Am I in scope of NIS2? Free scope checker

NIS2 (Directive (EU) 2022/2555) covers organisations in the sectors in Annex I and Annex II. As a rule it applies from medium size: 50 or more staff, or annual turnover and balance sheet total both above EUR 10 million. Group figures can count. Some services are in scope at any size. The check is free and needs no account.

Indicative only, not legal advice.

How the checker works

Answer with your activity, headcount, annual turnover, balance sheet total and Member State. Add linked and partner enterprises if you have them. Tick a designation box only if it might apply. The result names the Directive article that produced it: likely in scope as an essential entity, likely in scope as an important entity, likely out of scope, or a prompt to check a national designation. Domain name registration services are called out on their own.

Sectors covered (Annex I and II)

Annex I is sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business to business), public administration and space. Annex II is other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research. The activity list in the form follows those annexes. It is a guide to the annex types, not a copy of every legal definition.

Size thresholds and exceptions

The thresholds come from Commission Recommendation 2003/361/EC, which Article 2(1) of NIS2 uses. Medium means 50 or more employees, or annual turnover and annual balance sheet total both above EUR 10 million. Large means 250 or more employees, or turnover above EUR 50 million and balance sheet total above EUR 43 million. A figure that only meets one of the two money tests does not cross that money threshold.

Linked enterprises, above 50 percent control, are added in full. Partner enterprises, a holding from 25 to 50 percent, are added in proportion to the holding. Article 2(1) also says Article 3(4) of the Recommendation's Annex does not apply, so a public-sector shareholder does not by itself push an organisation over the line. Simplified: control can also arise from voting rights or the right to appoint the board, some investors at 25–50% don't count as partners, and a change of size category takes effect only after two consecutive years (Rec. 2003/361/EC Annex, Art. 3–4).

Size does not decide every case. Article 2(2) to Article 2(4) bring in some entities at any size, and a Member State can designate others.

Essential vs important entities

Under Article 3(1), essential entities include Annex I entities above the medium-sized ceilings, qualified trust service providers, TLD name registries and DNS service providers of any size, and medium-sized or larger providers of public electronic communications networks or services. Central government public administration entities, as defined by national law, are essential (Art. 3(1)(d)). Regional public administration is in scope only after a national risk assessment (Art. 2(2)(f)(ii)). Local government and education institutions are in scope only where the Member State opts in (Art. 2(5)). Bodies working in national security, public security, defence or law enforcement are excluded (Art. 2(7)). Other entities that are in scope are important entities under Article 3(2), including medium-sized Annex I entities, medium-sized and large Annex II entities, and small or micro public electronic communications providers. Non-qualified trust service providers are essential if they exceed the medium-sized ceilings (Art. 3(1)(a)) and important otherwise (Art. 3(2)).

Article 32 is proactive supervision for essential entities. Article 33 is ex post supervision for important entities. Articles 20, 21 and 23 apply to both.

Country rules

Choose any of the 27 Member States in the form. Austria, Belgium, Finland, Germany, Ireland, Italy, Luxembourg, the Netherlands, Poland, Slovenia and Sweden show national notes, each with a last-checked date. Every other country says national details are coming soon. The scope result still uses the Directive.

What to do if you're likely in scope

1. Check whether you must register, and with which authority.
2. Brief the management body. Article 20 requires approval, oversight and training.
3. Map the ten measures in Article 21(2). The NIS2 checklist for SMEs walks through them.
4. Prepare the Article 23 clocks. See NIS2 incident reporting deadlines.

GRCompliance is a self-hosted GRC product that can hold the measures, the risk register and the reporting clocks. Try the live demo on sample data, or book a gap review. For the product overview, see NIS2 compliance software and self-hosted install.

Disclaimer

Indicative only, not legal advice. National transposition can add entities, change registration deadlines or name a different authority.

FAQ

Directive text: Directive (EU) 2022/2555 on EUR-Lex. Size test: Commission Recommendation 2003/361/EC. Agency overview: ENISA.