Does NIS2 apply to SMEs?

Generally not at micro or small size. NIS2 applies to entities of a type in Annex I or II that reach the medium-enterprise floor. That means 50+ staff, or annual turnover over €10M and balance-sheet total over €10M. But certain categories are captured regardless of size: public electronic communications providers, trust service providers, TLD name registries, DNS providers, domain name registration services, sole providers of essential services, central-government public administration, and critical entities under Directive (EU) 2022/2557.

What are the NIS2 reporting deadlines?

Early warning within 24 hours of becoming aware of a significant incident, incident notification within 72 hours, and a final report one month after the incident notification (Art. 23(4)). Trust service providers notify within 24 hours under the Art. 23(4) derogation.

What is the difference between essential and important entities?

Essential entities (high-criticality Annex I types that exceed the medium-enterprise ceilings, plus certain size-independent categories) face fines up to at least €10,000,000 or 2% of total worldwide annual turnover, whichever is higher. Important entities (medium-sized Annex I entities and medium-or-larger Annex II entities) face fines up to at least €7,000,000 or 1.4% of total worldwide annual turnover, whichever is higher.

Isn't NIS2 about to change for small companies?

An SME simplification amendment is under discussion in Brussels, but it is stuck in trialogue with political agreement not expected before early 2027. The scope test this checker uses (Annex I and II sectors, size thresholds) is the law in force today, and the obligations you carry now are judged against it.

NIS2 · Directive (EU) 2022/2555 · free scope check

Does NIS2 apply to my company?

NIS2 (Directive (EU) 2022/2555) is the EU's cybersecurity law for “essential” and “important” entities in the Annex I and Annex II sector lists. This quiz is an EU-level test only: national transposition can extend it. Answer three short questions and you get a status, the reasons, and what you would owe. Read the Directive and the Commission transposition news for the member-state picture.

Check your scope

What an in-scope company owes

Four duties every essential or important entity carries once NIS2 applies.

Article 21

Risk-management measures

Appropriate and proportionate technical, operational and organisational measures: risk analysis and information-system security policy, incident handling, business continuity, supply-chain security, vulnerability handling, cyber hygiene and training, cryptography, access control, and multi-factor authentication (the Article 21(2) list).

Article 23(4)

Incident reporting

Early warning within 24 hours of becoming aware of a significant incident; incident notification within 72 hours; final report one month after the incident notification. Trust service providers notify within 24 hours.

Article 3(4)

Registration

Submit to the competent authorities: name; address and up-to-date contact details (email, IP ranges, phone); relevant sector/subsector per Annex; where applicable, list of Member States where you provide in-scope services.

Article 20

Management accountability

Management bodies approve the risk-management measures, oversee their implementation, can be held liable for infringements of Article 21, and are required to follow cybersecurity training.

NIS2 Starter Pack: €49

Turn your verdict into the six documents the Directive expects: the ten-measure Article 21 checklist, the 24h/72h/one-month incident runbook, the registration sheet, a management accountability one-pager with board-resolution template, and a dated evidence record. Generated in your browser from your own answers. Nothing uploads. Your organisation name is on every document.

Get the Starter Pack: €49 Already bought? Build your pack · free sample

Run an EU AI Act chat-widget check on your shop