NIS2 size thresholds: from what size does NIS2 apply?

In the 18 sectors it covers, NIS2 applies from medium-sized enterprise level: 50 or more employees, or more than €10 million in turnover and more than €10 million in balance sheet total. Headcount and figures include linked group companies. Above 250 employees, an Annex I entity is, as a rule, an essential entity.

Size is checked after sector. For the full method, see Who does NIS2 apply to?.

The rule: the EU SME definition

Article 2(1) of Directive (EU) 2022/2555 refers to Commission Recommendation 2003/361/EC. Three size bands matter:

Category	Headcount	And either financial test	NIS2 status (if sector listed)
Small enterprise	Fewer than 50	Turnover or balance sheet of €10m or less	Out of scope, except special cases
Medium-sized enterprise	Fewer than 250	Turnover of €50m or less, or balance sheet of €43m or less	In scope, as a rule an important entity
Large enterprise	250 or more	Or turnover above €50m and balance sheet above €43m	In scope: essential if Annex I, important if Annex II

In plain terms: under these definitions, a business in a listed sector stops being a “small enterprise”, and therefore as a rule enters scope, as soon as it has 50 or more employees, or as soon as its turnover and its balance sheet both exceed €10 million.

How headcount is calculated

The Recommendation measures staff in annual work units (AWU):

• a full-time employee present all year counts as 1; part-time staff and people present for part of the year count pro rata;
• employees, owner-managers and partners engaged in regular activity are included;
• apprentices and students on vocational training contracts are excluded.

Figures come from the latest closed financial year. A change of category only applies once a threshold has been crossed for two consecutive financial years (Article 4 of the Annex to the Recommendation).

The group trap: linked and partner enterprises

This is where most mistakes happen. The Recommendation provides for adding up:

• 100% of the headcount and figures of linked enterprises, essentially those you control or that control you (for example, more than 50% of voting rights);
• a proportional share of partner enterprises held between 25% and 50%.

Under this rule, a 30-person subsidiary of a 600-person group counts, as a rule, as a large enterprise. If it carries out an Annex I activity, it is as a rule in scope.

The directive adds a nuance. Recital 16 lets Member States take into account how independent an entity is from its group, in particular where its network and information systems are independent. How each country applies this depends on its national law. For international groups, see also Does NIS2 apply to foreign subsidiaries?.

Three examples

These fictional examples illustrate how the Recommendation’s thresholds read. They do not replace an analysis of a real situation, which also depends on national transposition law and is worth checking with a legal adviser.

Organisation	Sector	Figures	Reading under the thresholds
Independent electrical equipment manufacturer	Annex II	40 staff, turnover €12m, balance sheet €8m	Small enterprise (balance sheet below €10m): out of scope
Independent MSP	Annex I	40 staff, turnover €15m, balance sheet €12m	Medium-sized: important entity
Food wholesaler, wholly owned group subsidiary	Annex II	30 staff alone, 600 with group	Large enterprise: important entity

When size does not matter

Some entities are in scope even below 50 employees: electronic communications providers, trust service providers, DNS providers, sole providers of an essential service, designated critical entities. These are covered in NIS2 for SMEs: does NIS2 apply to small businesses?.

After size

Once you know you are in scope, size also sets your category. See NIS2 essential vs important entities.

Worth knowing: the Commission’s proposal to amend NIS2, published on 20 January 2026, introduces a “small mid-cap” category treated as important entities. It has not been adopted and does not change today’s thresholds.

Talk to an expert

Just above the thresholds and wondering how to meet detection and reporting requirements without a dedicated team? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

Do agency workers and contractors count towards headcount?

The Recommendation counts people who work for the business and are treated as employees under national law. External contractors billed by another employer are generally not counted. If in doubt, have your accountant check the calculation.

I have just passed 50 employees: am I in scope straight away?

Under Article 4 of the Annex to Recommendation 2003/361/EC, a change of category only applies after two consecutive financial years above the threshold. Your legal adviser can confirm your situation. Plan ahead anyway: security measures take months to put in place.

My turnover is above €10 million but my balance sheet is not: am I in scope?

Not on that basis alone, according to the EU Recommendation: with fewer than 50 employees, a business only stops being a "small enterprise" if both its turnover and its balance sheet exceed €10 million.

Does a non-profit count as an enterprise?

Yes. The EU definition treats any entity carrying out an economic activity as an enterprise, whatever its legal form.

Which accounts are used?

The latest closed and approved financial year.