Does my business fall under NIS2?

## Does my company fall under NIS2? Whether your company itself falls under the NIS2 directive depends on two things: the sector in which you operate and the size of your organisation. The directive identifies in two annexes sectors that it considers important for society or the economy, ranging from energy and transport to digital infrastructure and wastewater management. If your company falls within such a sector and within the size range that the directive applies to, you are likely to be an 'essential' or 'important' entity yourself, with all the associated obligations. But the answer does not stop there. Many more companies fall outside the sector and size criteria, yet still face the requirements as suppliers, installers or service providers of a company that is subject to the directive. These subject organisations must assess their own supply chain, and that translates into questionnaires and contractual requirements for companies that themselves never need to register with a regulator. ### Sector: Annex I and II The directive lists sectors in two annexes. Annex I names sectors that are considered essential: including energy, transport, banking, drinking water, digital infrastructure and government. Annex II names sectors considered important, such as postal and courier services, waste management, chemicals, food and certain digital services. An installation company, an IT service provider or a consultancy is usually not named specifically in those annexes, but the descriptions are broader than the sector name suggests. Anyone in doubt as to whether their activity falls under one of these sectors should read the description in the official text itself, not just the sector name. ### Size: when your company counts Beyond the sector, the directive looks at the size of the organisation, using the standard EU classification of small, medium and large enterprises based on headcount and turnover or balance sheet total. For most sectors, the rule is: the larger the enterprise, the sooner it falls within the scope. There are also exceptions where size matters less, for example when an organisation is the only provider of a particular service in a country. Those exceptions are precisely defined in the directive and in the national law based on it; an exact assessment for your own situation is for you, your legal adviser or the regulator to make. ### The largest group falls outside, and faces the requirements anyway The part of the directive that attracts the most attention is about the due diligence obligation: subject organisations must take appropriate measures and also assess their suppliers in doing so. This is precisely where the largest group of companies faces the requirements. An installation company maintaining building management systems for an energy company, a cleaning company working for a hospital, or an IT partner of a municipality: none of them need to register themselves, but all of them can receive a questionnaire. In practice, this is often called 'supply chain impact': you do not fall under the directive yourself, but a customer who does is still asking you to demonstrate that your security is in order. Whether this applies to your company depends on who your customers are and how important your service is to them. This is difficult to assess without a full picture of sector, size and supply chain role together. [[LINK:/nis2-check|In a few questions you can see where your company stands]], with an explanation of why and a suggestion for the next step. ### Financial institutions: a separate regime Banks, insurers and other financial institutions do not fall under NIS2 but under a separate regulation for digital operational resilience, specifically aimed at the financial sector. Anyone active in that sector usually recognises this at the first intake question about the sector. ### What to do if the answer is not clear Sector and size together give a good first indication, but the precise boundary between 'essential', 'important', 'supply chain impact' and 'not affected' requires tailored consideration. [[LINK:/onderwerpen|The knowledge base covering all topics per situation]] provides an explanation for each concept and references the source in the official text. If you remain uncertain after reading that, a legal adviser or the regulator in your country is the appropriate party to assess your specific situation; secria.eu deliberately does not pronounce on that. Would you first like to know where the information on this platform comes from and how it is kept current? [[LINK:/hoe-het-werkt|Read here how we maintain sources]]. Answers to practical questions about using the platform can be found in [[LINK:/veelgestelde-vragen|the overview of frequently asked questions]]. The short answer to 'does my company fall under NIS2' is thus obtained by comparing sector, size and supply chain role side by side. Do the free check and read the knowledge base; they already give you, without an account, a first, well-founded picture of where your company stands.