Insight · Reviewed 2026-06
Does NIS2 apply to your organization?
A practical walk-through of scope — not a substitute for legal review.
Start with sector
NIS2 lists specific sectors as “essential” or “important” entities — energy, transport, banking, financial-market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space, postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research, among others. If your organization operates in one of these sectors, sector scope is the first filter.
Then check size
Most sectors apply a size threshold — broadly, medium and large entities (roughly 50+ employees or €10M+ turnover, with variations by category). Some categories are captured regardless of size when the entity plays a uniquely critical role.
Confirm the national transposition
NIS2 is a directive, not a directly applicable regulation — each EU Member State transposed it into national law by the October 2024 deadline, and the exact scope, competent authority and enforcement approach can vary by country. Always confirm against your country’s transposing legislation.
Quick self-check
| Question | Why it matters |
|---|---|
| Is your sector listed as essential or important? | Sector is the first scope filter under NIS2. |
| Does your organization meet the size threshold? | Most sectors apply a medium/large-entity threshold. |
| Has your country finished transposing NIS2? | Scope and enforcement details vary by Member State. |
| Do you have supply-chain dependencies in scope? | NIS2 requires addressing supply-chain risk explicitly. |
