Who does NIS2 apply to? How to tell if your organisation is in scope

Who does NIS2 apply to? According to the directive, an organisation is in principle in scope if it operates in one of the 18 sectors listed in the text and has at least 50 employees, or more than €10 million in both annual turnover and balance sheet total. Some entities are covered whatever their size. Each EU country enforces NIS2 through its own national law.

This page is the entry point to our series on NIS2 scope. It sets out the full method in four questions, then links to a dedicated article for each specific case.

Where NIS2 stands, as of 17 October 2026

Directive (EU) 2022/2555, known as NIS2, had to be transposed by Member States by 17 October 2024 (Article 41). Most have done so, but not all. On 8 July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to notify full transposition.

In France, where Cyna is based, the bill on the resilience of critical infrastructure and cybersecurity was adopted by the Senate on 12 March 2025 and by the National Assembly’s special committee on 10 September 2025. Its debate in plenary, scheduled for 7 and 9 October 2026, was withdrawn from the agenda on 6 October 2026, with no new date set.

What this means in practice: national obligations take effect through each country’s transposition law. But the scope criteria come from the directive itself, and national laws largely mirror them. It is therefore already possible to form a first view.

Question 1: is your activity in one of the 18 sectors?

NIS2 does not cover “every business”. It covers types of entities listed in two annexes:

• Annex I, 11 sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business to business), public administration, space.
• Annex II, 7 other critical sectors: postal and courier services, waste management, chemicals, food production and distribution, manufacturing (medical devices, computer and electronic products, electrical equipment, machinery, motor vehicles, other transport equipment), digital providers (online marketplaces, search engines, social networks), research.

This is the most underestimated criterion. A machinery manufacturer, a food wholesaler or a managed IT provider can fall within these annexes without ever having thought of themselves as “critical operators”. Sub-sectors are detailed in Which sectors are covered by NIS2?.

According to the directive, an entity none of whose activities appears in these annexes is not directly covered. It may still feel the effects through its clients (see question 4).

Question 2: are you above the size thresholds?

If your activity is listed, size decides. NIS2 applies to entities that are at least medium-sized enterprises under Commission Recommendation 2003/361/EC (Article 2(1) of the directive). In practice, the thresholds are:

• 50 or more employees, or
• more than €10 million in annual turnover and more than €10 million in balance sheet total.

Headcount and financial figures include linked and partner enterprises, which makes a big difference for group subsidiaries. Full details and examples are in NIS2 size thresholds: from what size does NIS2 apply?.

Question 3: are you a “regardless of size” case?

Article 2(2) and 2(3) bring some entities into scope even below the thresholds:

• providers of public electronic communications networks or publicly available electronic communications services;
• trust service providers;
• top-level domain name registries and DNS service providers;
• an entity that is the sole provider, in a Member State, of a service essential to critical societal or economic activities;
• entities whose disruption would significantly affect public safety, public security or public health, or create a systemic risk;
• entities identified as critical entities under Directive (EU) 2022/2557 (the CER Directive);
• central government public administration entities.

These cases explain why a small organisation can be in scope. We cover them in NIS2 SMEs: does NIS2 apply to small and medium-sized businesses?.

Question 4: essential, important, or indirectly affected?

Article 3 places in-scope entities in one of two categories:

• essential entity: as a rule, a large enterprise in an Annex I sector, or an entity designated as such;
• important entity: every other in-scope entity, in particular medium-sized Annex I entities and all Annex II entities.

Article 21 sets the same security measures for both categories. What differs, according to the directive, is the intensity of supervision and the maximum fine. See NIS2 essential vs important entities: what is the difference?.

An organisation that is out of scope but works for in-scope entities may receive contractual requirements: Article 21 provides that in-scope entities manage supply chain security. Two articles cover this, depending on where you sit:

• as a buyer: Are my suppliers subject to NIS2?
• as a supplier: Does NIS2 affect me if my client is in scope?

Managed service providers

Managed service providers (MSPs) and managed security service providers (MSSPs) are listed in Annex I under “ICT service management”. According to the directive, an MSP that meets the size thresholds is therefore in principle in scope. This is a major change from NIS1, which did not cover them. We explore this in NIS2 Directive: obligations, risks and growth levers.

Specific situations

A few questions come up once you have applied the method:

• You are part of a foreign group, or have subsidiaries in other countries? The jurisdiction rule depends on your activity. See Does NIS2 apply to foreign subsidiaries?.
• You were an operator of essential services under NIS1? See NIS1 vs NIS2: what changed?.
• You operate in France and are an operator of vital importance (OIV)? See Does NIS2 replace France’s LPM cyber rules?.
• You want to know whether your organisation has already registered? See How do I check whether I am registered for NIS2?.
• Still unsure? See Not sure if NIS2 applies to you? What to do next.

How many organisations are affected?

Figures vary by country. In France, the national cybersecurity agency ANSSI states that “several thousand entities across 18 sectors” will be covered. Published estimates differ, as no final census exists: checking your own situation is safer than relying on an order of magnitude.

A text that may still change

On 20 January 2026 the European Commission proposed targeted amendments to NIS2 (proposal COM(2026) 13). They include a new “small mid-cap” category to be treated as important entities, and clarified jurisdiction rules. These amendments are still under negotiation and do not apply today. We will update this series if they are adopted.

Four profiles and the questions they raise

These profiles show how the criteria are read. They are not a legal qualification: only an analysis of the real situation, using the national authority’s tools and legal advice, can settle the question.

A private clinic with 120 employees. Healthcare providers are listed in Annex I under health, and the headcount is above the 50-employee threshold. This is typically a profile to examine closely. For entities in scope, Article 23 provides for an early warning within 24 hours of becoming aware of a significant incident, which means being able to detect an incident at any hour, including at night or at weekends.

A 35-person MSP that belongs to a 400-person group. On its own, it would be a small enterprise. But Recommendation 2003/361/EC takes linked enterprises into account, and managed services fall under Annex I. The question of attachment to the group therefore arises, and Recital 16 of the directive addresses subsidiary independence. How national law will handle this point varies: it is a borderline case to review with a legal adviser.

An independent precision parts manufacturer with 30 employees and €6 million turnover. Machinery manufacturing is listed in Annex II, but the company is below the thresholds and does not appear to fall under any special case. The directive therefore does not cover it directly. Security requirements may however reach it through its contracts if it supplies a car manufacturer or a medical device maker.

A marketing agency with 80 employees. Its activity is not listed in any annex: the directive does not cover it directly, whatever its size. It may be affected indirectly if it manages websites or accounts with privileged access for regulated clients.

What this method does not replace

This framework helps you find your bearings. It does not replace:

• your national authority’s own tools, such as the eligibility test ANSSI offers French entities on its MesServices platform;
• legal advice for borderline cases (complex groups, multiple activities, designation by the state);
• the final wording of the national law that applies to you.

Talk to an expert

Knowing whether you are in scope is only step one. Article 21 provides, among other things, for incident detection and handling measures, and Article 23 for short reporting deadlines. That is Cyna’s core business: a 24/7 SOC operated from France and a CERT team, delivered through its partner MSPs, who own the relationship with their clients. Cyna does not make an entity NIS2 compliant: compliance depends on all the measures each organisation puts in place.

If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch and we can point you to a partner.

Frequently asked questions

Does NIS2 already apply?

It depends on the country. Under the directive, obligations take effect through the national transposition law of each Member State. Most Member States have adopted theirs; a few, France among them, had not as of 17 October 2026.

Is local government covered?

The directive covers central government and leaves each Member State to decide for regional and local levels (Article 2(2) and 2(5)). Coverage therefore varies by country.

Do I need ISO 27001 certification to comply?

The NIS2 text does not require certification as such. ISO 27001 can help structure the Article 21 measures. Assessing an entity's compliance is a matter for the competent authorities, and specific cases are best discussed with a legal adviser.

Can a charity or public body be in scope?

Yes. NIS2 covers public and private entities whatever their legal form. A public hospital, a non-profit running care homes or a water authority can be in scope if they meet the criteria.