EU NIS2 Directive Applicability Test

Start with the legal entity and the service or activity being tested. NIS2 applies to public or private entities of a type listed in Annex I or Annex II that provide services or carry out activities within the Union and meet the applicable size or special-case criteria.

Do not classify only by brand, group name, or product category. The record should identify the contracting or operating entity, the Member States where the service is provided, the sector and subsector, and the network and information systems that support the service.

The sector map is the core of the applicability test. Annex I covers sectors of high criticality such as energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management, public administration, and space. Annex II covers other critical sectors such as postal and courier services, waste management, chemicals, food, manufacturing categories, digital providers, and research organisations.

Use the defined entity types inside each annex, not only the sector heading. For example, the digital-infrastructure section distinguishes DNS service providers, TLD registries, cloud computing service providers, data centre service providers, content delivery network providers, trust service providers, and public electronic communications providers.

For most Annex I and Annex II entity types, Article 2 starts with the size-cap rule: the Directive applies where the entity qualifies as a medium-sized enterprise under the Annex to Commission Recommendation 2003/361/EC, or exceeds the ceilings for medium-sized enterprises, and provides the relevant services or activities in the Union.

That is not the end of the test. Article 2 also applies regardless of size to listed cases, including providers of public electronic communications networks or publicly available electronic communications services, trust service providers, TLD registries and DNS service providers, sole providers of essential services in a Member State, entities whose service disruption could have specified public-safety, systemic, or national or regional importance effects, certain public administration entities, critical entities under Directive (EU) 2022/2557, and entities providing domain name registration services.

After scope is established, Article 3 determines whether the entity is essential or important. Essential entities include large Annex I entities, qualified trust service providers, TLD registries, DNS service providers, medium-sized providers of public electronic communications networks or publicly available electronic communications services, central government public administration entities, Member State-identified essential entities under specific Article 2 triggers, critical entities under the CER Directive, and, where a Member State so provides, entities previously identified as operators of essential services.

Important entities are the in-scope Annex I or Annex II entities that do not qualify as essential. If facts are missing, classify the test as blocked rather than forcing an essential or important label.

The applicability record should identify the authority path before teams start implementation. As a rule, essential and important entities fall under the jurisdiction of the Member State where they are established. The Commission FAQ identifies exceptions for public electronic communications services, public administration entities, and certain cross-border digital and ICT entities, including DNS, TLD, domain name registration, cloud, data centre, content delivery network, managed service, managed security service, online marketplace, online search engine, and social networking platform providers.

Article 3 also requires Member States to establish a list of essential and important entities and entities providing domain name registration services by 17 April 2025 and to update it at least every two years. The evidence record should therefore preserve the facts needed for national registration or authority notification, not only the internal scope conclusion.