Does NIS2 apply to me? Check it against the directive

Directive (EU) 2022/2555, which sets cybersecurity risk-management measures and incident reporting obligations for essential and important entities in the EU (Art. 1). It has been in force since 16 January 2023, and the Member States had to apply their transposing laws from 18 October 2024 (Arts 41 and 45).

Public or private entities of the types listed in Annexes I and II that exceed the ceilings for small enterprises and provide their services or carry out their activities in the Union (Art. 2(1)). Some are covered regardless of their size (Art. 2(2) to 2(4)). The obligations reach them through the national law transposing the directive.

Check whether your activity matches a type of entity in Annex I or II, whether you exceed the small-enterprise ceilings counting the companies in your group, and whether you fall under a case that does not depend on size or under an exclusion (Arts 2 and 3). Those are the questions of this check, with the article behind each conclusion.

The directive is in force and the Member States had to transpose it by 17 October 2024 (Art. 41). The obligations reach you through the national law of the Member State that governs you, so check whether it has been adopted there and from when it applies. If you are established in Spain, the result tells you what we found about the Spanish transposition.

If you have fewer than 50 staff and your annual turnover or annual balance sheet total does not exceed €10 million, you are in principle outside on size alone; size is calculated with the companies in your group and the last two financial years. Some cases do not depend on size: providers of public electronic communications networks or services, trust service providers, TLD name registries and DNS service providers (Art. 2(2)(a)); entities providing domain name registration services (Art. 2(4)); entities identified by a Member State because of their role (Art. 2(2)(b) to (e)); and critical entities (Art. 2(3)).

The directive classifies the entities within its scope as essential or important (Art. 3). In general, essential entities are those in the sectors of Annex I that exceed the ceilings for medium-sized enterprises, and some others because of their type or identification; the rest are important. The difference lies mainly in supervision and in the maximum fines (Arts 32 to 34).

If your company is not within the scope, the directive does not impose its obligations on you directly. But your covered clients must manage the security of their supply chain (Art. 21(2)(d)) and may ask you for measures, questionnaires or contractual clauses.

For a significant incident, the directive provides for an early warning within 24 hours and an incident notification within 72 hours, both from becoming aware of it, and a final report no later than one month after the 72-hour incident notification; if the incident is still ongoing, a progress report at that time and the final report within one month of handling it (Art. 23(4)). Trust service providers notify within 24 hours instead of 72. National law may specify the procedure.

In general, the law of the Member State where you are established (Art. 26(1)). If you provide public electronic communications networks or services, that of each Member State where you provide them (Art. 26(1)(a)). For DNS, cloud computing, data centre and managed service providers, among others, your main establishment in the Union counts (Art. 26(1)(b) and 26(2)).

• 20 October 2026 · version 2026.10.12-r5. First complete version: 53 types of entity, a question on your company's history without the group, operators from outside the EU and obligations by type of entity. Review: DORA prevails in obligations and plan, the cases in Art. 2(2)(b) to (e) separately, Member State identification in the class, defence and security in all sectors, telecommunications by where you provide the service, and fines for public administration.