Not sure if NIS2 applies to you? What to do next
Not sure whether NIS2 applies to you? How to settle it: the four-question method, your authority's tools, who to ask for help and how to record your decision.
Start with the four-question method: sector, size, special cases, category. Then use your national authority’s tools, such as the eligibility test ANSSI offers French entities. If you are still unsure, ask the authority through its contact channels, your legal adviser or your trade association. Either way, record your analysis and start putting basic security measures in place.
This article closes our series on NIS2 scope. The full method is in Who does NIS2 apply to?.
Step 1: gather the right information
Most doubts come from incomplete information. Before any analysis, collect:
- a list of all your activities, including secondary ones, with their NACE codes;
- your headcount in full-time equivalents, your turnover and your balance sheet total for the last two financial years;
- your group structure: who owns you, what you own, and the percentages;
- the countries where you provide services.
Step 2: apply the four-question method
- Is one of your activities listed in the annexes? See Which sectors are covered by NIS2?.
- Are you above the thresholds, group included? See NIS2 size thresholds.
- Are you a “regardless of size” case? See NIS2 SMEs: does NIS2 apply to small and medium-sized businesses?.
- Which category would you fall into? See NIS2 essential vs important entities.
Step 3: use your authority’s tools
Several national authorities publish self-assessment tools. In France, ANSSI offers a test on its MesServices platform (formerly MonEspaceNIS2) that tells you whether your entity is regulated and in which category. It takes a few minutes if you prepared the step 1 information. Keep a copy of the result.
Step 4: pin down the source of doubt
Doubts that survive the self-assessment almost always fall into one of these cases:
| Source of doubt | Who can help |
|---|---|
| Activity on the edge of a sub-sector | Your national authority, through its contact channels; your trade association |
| Threshold calculation in a complex group | Your accountant; your legal adviser |
| Entities in several EU countries | Your legal adviser; the authority of each country. See Does NIS2 apply to foreign subsidiaries? |
| Former NIS1 operator or French OIV | Your authority, which already knows you. See Does NIS2 replace France’s LPM cyber rules? |
| National law not yet adopted | No final answer until the law is passed: follow the legislative process |
Your managed service provider can also help you gather the technical information and prepare next steps.
Step 5: decide and record it
Once the analysis is done, write a short note: information used, reasoning, conclusion, date. Have senior management sign it off. It will help if the authority or a client asks, and when you repeat the exercise as your situation changes (growth, acquisition, new activity).
If you conclude you are in scope, the next step is usually registration with your national authority (in France, ANSSI offers pre-registration on the same platform). See How do I check whether I am registered for NIS2?.
What if doubt remains?
Some answers only become final once the national law is published, and a few EU countries, France among them, had still not adopted theirs as of 16 August 2026. In the meantime, a sensible approach is to prepare as if you were in scope, on the basics:
- being able to detect an incident and respond quickly;
- securing access, with multi-factor authentication;
- tested backups and a business continuity plan.
These measures are worthwhile whatever the final answer. They also meet your clients’ expectations if they are in scope themselves: see Does NIS2 affect me if my client is in scope?.
Talk to an expert
Want to know where you stand on detecting and handling an incident? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch and we can point you to a partner.
Frequently asked questions
How long does the analysis take?
For a simple business, a few hours once the information is gathered. For a group with several activities and countries, allow several days and legal support.
What if I get it wrong in good faith?
A documented, dated analysis lets you show your reasoning and the information you had at the time. How an error of judgement would be treated is up to the authority: if your situation is ambiguous, it is better to raise it with your legal adviser or the authority than to wait.
Should I wait for the law before doing anything?
Waiting rarely pays. The scope criteria are already known, and the most useful measures take months to put in place. Starting with detection, access security and backups is useful whatever the final answer.
Who in the company should own this analysis?
Usually management, supported by IT, finance (for thresholds) and legal. Article 20 of NIS2 provides that management bodies approve the risk management measures and oversee their implementation, so it makes sense to have the conclusion signed off at that level.
This article provides general information for guidance only. It is neither legal advice nor a contractual commitment from Cyna: service terms are those of the contract agreed through your partner MSP. For any regulatory question, consult your legal adviser.