Search every question across sub-FAQs

Article 2(1) of NIS2 applies the directive to public or private entities of a type listed in Annex I or Annex II when they qualify as medium-sized enterprises under Recommendation 2003/361/EC, or exceed the medium-sized-enterprise ceilings, and provide services or carry out activities in the Union.

Do not test headcount or revenue in isolation. First confirm the Annex I or Annex II entity type. An enterprise is within the Recommendation's SME ceiling only if it has fewer than 250 annual work units and either annual turnover no higher than EUR 50 million or an annual balance-sheet total no higher than EUR 43 million. A financial figure can exceed one ceiling while the enterprise remains within the medium ceiling through the other financial test. Apply the Recommendation's aggregation rules before checking the size-independent routes in Article 2(2), (3), and (4).

Recommendation 2003/361/EC defines the SME category as enterprises with fewer than 250 persons and annual turnover not exceeding EUR 50 million and/or an annual balance-sheet total not exceeding EUR 43 million. Within that category, a small enterprise has fewer than 50 persons and turnover and/or balance-sheet total no higher than EUR 10 million, and a microenterprise has fewer than 10 persons and turnover and/or balance-sheet total no higher than EUR 2 million. The default NIS2 gate is medium-sized or larger, so do not treat every enterprise inside the overall SME ceiling as covered.

Use annual work units rather than a payroll snapshot. Use the latest approved annual accounts, excluding VAT and other indirect taxes from turnover. For partner enterprises, add data in proportion to the capital or voting-rights interest, whichever is greater; for linked enterprises, add 100 percent where the data are not already consolidated.

NIS2 excludes Article 3(4) of the Recommendation's Annex, which is the rule that normally prevents an enterprise from being an SME when public bodies control 25 percent or more of its capital or voting rights. It does not exclude Article 4(2), the rule under which crossing a size ceiling generally changes SME status only after two consecutive accounting periods. Record how national law applies these rules to the NIS2 decision.

The size cap is not the end of the NIS2 scope analysis. Article 2(2) applies NIS2 regardless of size to certain Annex I or Annex II entities, including providers of public electronic communications networks or publicly available electronic communications services, trust service providers, top-level domain name registries, DNS service providers, sole providers of essential services in a Member State, entities whose disruption could significantly affect public safety, public security, or public health, entities whose disruption could induce significant systemic risk, nationally or regionally critical entities, and certain public administration entities.

Article 2(3) also applies NIS2 regardless of size to entities identified as critical entities under Directive (EU) 2022/2557, and Article 2(4) applies it regardless of size to entities providing domain name registration services. Member States may also apply NIS2 to local public administration entities and some education institutions, so the final answer may depend on national transposition.

A size-cap record should let legal, finance, security, and compliance reviewers reproduce the conclusion. Keep the source rule, annual-work-unit calculation, accounts, ownership and aggregation analysis, sector mapping, financial alternative used, exception checks, and national-law route together.

Reopen the decision when headcount, turnover, balance sheet total, group structure, covered service, sector classification, Member State footprint, or critical-entity status changes.