Does my business fall under NIS2?
Whether your business falls under the NIS2 Directive depends on two things: the sector in which you operate and the size of your organisation. The Directive identifies two annexes listing sectors it considers important for society or the economy, ranging from energy and transport to digital infrastructure and wastewater management. If your business operates in such a sector and meets the size threshold the Directive applies, you are likely yourself an 'essential' or 'important' entity, with all the associated obligations.
But the answer does not stop there. Many more businesses fall outside the sector and size criteria, yet face the requirements anyway: as a supplier, installer or service provider to a business that is subject to obligations. Those obligated organisations must assess their own supply chain, which translates into questionnaires and contractual requirements for businesses that themselves never need to register with a competent authority.
Sector: Annexes I and II
The Directive lists sectors in two annexes. Annex I identifies sectors considered essential: including energy, transport, banking, drinking water, digital infrastructure and public administration. Annex II identifies sectors considered important, such as postal and courier services, waste management, chemicals, food and certain digital services. An installation company, an IT service provider or a consultancy may not appear by name in those annexes, but the descriptions are broader than the names suggest. Those uncertain whether their activity falls within one of these sectors are well advised to read the description in the official text itself, not only the sector name.
Size: when your business counts
Alongside the sector, the Directive looks at the size of the organisation, using the standard EU classification of small, medium and large enterprises based on staff numbers and turnover or total assets. For most sectors, the rule is: the larger the enterprise, the sooner it falls within scope. There are also exceptions where size matters less, for example when an organisation is the sole provider of a particular service in a country. Those exceptions are precisely defined in the Directive and in the national law based on it; an exact assessment of your own situation is for you, your legal adviser or the competent authority to make.
The largest group falls outside, yet faces the requirements anyway
The part of the Directive that attracts most attention concerns the duty of care: obligated organisations must take appropriate measures and, in doing so, also assess their suppliers. This is precisely where the largest group of businesses gets involved. An installation company maintaining building management systems for an energy company, a cleaning company working for a hospital, or an IT partner of a municipality: none of them needs to register themselves, but all of them may receive a questionnaire. In practice this is often called 'supply-chain-affected': you do not fall under the Directive yourself, but a customer who does may still ask you to demonstrate that your security is in order.
Whether this applies to your business depends on who your customers are and how critical your service is to them. That is difficult to estimate without an overview of sector, size and supply-chain role together. In a few questions you will see where your business stands approximately, with an explanation why and a suggestion for the next step.
Financial institutions: a separate regime
Banks, insurers and other financial institutions do not fall under NIS2 but under a separate regulation on digital operational resilience, aimed specifically at the financial sector. Those active in that sector typically recognise this already at the first intake question about sector.
What to do if the answer is not clear
Sector and size together provide a good initial indication, but the precise boundary between 'essential', 'important', 'supply-chain-affected' and 'not affected' calls for a tailored approach. The knowledge base with all topics by situation provides an explanation for each term and refers to the location in the official text. If you still have doubts after reading that, a lawyer or the regulator in your country is the appropriate party to assess your specific situation; secria.eu deliberately does not comment on this.
Do you first want to know where the information on this platform comes from and how it is kept up to date? Read here how we maintain sources. You will find answers to practical questions about using the platform in the overview of frequently asked questions.
The short answer to 'does my company fall under NIS2' is obtained by placing sector, size and supply chain role side by side. Do the free check and read the knowledge base; they will give you, without an account, an initial, substantiated picture of where your company stands.