We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Scope GuideEU

NIS2 size cap and special cases

Use this guide to decide whether an entity is in NIS2 under the general medium-size rule or a regardless-of-size route, then classify it as essential or important.

Based on Directive (EU) 2022/2555, Commission Recommendation 2003/361/EC, the Commission Article 3(4) guidelines, and the Commission NIS2 overview.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
5 sections10 primary sources
Overview

An entity is generally in NIS2 if it matches a type in Annex I or II, provides services or carries out activities in the EU, and qualifies as a or exceeds the medium-sized enterprise ceilings. Apply staff, financial, reference-period, partner, and linked-enterprise rules rather than using local headcount alone. Smaller entities can still be covered by an Article 2 special case, critical-entity status, domain name registration services, or a Member State decision. Determine scope first, then use Article 3 to classify the entity as essential or important.

Section 1

Start with the NIS2 size-cap rule

Article 2(1) applies NIS2 to public or private entities of a type listed in Annex I or Annex II when they qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the ceilings, and provide services or carry out activities within the Union.

Do not reduce this to a single employee threshold. Apply the Recommendation's staff and financial tests to the correct enterprise data, including partner and linked enterprises. Then check the Article 2 special cases even if the result is small or micro.

  • Record the Annex I or Annex II sector, subsector, and type of entity before applying headcount or financial data.
  • Treat medium-sized and larger entities in covered sectors as the general NIS2 starting point, not as the whole scope analysis.
  • Use the latest approved accounting period and annualised data. A newly established enterprise without approved accounts uses a bona fide estimate made during the financial year.
  • Document whether the entity is autonomous, partner, or linked, because Recommendation 2003/361/EC requires related enterprise data to be considered when calculating size.
Section 2

Apply the regardless-of-size special cases

Article 2(2) covers certain Annex I or Annex II entities regardless of size. Article 2(2)(a) directly covers providers of public electronic communications networks or publicly available electronic communications services, trust service providers, top-level domain name registries, and DNS service providers.

Other Article 2(2) routes depend on the facts or a Member State determination: sole-provider status for an essential service, significant impact on public safety, public security, or public health, significant systemic risk, specific national or regional importance, and specified central or regional public administration entities. Article 2(3) separately covers entities identified as critical under Directive (EU) 2022/2557, and Article 2(4) covers domain name registration service providers regardless of size.

  • Do not stop the review because the entity is small or micro if it provides a service listed in Article 2(2)(a).
  • Check the applicable Member State law and authority decisions for sole-provider, impact, systemic-risk, national or regional importance, and public-administration routes.
  • Separate EU-level regardless-of-size categories from Member State determinations, because evidence and authority contacts may differ.
  • Check optional national extensions: Article 2(5) permits Member States to cover local public administration and education institutions, particularly those carrying out critical research.
  • Distinguish Article 2(7), which excludes specified public administration activities, from Article 2(8), which lets Member States exempt specified entities from some duties. Neither provision applies where an entity acts as a trust service provider.
  • Check the DORA boundary: NIS2 does not apply to entities that a Member State has exempted from Regulation (EU) 2022/2554 under DORA Article 2(4).
Section 3

Classify essential versus important after scope is established

Scope and classification are separate decisions. Under Article 3(1), Annex I entities that exceed the ceilings are essential. Other in-scope Annex I or II entities are important unless another Article 3(1) route makes them essential.

Essential routes include qualified trust service providers, top-level domain name registries, DNS service providers, medium-sized providers of public electronic communications networks or publicly available electronic communications services, specified central-government public administration entities, entities identified as critical under Directive (EU) 2022/2557, and entities a Member State identifies as essential under Article 2(2)(b) to (e). A communications provider that is smaller than medium-sized can therefore be in scope but important, unless another essential route applies.

  • Use one evidence line for scope and a separate evidence line for essential or important classification.
  • Check whether the entity is an Annex I entity exceeding the ceilings before treating it as essential on size grounds.
  • Check whether the entity is a qualified trust service provider, TLD registry, or DNS service provider, because Article 3 treats those categories as essential regardless of size.
  • Save the Member State source when an entity is identified as essential or important by national classification rather than by the general size rule alone.
Section 4

Use the SME definition correctly

Recommendation 2003/361/EC defines an SME as an enterprise with fewer than 250 persons and either annual turnover not exceeding EUR 50 million or an annual balance sheet total not exceeding EUR 43 million. Within that category, a small enterprise has fewer than 50 persons and turnover or balance sheet total not exceeding EUR 10 million; a microenterprise has fewer than 10 persons and turnover or balance sheet total not exceeding EUR 2 million. An SME that is neither small nor micro is medium-sized.

Staff is measured in , so part-year, part-time, and seasonal work counts as fractions. Apprentices and vocational-training students under the specified contracts are excluded, as are periods of maternity or parental leave.

The result can change when the enterprise has partner or linked enterprises. Article 6 requires proportional aggregation for immediate , using the greater of the capital or voting-rights percentage, and 100% aggregation for linked enterprises when the data are not already consolidated. NIS2 disapplies Article 3(4) of the Recommendation, so the Recommendation's rule that normally prevents an enterprise controlled 25% or more by public bodies from being an SME is not used for this NIS2 calculation.

  • Keep the approved accounts, annual-work-unit calculation, turnover excluding VAT and other indirect taxes, balance sheet total, and accounting period in the scope record.
  • A one-period threshold crossing does not change medium, small, or micro status under Article 4(2); acquisition or loss of that status requires the ceilings to be crossed over two consecutive accounting periods.
  • Include partner and linked enterprise analysis where ownership, voting rights, control, or group accounts could change the size result.
  • Escalate borderline group structures to legal or finance reviewers instead of treating a local subsidiary's standalone headcount as conclusive.
Section 5

Maintain registration and list evidence

Article 3 required Member States to establish a list of essential and important entities and domain name registration service providers by 17 April 2025, then review and, where appropriate, update it regularly and at least every two years. The Commission's Article 3(4) guidelines provide a collection template and explain how national self-registration mechanisms can support those lists. Entities must notify changes to Article 3 list information without delay and within two weeks of the change; keep that clock separate from Article 27 registry updates.

Article 27 has a separate registration regime for DNS service providers, TLD name registries, domain name registration service providers, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, and social networking services platforms. The original submission deadline was 17 January 2025; changes must be reported without delay and no later than three months after the change. Use the current national mechanism and requirements rather than treating the Commission template as the filing system.

Does being small or micro always keep an entity out of NIS2?

No. Article 2(2), (3), and (4) can cover smaller entities, including specified communications providers, trust service providers, TLD registries, DNS service providers, critical entities, domain name registration service providers, and entities covered through the sole-provider, impact, systemic-risk, national-importance, or public-administration routes. Member States may also extend scope to local public administration and education institutions under Article 2(5).

What is the core evidence for a NIS2 size-cap decision?

Keep the Annex I or II entity mapping, EU activity analysis, annual-work-unit and financial calculation, partner and linked enterprise analysis, two-period status check, special-case and exclusion review, essential-or-important classification, applicable national registration evidence, source URLs, decision owner, and reassessment trigger.

Does appearing on a Member State list replace the size and scope analysis?

No. Keep the national listing or registration evidence, but also record the legal route that places the entity in scope and the separate Article 3 route that makes it essential or important. National procedures implement the Directive and may request additional information, so verify the current law and authority process in every Member State involved.

  • Store the entity name, address, current contact details, IP ranges, sector, subsector, entity type, and Member States where services are provided when required by the applicable national mechanism.
  • Track changes to submitted information, because Article 27 entities must notify changes without delay and in any event within three months of the change.
  • Keep national authority correspondence separate from the EU legal basis so reviewers can distinguish directive scope from local implementation steps.
  • Review the size and special-case analysis when services, countries, ownership, group accounts, or sector activities materially change.
Recommended next step

This NIS2 guide helps classify entities and evidence special cases

Sorena can help convert size data, Annex mapping, special-case triggers, and Member State registration requirements into a cited NIS2 scope workflow.

Research workflow
Open Research Copilot for NIS2

Ask questions tied to cited sources about the size-cap rule, special scope cases, essential and important classification, and registration evidence.

Explore next step
Talk to Sorena
Talk through implementation

Review your NIS2 scope analysis, special-case evidence, and country registration workflow with Sorena.

Explore next step
Primary sources

References and citations

Commission Guidelines on NIS2 Article 3(4)
eur-lex.europa.eu2 citations
Referenced sections
  • Guidelines and template context for Member State lists and registration information under NIS2 Article 3(4).
  • Commission guidance and template context for Member State lists of essential and important entities and domain name registration service providers.
"By 17 April 2025"
More quoted passages
"establish a list"
Commission Recommendation 2003/361/EC
eur-lex.europa.eu2 citations
Referenced sections
  • Defines micro, small, and medium-sized enterprises, including headcount, turnover, balance sheet, partner, and linked enterprise rules.
  • Defines SME categories, including staff headcount and financial ceilings used by the NIS2 size-cap rule.
"definition of micro, small and medium-sized enterprises"
More quoted passages
"fewer than 250 persons"
European Commission - NIS2 Directive overview
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Commission overview of NIS2 scope, sectors, risk-management duties, reporting requirements, and implementation context.
  • Commission overview describing NIS2 scope expansion and the general size-cap approach for entities in critical sectors.
Directive (EU) 2022/2555 (NIS2)
eur-lex.europa.eu
Referenced sections
  • Primary NIS2 legal text for scope, essential and important entity classification, registration, and sector annexes.
"high common level of cybersecurity across the Union"
Directive (EU) 2022/2555 (NIS2), Article 2
eur-lex.europa.eu
Referenced sections
  • Primary legal source for the NIS2 scope rule covering Annex I and Annex II entities that are medium-sized or larger.
"qualify as medium-sized enterprises"

Related guides

EU NIS2 Directive applicability test for entity scope

Stepwise NIS2 applicability test for Annex I and Annex II sectors, medium and large entities, size-independent cases, essential or important classification, jurisdiction, and evidence.

EU NIS2 Directive deadlines and compliance calendar | Article 23 clocks

NIS2 compliance calendar for EU transposition, Article 3 and 27 registration updates, Article 23 incident reports, technical measures, and the 2027 review.

NIS2 Annex I and Annex II Sector Scoping Guide

Map NIS2 Annex I and Annex II sectors, entity types, size-cap rules, and essential versus important entity classification with official EU sources.

NIS2 Article 21 control baseline and evidence checklist

Build a NIS2 Article 21 control baseline from the Directive's minimum cybersecurity risk-management measures, proportionality test, supplier duties, and evidence expectations.

NIS2 Article 21 control-by-control evidence checklist

Map NIS2 Article 21 risk-management measures to evidence records for governance, incident handling, continuity, supply chain, testing, cyber hygiene, cryptography, access, assets, and authentication.

NIS2 Article 21 Gap Assessment Workflow: controls, evidence, and owners

Assess NIS2 Article 21 cybersecurity risk-management gaps by mapping current controls to Article 21(2), ownership, evidence, supplier risk, and management review.

Show all related guides (34)

NIS2 Article 23 incident notification workflow

Map NIS2 Article 23 reporting duties for significant incidents: 24-hour early warning, 72-hour notification, intermediate reports, final report, recipients, and evidence.

NIS2 Compliance Checklist: scope, controls, reporting

This NIS2 compliance checklist helps confirm scope, entity classification, management-body duties, Article 21 controls, Article 23 reporting, and evidence.

NIS2 Compliance Guide: scope, controls, reporting, and evidence

A practical NIS2 compliance guide for mapping entity scope, Article 21 risk measures, Article 23 incident reporting, management accountability, and evidence records.

NIS2 Country Implementation Matrix: Authorities, Portals, and Local Deltas

Build an operational NIS2 country matrix for applicable national law, competent authorities, registration, incident portals, local implementation deltas, evidence, and review dates.

NIS2 Entity Classifier Workflow: essential vs important entity scoping

Classify whether an EU service is out of scope, an important entity, an essential entity, or needs national-authority review under the NIS2 Directive.

NIS2 entity supervision guide

Compare NIS2 essential and important entities by scope, Article 21 and 23 duties, Article 32 and 33 supervision, evidence, jurisdiction, and penalties.

NIS2 essential vs important entities: Article 3 scope and supervision guide

Classify NIS2 essential and important entities using Article 3, Annex I and II sector scope, size-cap rules, registration evidence, and the Article 32/33 supervision split.

NIS2 FAQ: scope, Article 21 controls, incident reporting, and penalties

NIS2 FAQ on entity scope, essential and important classification, Article 21 measures, Article 23 reporting, national implementation, and evidence.

NIS2 incident clock triage workflow

Triage a possible NIS2 significant incident by recording awareness time, severity, impact, authority route, recipient communications, and Article 23 reporting clocks.

NIS2 Incident Reporting Workflow: 24-hour, 72-hour, and final report steps

Build a NIS2 Article 23 incident reporting workflow with significance triage, CSIRT or authority notification steps, recipient communication, cross-border checks, and evidence records.

NIS2 Management Body Accountability: board duties, training, and evidence

A guide to NIS2 Article 20 management body accountability: approval of Article 21 measures, oversight, national liability rules, training, reporting lines, and evidence.

NIS2 National Transposition Tracker: EU Member State Evidence Register

Track NIS2 national transposition with Commission country pages, Article 41 dates, reasoned-opinion flags, source wording, authority contacts, and legal review triggers.

NIS2 penalties and fines: Article 34 maximum levels and factors

NIS2 Article 34 fine levels, calculation factors, enforcement measures, GDPR overlap, and national-law checks for essential and important entities.

NIS2 Registration and Authority Notification Guide

Map NIS2 Article 3 entity lists, Article 27 registry submissions, competent authorities, national filing routes, required data, and change-notification deadlines.

NIS2 Requirements: scope, Article 21 controls, reporting, and evidence

Map NIS2 requirements for essential and important entities: scope classification, management-body duties, Article 21 cybersecurity measures, Article 23 incident reporting, and evidence records.

NIS2 Supply Chain Security Program: Article 21 Guide

Apply NIS2 Article 21 to direct suppliers and service providers, and distinguish its general duty from Regulation 2024/2690's digital-entity controls.

NIS2 vs CER Directive comparison: cyber obligations and critical-entity resilience

Compare NIS2 and the CER Directive using cited rows for scope, triggers, evidence, incident handling, supervision, and shared critical-entity work.

NIS2 vs DORA: scope, overlap, and evidence for EU cyber compliance

Compare NIS2 and DORA for EU cyber compliance: covered entities, when DORA replaces NIS2 duties for financial entities, incident reporting, evidence, and supervisory handoffs.

NIS2 vs GDPR breach reporting: EU deadlines and overlap

Compare NIS2 significant-incident reporting with GDPR personal-data-breach reporting, including scope, 24-hour and 72-hour clocks, evidence, and overlap.

NIS2 vs ISO/IEC 27001: legal duties, ISMS evidence, and reuse limits

Compare NIS2 legal obligations with ISO/IEC 27001 ISMS requirements: scope, Article 21 controls, incident clocks, SoA evidence, audits, and certification reuse.

NIS2 vs ISO/IEC 27017: legal duties, cloud controls, and reuse limits

Compare NIS2 legal obligations with ISO/IEC 27017 cloud-service controls: entity scope, Article 21 measures, incident clocks, shared responsibility, evidence, and assurance limits.

NIS2 vs NIS1: what changed in EU cybersecurity compliance

Compare NIS2 with the repealed NIS1 Directive: expanded sectors, essential and important entities, management-body duties, Article 21 controls, Article 23 reporting, and supervision.

Are managed service providers in scope of NIS2?

NIS2 scope answer for managed service providers and managed security service providers, including service definition, size-cap checks, entity status, and jurisdiction evidence.

NIS2 24-hour early warning: what to send and when

Under NIS2 Article 23, covered essential and important entities submit an early warning within 24 hours of becoming aware of a significant incident.

NIS2 72-hour incident notification FAQ

NIS2 incident-notification deadline, required initial assessment, evidence, follow-up, and the 24-hour trust-service-provider exception.

NIS2 entity classification FAQ

Plain-English FAQ comparing NIS2 essential entities and important entities, with Article 3 classification rules, shared Article 21 and 23 duties, supervision differences, and evidence to keep.

NIS2 Member State Transposition: What Teams Must Check

How to handle NIS2 Member State transposition: use Article 41 as the EU baseline, then verify national law, authority routing, registration, and incident-reporting details.

NIS2 size-cap rule: when medium and large entities are in scope

Plain-language FAQ on the NIS2 size-cap rule: medium and large Annex I or II entities, SME thresholds, regardless-of-size exceptions, and evidence to keep.