We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

FAQEU

NIS2 size-cap rule medium and large entity scope

Use the NIS2 size-cap rule to decide whether an Annex I or Annex II entity is covered because it is medium-sized or larger.

Check the sector first, then employee and financial thresholds, then the regardless-of-size exceptions and Member State classification rules.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 25, 2026
Questions
4

Structured answer sets in this page tree.

Primary sources
3

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 25, 2026
Overview

The default NIS2 size-cap covers an Annex I or Annex II entity that qualifies as a under Recommendation 2003/361/EC or exceeds the medium-enterprise ceilings and provides services or carries out activities in the Union. Apply the employee and financial tests with the Recommendation's partner- and linked-enterprise aggregation rules. Then check Article 2's size-independent routes and national implementation before treating a small or micro entity as outside scope.

Search this module

Find a question or answer quickly

4 of 4 questions
Question 1

What is the NIS2 size-cap rule?

Article 2(1) of NIS2 applies the directive to public or private entities of a type listed in Annex I or Annex II when they qualify as medium-sized enterprises under Recommendation 2003/361/EC, or exceed the medium-sized-enterprise ceilings, and provide services or carry out activities in the Union.

Do not test headcount or revenue in isolation. First confirm the Annex I or Annex II entity type. An enterprise is within the Recommendation's SME ceiling only if it has fewer than 250 and either annual turnover no higher than EUR 50 million or an annual balance-sheet total no higher than EUR 43 million. A financial figure can exceed one ceiling while the enterprise remains within the medium ceiling through the other financial test. Apply the Recommendation's aggregation rules before checking the size-independent routes in Article 2(2), (3), and (4).

  • Start with the sector: confirm the entity is in Annex I or Annex II before you apply any size test.
  • Check and the financial alternative together: fewer than 250 staff and either turnover no higher than EUR 50 million or balance-sheet total no higher than EUR 43 million.
  • Aggregate partner-enterprise data in proportion to the ownership or voting interest and add 100 percent of linked-enterprise data where the Recommendation requires it.
  • Confirm that the entity provides services or carries out activities in the Union.
  • Escalate small or micro entities when a regardless-of-size rule, critical-entity designation, domain-name-registration-service rule, or Member State rule may apply.

Does the NIS2 size-cap rule mean only large companies are covered?

No. The default rule covers an Annex I or Annex II entity that qualifies as medium-sized or exceeds the medium-enterprise ceilings and has the required Union activity. Calculate staff and financial data under the Recommendation, including partner and . Small and micro entities can still be covered through Article 2 size-independent cases, critical-entity status, domain-name-registration-service coverage, or national identification.

Citations
Directive (EU) 2022/2555 (NIS2)

Article 2(1) sets the default NIS2 scope test for Annex I and Annex II entities that are medium-sized or exceed the medium-sized-enterprise ceilings.

Question 2

Which employee, turnover, and balance-sheet thresholds should teams check?

Recommendation 2003/361/EC defines the SME category as enterprises with fewer than 250 persons and annual turnover not exceeding EUR 50 million and/or an annual balance-sheet total not exceeding EUR 43 million. Within that category, a small enterprise has fewer than 50 persons and turnover and/or balance-sheet total no higher than EUR 10 million, and a microenterprise has fewer than 10 persons and turnover and/or balance-sheet total no higher than EUR 2 million. The default NIS2 gate is medium-sized or larger, so do not treat every enterprise inside the overall SME ceiling as covered.

Use rather than a payroll snapshot. Use the latest approved annual accounts, excluding VAT and other indirect taxes from turnover. For , add data in proportion to the capital or voting-rights interest, whichever is greater; for , add 100 percent where the data are not already consolidated.

NIS2 excludes Article 3(4) of the Recommendation's Annex, which is the rule that normally prevents an enterprise from being an SME when public bodies control 25 percent or more of its capital or voting rights. It does not exclude Article 4(2), the rule under which crossing a size ceiling generally changes SME status only after two consecutive accounting periods. Record how national law applies these rules to the NIS2 decision.

  • Calculate and keep the latest approved annual turnover and balance-sheet total.
  • Classify the enterprise as autonomous, partner, or linked and retain the ownership, voting-rights, and consolidation evidence used for aggregation.
  • Record whether the two-consecutive-accounting-period rule affects a recent crossing of a ceiling.
  • Do not exclude an entity from the NIS2 medium-size test solely because public bodies control 25 percent or more; NIS2 expressly disapplies that Recommendation rule.
  • Map the entity to the relevant Annex I or Annex II sector and the covered service it actually provides.
  • Explain why the entity is medium-sized, exceeds the medium-sized-enterprise ceilings, or is escalated as a small or micro special case.
  • Keep the reviewer, approval date, source citation, and reassessment trigger with the decision record.
Citations
Directive (EU) 2022/2555 (NIS2)

NIS2 Article 2 references the Recommendation's medium-enterprise test and expressly excludes only Article 3(4) of its Annex, the public-body-control rule.

Question 3

Which NIS2 entities can be covered regardless of size?

The size cap is not the end of the NIS2 scope analysis. Article 2(2) applies NIS2 regardless of size to certain Annex I or Annex II entities, including providers of public electronic communications networks or publicly available electronic communications services, trust service providers, top-level domain name registries, DNS service providers, sole providers of essential services in a Member State, entities whose disruption could significantly affect public safety, public security, or public health, entities whose disruption could induce significant systemic risk, nationally or regionally critical entities, and certain public administration entities.

Article 2(3) also applies NIS2 regardless of size to entities identified as critical entities under Directive (EU) 2022/2557, and Article 2(4) applies it regardless of size to entities providing domain name registration services. Member States may also apply NIS2 to local public administration entities and some education institutions, so the final answer may depend on national transposition.

  • Check electronic communications, trust-service, TLD registry, DNS, and domain-name-registration-service roles first.
  • Check whether the entity is a sole essential provider, creates a public-safety or public-health impact, creates systemic risk, or has national or regional criticality.
  • Check whether the entity is identified as a critical entity under Directive (EU) 2022/2557.
  • Check local public administration, education, and Member State implementation rules before treating a small or micro entity as out of scope.
Citations
Directive (EU) 2022/2555 (NIS2)

Article 2(2), Article 2(3), and Article 2(4) list regardless-of-size scope rules and Article 2(5) permits some Member State extensions.

Question 4

What evidence should prove a NIS2 size-cap decision?

A size-cap record should let legal, finance, security, and compliance reviewers reproduce the conclusion. Keep the source rule, annual-work-unit calculation, accounts, ownership and aggregation analysis, sector mapping, financial alternative used, exception checks, and national-law route together.

Reopen the decision when headcount, turnover, balance sheet total, group structure, covered service, sector classification, Member State footprint, or critical-entity status changes.

  • Keep the Article 2 rule and the exact sector or exception that made the entity in scope.
  • Attach the Recommendation 2003/361/EC evidence for , turnover, balance-sheet total, and the accounting period used.
  • Include autonomous, partner, linked-enterprise, ownership, and consolidation evidence so reviewers can reproduce every aggregation.
  • Record the Article 3(4) public-body-control disapplication and any Article 4(2) two-period status analysis that affects the result.
  • Record the Annex I or Annex II mapping, covered service description, operating country, and any Member State routing note.
  • Name the decision owner, reviewer, approval date, and the trigger that will force a reassessment.

What is the first practical step for applying the NIS2 size-cap rule?

Identify the legal entity and Annex I or Annex II service first. Then calculate , turnover, and balance-sheet total using the Recommendation's autonomous, partner, and linked-enterprise rules; record the financial alternative and accounting periods used; confirm Union activity; and test every Article 2 size-independent or national identification rule.

Citations
Recommended next step

Record the entity size and scope decision

Sorena can help turn the NIS2 size-cap rule into entity-classification records, threshold evidence requests, special-case checks, and reusable review steps.

Research workflow
Open Research Copilot for EU NIS2 Directive

Ask questions tied to cited sources about NIS2 scope, SME thresholds, essential entities, important entities, and special cases using the cited sources on this page.

Explore next step
Talk to Sorena
Talk through NIS2 scope implementation

Review your size-cap evidence, sector mapping, exception checks, and Member State routing with Sorena.

Explore next step
Primary sources

References and citations

Directive (EU) 2022/2555 (NIS2)
eur-lex.europa.eu
Referenced sections
  • Binding source for NIS2 scope, essential and important entity classification, and regardless-of-size rules.
"entities of a type referred to in Annex I or II"
Related guides

Explore more topics

Are managed service providers in scope of NIS2?
NIS2 scope answer for managed service providers and managed security service providers, including service definition, size-cap checks, entity status, and jurisdiction evidence.
EU NIS2 Directive applicability test for entity scope
Stepwise NIS2 applicability test for Annex I and Annex II sectors, medium and large entities, size-independent cases, essential or important classification, jurisdiction, and evidence.
EU NIS2 Directive deadlines and compliance calendar | Article 23 clocks
NIS2 compliance calendar for EU transposition, Article 3 and 27 registration updates, Article 23 incident reports, technical measures, and the 2027 review.
NIS2 24-hour early warning: what to send and when
Under NIS2 Article 23, covered essential and important entities submit an early warning within 24 hours of becoming aware of a significant incident.
NIS2 72-hour incident notification FAQ
NIS2 incident-notification deadline, required initial assessment, evidence, follow-up, and the 24-hour trust-service-provider exception.
NIS2 Annex I and Annex II Sector Scoping Guide
Map NIS2 Annex I and Annex II sectors, entity types, size-cap rules, and essential versus important entity classification with official EU sources.
NIS2 Article 21 control baseline and evidence checklist
Build a NIS2 Article 21 control baseline from the Directive's minimum cybersecurity risk-management measures, proportionality test, supplier duties, and evidence expectations.
NIS2 Article 21 control-by-control evidence checklist
Map NIS2 Article 21 risk-management measures to evidence records for governance, incident handling, continuity, supply chain, testing, cyber hygiene, cryptography, access, assets, and authentication.
NIS2 Article 21 Gap Assessment Workflow: controls, evidence, and owners
Assess NIS2 Article 21 cybersecurity risk-management gaps by mapping current controls to Article 21(2), ownership, evidence, supplier risk, and management review.
NIS2 Article 23 incident notification workflow
Map NIS2 Article 23 reporting duties for significant incidents: 24-hour early warning, 72-hour notification, intermediate reports, final report, recipients, and evidence.
NIS2 Compliance Checklist: scope, controls, reporting
This NIS2 compliance checklist helps confirm scope, entity classification, management-body duties, Article 21 controls, Article 23 reporting, and evidence.
NIS2 Compliance Guide: scope, controls, reporting, and evidence
A practical NIS2 compliance guide for mapping entity scope, Article 21 risk measures, Article 23 incident reporting, management accountability, and evidence records.
NIS2 Country Implementation Matrix: Authorities, Portals, and Local Deltas
Build an operational NIS2 country matrix for applicable national law, competent authorities, registration, incident portals, local implementation deltas, evidence, and review dates.
NIS2 entity classification FAQ
Plain-English FAQ comparing NIS2 essential entities and important entities, with Article 3 classification rules, shared Article 21 and 23 duties, supervision differences, and evidence to keep.
NIS2 Entity Classifier Workflow: essential vs important entity scoping
Classify whether an EU service is out of scope, an important entity, an essential entity, or needs national-authority review under the NIS2 Directive.
NIS2 entity supervision guide
Compare NIS2 essential and important entities by scope, Article 21 and 23 duties, Article 32 and 33 supervision, evidence, jurisdiction, and penalties.
NIS2 essential vs important entities: Article 3 scope and supervision guide
Classify NIS2 essential and important entities using Article 3, Annex I and II sector scope, size-cap rules, registration evidence, and the Article 32/33 supervision split.
NIS2 FAQ: scope, Article 21 controls, incident reporting, and penalties
NIS2 FAQ on entity scope, essential and important classification, Article 21 measures, Article 23 reporting, national implementation, and evidence.
NIS2 incident clock triage workflow
Triage a possible NIS2 significant incident by recording awareness time, severity, impact, authority route, recipient communications, and Article 23 reporting clocks.
NIS2 Incident Reporting Workflow: 24-hour, 72-hour, and final report steps
Build a NIS2 Article 23 incident reporting workflow with significance triage, CSIRT or authority notification steps, recipient communication, cross-border checks, and evidence records.
NIS2 Management Body Accountability: board duties, training, and evidence
A guide to NIS2 Article 20 management body accountability: approval of Article 21 measures, oversight, national liability rules, training, reporting lines, and evidence.
NIS2 Member State Transposition: What Teams Must Check
How to handle NIS2 Member State transposition: use Article 41 as the EU baseline, then verify national law, authority routing, registration, and incident-reporting details.
NIS2 National Transposition Tracker: EU Member State Evidence Register
Track NIS2 national transposition with Commission country pages, Article 41 dates, reasoned-opinion flags, source wording, authority contacts, and legal review triggers.
NIS2 penalties and fines: Article 34 maximum levels and factors
NIS2 Article 34 fine levels, calculation factors, enforcement measures, GDPR overlap, and national-law checks for essential and important entities.
NIS2 Registration and Authority Notification Guide
Map NIS2 Article 3 entity-list duties, Article 27 registry submissions, competent-authority contacts, and national registration portal evidence without inventing country deadlines.
NIS2 Requirements: scope, Article 21 controls, reporting, and evidence
Map NIS2 requirements for essential and important entities: scope classification, management-body duties, Article 21 cybersecurity measures, Article 23 incident reporting, and evidence records.
NIS2 Size Cap Rule and Special Scope Cases
Apply the NIS2 medium-size test, group-data rules, regardless-of-size cases, exclusions, and essential-versus-important classification.
NIS2 Supply Chain Security Program: Article 21 Guide
Apply NIS2 Article 21 to direct suppliers and service providers, and distinguish its general duty from Regulation 2024/2690's digital-entity controls.
NIS2 vs CER Directive comparison: cyber obligations and critical-entity resilience
Compare NIS2 and the CER Directive using cited rows for scope, triggers, evidence, incident handling, supervision, and shared critical-entity work.
NIS2 vs DORA: scope, overlap, and evidence for EU cyber compliance
Compare NIS2 and DORA for EU cyber compliance: covered entities, when DORA replaces NIS2 duties for financial entities, incident reporting, evidence, and supervisory handoffs.
NIS2 vs GDPR breach reporting: EU deadlines and overlap
Compare NIS2 significant-incident reporting with GDPR personal-data-breach reporting, including scope, 24-hour and 72-hour clocks, evidence, and overlap.
NIS2 vs ISO/IEC 27001: legal duties, ISMS evidence, and reuse limits
Compare NIS2 legal obligations with ISO/IEC 27001 ISMS requirements: scope, Article 21 controls, incident clocks, SoA evidence, audits, and certification reuse.
NIS2 vs ISO/IEC 27017: legal duties, cloud controls, and reuse limits
Compare NIS2 legal obligations with ISO/IEC 27017 cloud-service controls: entity scope, Article 21 measures, incident clocks, shared responsibility, evidence, and assurance limits.
NIS2 vs NIS1: what changed in EU cybersecurity compliance
Compare NIS2 with the repealed NIS1 Directive: expanded sectors, essential and important entities, management-body duties, Article 21 controls, Article 23 reporting, and supervision.