a group, this rule leads in principle to the following pattern:

• a subsidiary established in Germany falls under German law, one established in Spain under Spanish law;
• the Irish or French subsidiary of a US or UK group falls under Irish or French law, like any company established there.

Scope criteria (sectors, thresholds) are common, as the directive sets them. But arrangements vary by country: competent authority, registration platform, level of fines, possible extensions of scope. Transposition timing also differs: when the Commission referred four countries to the Court of Justice on 8 July 2026, France, Ireland, Spain and the Netherlands had still not fully transposed.

The digital services exception: main establishment

For certain entity types, the directive applies a different rule (Article 26(1)(b)). The following fall under the Member State of their main establishment in the Union:

• DNS service providers, top-level domain registries and domain name registration services;
• cloud computing, data centre and content delivery network providers;
• managed service providers (MSPs) and managed security service providers (MSSPs);
• online marketplaces, online search engines and social networking platforms.

The main establishment is the Member State where decisions on cybersecurity risk-management measures are predominantly taken. Failing that, it is where cybersecurity operations are carried out, then the establishment with the most employees in the Union (Article 26(2)).

For an MSP group operating in several countries, this can mean a single lead regulator for all covered activities.

Electronic communications providers follow yet another rule: they fall under each Member State where they provide services (Article 26(1)(a)).

Non-EU companies serving the European market

Article 26(3) provides that a digital service provider from the list above that is established outside the Union but offers services in it designates a representative in a Member State where it operates. It then falls under that state’s jurisdiction.

Size is calculated at group level

This is what brings many small subsidiaries into scope. NIS2 thresholds use the EU SME definition, which adds up the headcount and figures of linked enterprises. Under that definition, a 20-person subsidiary of a 5,000-person international group can therefore count as a large enterprise.

Recital 16 lets Member States take into account the subsidiary’s independence, particularly if its information systems are separate from the group’s. Whether this applies depends on each national law. The calculation is detailed in NIS2 size thresholds.

What about subsidiaries outside the EU?

A subsidiary established in the UK, Switzerland, Morocco or the US is not subject to NIS2. But if it connects to group systems, it is part of the attack surface of the regulated EU entities. In practice, the group therefore has good reason to include it in its security and detection measures. Relationships with it also fall under supply chain security: see Are my suppliers subject to NIS2?.

Tips for a multi-country group

1. List every legal entity in the group, its country, activities and likely category.
2. Identify the entities that follow the main-establishment rule.
3. Set a common baseline of measures at group level, then adjust to each country’s requirements.
4. Organise incident reporting: who reports, to which authority, in which country, taking into account the Article 23 deadlines (early warning within 24 hours).

For the analysis of each entity’s situation, rely on your legal adviser: transposition laws can differ on points of detail.

Worth knowing: the Commission’s proposal to amend NIS2, published on 20 January 2026, aims to clarify jurisdiction rules. It has not been adopted yet.

Talk to an expert

Unified monitoring across subsidiaries makes incident detection and reporting simpler in every country. If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

Can head office report incidents for every subsidiary?

The process can be centralised, but the directive ties each entity to the competent authority of its country, and reports go to that authority within the deadlines set by Article 23. It helps to plan who does what, country by country, with your legal adviser.

Is the EU subsidiary of a UK or US group in scope?

Under Article 26 of the directive, an entity established in an EU country falls under that country's law, and the EU SME definition used by NIS2 adds up the size of linked enterprises, even if the parent is outside the Union. Assessing a specific case is a matter for your legal adviser.

Does a non-EU parent company have obligations?

The directive applies to entities established or offering listed digital services in the EU; whether a given parent company is affected is a question for legal counsel. In practice, the parent often sets group security policy, so involving it is usually useful.