Where your organisation fits
NIS2 uses sector, service, size, and specific designation criteria. Medium and large organisations in covered sectors are generally in scope, with important exceptions for critical providers regardless of size.
ESSENTIAL
High-criticality sectors
- Energy, transport, banking, and financial market infrastructure
- Health, drinking water, wastewater, and digital infrastructure
- ICT service management, public administration, and space
Supervision: Proactive and reactive oversight.
IMPORTANT
Other critical sectors
- Postal and courier services, waste, chemicals, and food
- Manufacturing of critical products and machinery
- Digital providers and research organisations
Supervision: Primarily reactive oversight.
Size is not the only test
DNS services, trust providers, public electronic communications, and entities designated as critical can be covered regardless of size.
Classification decision points
- 01 Identify covered services Map legal entities to the sectors and subsectors in Annexes I and II.
- 02 Apply the size threshold Review headcount, annual turnover, and balance-sheet criteria.
- 03 Test exceptions Consider criticality, monopoly position, cross-border impact, and specific designation.
- 04 Confirm national transposition Validate the rules and registration duties in each relevant member state.