NIS2 - Directive (EU) 2022/2555

NIS2 Scope Checker

Check whether NIS2 applies to your organisation, your entity class, obligations and fine exposure.

Sector

Employees (headcount)

Annual turnover (€ millions)

Provides services or carries out activities in the EU

Who NIS2 covers

The NIS2 Directive (EU) 2022/2555 generally applies when all three are true (Art 2):

you provide services or carry out activities in the EU;
your sector is listed in Annex I (high criticality: energy, transport, banking, health, digital infrastructure, ICT service management including MSPs and MSSPs, and others) or Annex II (other critical sectors such as postal, waste, manufacturing and digital providers); and
you are at least medium-sized: 50 or more staff, or turnover above EUR 10 million.

Some are in scope regardless of size, including DNS service providers, TLD registries, trust service providers, public electronic communications providers and central-government public administration.

Essential or important?

Large entities (250 or more staff, or turnover above EUR 50 million) in Annex I sectors are generally essential, as are some providers of any size. Every other in-scope entity is important. Essential entities face proactive supervision; important entities are supervised after the fact. Both carry the same core security and reporting duties.

What NIS2 requires

Cybersecurity risk-management measures, approved and overseen by the management body, whose members must take training and can be held liable (Art 20-21).
Incident reporting for significant incidents (Art 23): an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month.
Supply chain security, including your MSPs and other service providers.

Fines

Entity	Maximum fine, at least (whichever is higher)
Essential	EUR 10 million or 2% of worldwide annual turnover
Important	EUR 7 million or 1.4% of worldwide annual turnover

These are the minimum maximums the Directive requires; each member state sets the actual rules in its national law, so check the law of the countries you operate in. The checker above uses staff and turnover only, not the balance-sheet test. For non-EU firms serving EU clients, see offshore cybersecurity services.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

Scope: you are in scope if you provide services in the EU, your sector is in Annex I or II, and you are at least medium-sized - approximated as 50 or more employees or turnover above EUR 10 million (Art 2(1) and Recommendation 2003/361/EC). DNS service providers, TLD registries, trust service providers, public electronic communications providers and central-government public administration are in scope regardless of size (Art 2(2)).
Class: essential if you are in an Annex I sector and large (250 or more employees or turnover above EUR 50 million), a DNS provider, TLD registry or qualified trust service provider of any size, central-government public administration, or a public e-comms provider of medium size or larger (Art 3(1)). Every other in-scope entity is important (Art 3(2)). Cloud, data centre, CDN, MSP and MSSP providers follow the normal size rule.
Fine: the higher of EUR 10 million or 2% of worldwide turnover for essential entities, and EUR 7 million or 1.4% for important entities (Art 34(4)-(5)). These are the minimum maximums the Directive requires national law to provide.
The tool does not ask for a balance sheet, so it cannot apply the Recommendation’s alternative balance-sheet ceilings (EUR 10 million for small, EUR 43 million for medium enterprises).

Worked example

The calculator run on its default inputs:

Sector: ICT service management (MSP / MSSP)
Employees (headcount): 60 people
Annual turnover (€ millions): €12 million
Provides services or carries out activities in the EU: Yes

Likely IN SCOPE - Important entity

€7,000,000

Entity classification: Important entity
Basis: Listed sector at medium size or larger (Art. 2(1)); not essential, so important (Art. 3(2))
Maximum administrative fine (the floor the Directive sets for national law): €7,000,000 or 1.4% of worldwide turnover → €7,000,000

An MSP with 60 staff and EUR 12 million turnover is medium-sized, and ICT service management is an Annex I sector, so it is in scope. It is not large, and MSPs are not in scope regardless of size, so it is an important entity. 1.4% of EUR 12 million is EUR 168,000, below the EUR 7 million figure, so the maximum fine shown is EUR 7,000,000.

Sources

NIS2 Directive - Directive (EU) 2022/2555 (EUR-Lex) - scope (Art 2), essential and important entities (Art 3), management duties (Art 20), incident reporting (Art 23), fines (Art 34)
Commission Recommendation 2003/361/EC (EUR-Lex) - the staff, turnover and balance-sheet ceilings for small and medium-sized enterprises

Sources last checked September 2026.

Limitations

NIS2 is a directive, so each member state’s transposition law sets the details, including registration, designation of extra entities and the actual fine ceilings. Group structures (partner and linked enterprises count toward size) and entities active in several sectors are not modelled. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.