NIS2 size thresholds: linked and partner companies

Published 7 November 2026 by GRCompliance.

Your payroll total is not always the number that matters for a cybersecurity scope check.

If you run a small software business with investors, a parent company or subsidiaries, you need to understand the ownership picture before relying on a size-based answer. A business that looks small on its own may need to count figures from other enterprises.

The second Network and Information Security Directive, usually called NIS2, is Directive (European Union) 2022/2555. Its general size rule refers to the enterprise definition in Commission Recommendation 2003/361/EC. That definition considers staff, finances and relationships between enterprises.

This guide walks through the NIS2 group company size calculation as a preparation task. It does not determine whether your business is legally in scope. Sector, activities, exceptions, jurisdiction and national implementation still matter. Software cannot make legal determinations.

What matters this week, and what can wait

This week, ask your finance lead for the latest approved accounts, annual staff calculation and ownership chart. Include voting rights and control agreements, not just share percentages.

Make a short list of activities you actually provide and the countries involved. Then run an initial NIS2 scope check and record the assumptions behind it.

A large compliance project can wait until you understand the basis for scope. Urgent security weaknesses and any existing reporting or registration duties cannot. Do not treat “still checking” as an exemption.

Your useful output today is a one-page calculation pack that a qualified adviser or competent authority can review without reconstructing the group from scratch.

Start with sector, then apply the size test

Article 2(1) generally covers the types of entities listed in Annexes I and II that qualify as medium-sized enterprises or exceed the medium-sized ceilings, providing services or carrying out activities within the Union.

An ownership calculation alone does not put every business in scope. Check the actual listed entity type and service, not merely a broad industry label. A business selling software is not automatically the same thing as a managed service provider under the Directive.

Also check size-independent categories, national identification rules and relevant exclusions. Article 2 contains cases where size does not decide the answer. Article 4 addresses sector-specific Union legal acts with equivalent requirements.

Keep these questions separate: “What size are we under the referenced definition?” and “Does this law apply to this entity and activity?” The first informs the second; it does not replace it.

Read staff and financial ceilings together

The Recommendation's Annex, Article 2, sets the following categories. “Turnover” means annual revenue for this definition; the balance sheet total is the relevant accounting total, not your cash balance.

Both the staff condition and at least one financial condition must be satisfied for the category. A medium-sized enterprise is within the overall small and medium-sized enterprise ceiling but does not qualify as small or micro.

Do not replace the small-enterprise rule with “under 50 staff means exempt”. On the size test alone, an enterprise with fewer than 50 staff can cease to qualify as small if both financial figures exceed €10 million. Conversely, exceeding one financial ceiling alone need not remove the category if the other financial test and staff test are met.

Exactly 50 is not fewer than 50. Exactly €10 million does not exceed €10 million. These boundaries are easy to blur in a quick questionnaire.

Collect the right staff and accounting figures

Staff are calculated as annual work units: full-time work over the reference year, with part-year, part-time and seasonal work counted as fractions. The Recommendation includes specified categories beyond ordinary employees, including owner-managers. Apprentices and students with qualifying vocational training contracts are excluded, and maternity or parental leave periods are not counted.

Use the latest approved accounting period and annual figures. Turnover excludes value added tax and other indirect taxes. Newly established enterprises without approved accounts use a good-faith estimate during the financial year.

Article 4 also contains a two-consecutive-accounting-period rule for acquiring or losing a size status through crossing the ceilings. Do not apply that mechanically as a delay following an acquisition or restructuring. If ownership changed, ask an adviser to confirm the effect on the calculation and its reference date.

Keep source documents and the calculation date. Today's headcount in a people dashboard is not necessarily the required annual figure.

Distinguish autonomous, partner and linked enterprises

Autonomous: use the enterprise's own data

An autonomous enterprise is neither a partner nor linked enterprise under Article 3. Its own accounts determine the relevant data.

A holding below 25 per cent is not a universal safe harbour. Control rights or other relationships can make enterprises linked even without a simple majority shareholding.

Partner: normally add a proportionate share

Partner enterprises are not linked but meet the relevant holding test of 25 per cent or more of capital or voting rights. Specified investor exceptions can permit autonomous status where their conditions are satisfied.

Under Article 6, the proportion used is the percentage of capital or voting rights, whichever is greater. Cross-holdings and relationships with other enterprises need care. The partner's own linked enterprises can affect the figures being added.

Linked: normally add 100 per cent

Linked relationships include majority voting rights, rights to appoint or remove a majority of a governing body, dominant influence through specified arrangements, and agreements giving control over majority voting rights.

Indirect links count too. Certain relationships through people acting jointly also count when the enterprises operate in the same or adjacent markets.

Add 100 per cent of linked-enterprise data not already included through consolidation. Do not count the same enterprise twice. Consolidated accounts simplify some calculations but do not remove the need to understand what they contain.

Two explicitly hypothetical calculations

These examples use invented figures solely to explain arithmetic. They assume stable relationships, the same reference period, no double counting and no special exception. They are not legal scope decisions.

Assume a straightforward 30 per cent partner relationship, with equal capital and voting percentages and no control rights. The resulting 62 annual work units exceed the small-enterprise staff ceiling, even though the combined balance sheet total remains below €10 million. Under these assumptions, the figures fit the medium-sized category.

Now consider a different fictional business with 22 annual work units, €4 million turnover and a €3 million balance sheet total. A linked parent contributes 100 annual work units, €30 million turnover and €20 million balance sheet total, none already consolidated in those figures.

Adding the parent's data at 100 per cent produces 122 annual work units, €34 million turnover and €23 million balance sheet total. On those simplified facts, the business cannot rely on its own 22-person figure as proof that it is small.

Neither example establishes NIS2 scope. You still need the relevant activity, national rules and exceptions.

Two NIS2 qualifications that are easy to misread

First, Article 2(1) says Article 3(4) of the Recommendation's Annex does not apply for this Directive. That provision concerns the general exclusion from small and medium-sized enterprise status where public bodies control 25 per cent or more, subject to stated exceptions. It is not the linked-enterprise definition, which is in Article 3(3). Do not use this carve-out to ignore group relationships.

Second, NIS2 recital 16 permits Member States to take account of an entity's independence from partner or linked enterprises when applying Article 6(2). It mentions independence of systems and services. This is not a blanket right to disregard your group because you have separate technology.

Ask how the relevant national framework applies that possibility. Document any authority or adviser conclusion; do not silently change the arithmetic to achieve the preferred result.

Prepare a calculation pack someone can review

Before relying on a checker result, keep:

1. Legal entity and actual services provided.
2. Ownership and voting-rights chart, including indirect relationships.
3. Relevant control agreements and investor exceptions being considered.
4. Approved accounts and annual work-unit figures for the relevant periods.
5. Aggregation worksheet showing proportions, consolidation and avoided double counting.
6. Countries, competent authority and unresolved scope questions.
7. Dated conclusion, reviewer and triggers for reassessment.

Use the existing Belgium country page or Netherlands country page as a route into country-specific checking, not a substitute for current national law.

If you want to organise the risks and controls that follow your scope decision, GRCompliance Core documents a risk register, controls and linked evidence. Try the live demo with fictional data, or inspect the free open-source Core. Neither provides a binding legal classification.

Frequently asked questions

Does having fewer than 50 staff put a business outside NIS2?

Not necessarily. Financial figures, group relationships, sector and size-independent cases can change the answer. Check the complete definition and national framework rather than treating headcount as an exemption.

Do linked companies contribute only their ownership percentage?

Generally not. The Recommendation normally adds 100 per cent of linked-enterprise data not already included through consolidation. Partner enterprises normally contribute proportionately under the applicable rules.

Does NIS2 remove linked-enterprise calculations?

No. Its carve-out for Article 3(4) concerns the Recommendation's public-body rule, not Article 3(3)'s linked-enterprise definition. National application of the independence consideration also needs separate review.

Can a scope checker give a final legal answer?

No. It can help organise facts and identify questions. Software cannot make legal determinations; confirm uncertain classifications with a qualified adviser or the competent authority.

Sources

Reviewed 7 November 2026. Examples simplify the relationships and are not individual legal advice.

• Directive 2022/2555, Articles 2 and 4, recital 16 and Annexes I and II.
• Commission Recommendation 2003/361/EC, Annex Articles 2–6.
• GRCompliance Core documentation: verified product capabilities only.