NIS2 SMEs: does NIS2 apply to small and medium-sized businesses?

NIS2 SMEs: many SMEs are in scope. A medium-sized business, with 50 to 249 employees, operating in one of the 18 listed sectors falls under NIS2 as an important entity. A small business with fewer than 50 employees is only covered in specific cases set out in Article 2 of the directive, or indirectly through its clients’ requirements.

This article is part of our series on NIS2 scope. For the full method, see Who does NIS2 apply to?.

”SME” does not mean “out of NIS2”

Under the EU definition, SMEs are businesses with fewer than 250 employees. NIS2, however, applies from medium-sized enterprise level: 50 employees, or more than €10 million in both turnover and balance sheet. A large share of SMEs, those with 50 to 249 staff, is therefore in scope if their activity is listed.

Your business	Sector listed in NIS2	Result
50 to 249 employees	Annex I (energy, health, transport, managed IT…)	Important entity
50 to 249 employees	Annex II (manufacturing, food, waste…)	Important entity
Fewer than 50 employees, €10m or less turnover or balance sheet	Annex I or II	Out of scope, except the special cases below
Any size	No listed sector	Not directly in scope

Watch the calculation: Recommendation 2003/361/EC provides for the headcount and financial data of linked or partner enterprises to be taken into account. For a specific case, legal advice is the safest route. See NIS2 size thresholds.

When a small business is in scope

Article 2 of Directive (EU) 2022/2555 covers certain entities regardless of size:

1. Electronic communications providers: public electronic communications networks or publicly available services.
2. Trust service providers: electronic signatures, time stamping, certificates and so on.
3. Top-level domain name registries and DNS service providers.
4. The sole provider of an essential service for critical societal or economic activities in a Member State.
5. Entities whose disruption would significantly affect public safety, public security or public health, or create a systemic risk.
6. Entities of specific importance at national or regional level for their sector or type of service.
7. Critical entities identified under the CER Directive (2022/2557).

Cases 4 to 7 require designation by the state. A small business cannot place itself in these categories: if it is concerned, the national authority will tell it.

The most common case: SMEs affected through their clients

For most small businesses, NIS2 will arrive through their clients. Article 21(2)(d) provides that in-scope entities manage supply chain security. They may therefore ask their suppliers and service providers for:

• security clauses in contracts;
• questionnaires or evidence of measures in place;
• prompt reporting of any incident that could affect them.

An out-of-scope SME may therefore need to demonstrate a level of security close to that of a regulated entity. See Does NIS2 affect me if my client is in scope?.

What NIS2 asks of an in-scope SME

An in-scope SME is usually an important entity. The directive sets the same security measures for it as for an essential entity, with reactive supervision. The most demanding points for a small team:

• the Article 21 risk-management measures (incident handling, business continuity, supply chain security, multi-factor authentication and more);
• the involvement of senior management, who, under Article 20, approve the measures and take training;
• reporting of significant incidents, for which Article 23 provides an early warning within 24 hours, a notification within 72 hours and a final report within one month.

Detecting and reporting within these deadlines is often the hardest part without an in-house security team. That is exactly where an outsourced SOC, delivered through your managed service provider, makes sense. See NIS2 essential vs important entities.

And national transposition?

Obligations apply once the national law of the country where you are established is in force. Most EU countries have transposed NIS2. When the European Commission referred four of them to the Court of Justice on 8 July 2026, France, Ireland, Spain and the Netherlands had still not notified full transposition. Scope, however, is set by the directive: an SME that thinks it is concerned can use any remaining time to prepare, and have its position checked by its legal adviser.

Talk to an expert

An in-scope SME, or a supplier to one? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch and we will connect you with a partner.

Frequently asked questions

Can a micro-business be in scope?

Rarely, and only in the special cases listed above: electronic communications provider, trust service provider, DNS provider, or designation by the state. Most micro-businesses will be affected indirectly, through their clients.

Are obligations lighter for an SME?

The measures are the same, but Article 21 provides that they be proportionate to the entity's size, risk exposure and implementation cost. How that proportionality applies to a given case is a matter for your legal adviser and the competent authority.

How long does preparation take?

It depends on your starting point. The longest workstreams are often governance, supplier management and the ability to detect incidents around the clock.