NIS2 size cap and special cases

Article 2(1) applies NIS2 to public or private entities of a type listed in Annex I or Annex II when they qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the medium-sized enterprise ceilings, and provide services or carry out activities within the Union.

For a practical scope file, that means two questions must both be answered before relying on the general size-cap rule: does the entity match an Annex I or Annex II type, and does the entity meet or exceed the relevant SME size test?

Article 2(2) brings certain Annex I or Annex II entities into NIS2 regardless of size. These cases include providers of public electronic communications networks or publicly available electronic communications services, trust service providers, top-level domain name registries, and DNS service providers.

The same paragraph also captures entities where the service has a critical role: the sole provider in a Member State of a service essential for critical societal or economic activities, services whose disruption could significantly affect public safety, public security, or public health, services that could create significant systemic risk, and entities of specific national or regional importance.

The size-cap decision answers whether NIS2 can apply; Article 3 then determines whether the scoped entity is essential or important. Annex I entities that exceed the medium-sized enterprise ceilings are essential entities, while many other in-scope entities are important unless Article 3 places them in the essential category.

Several categories are essential regardless of size or through a specific rule: qualified trust service providers, top-level domain name registries, DNS service providers, central government public administration entities, entities identified as critical under Directive (EU) 2022/2557, and entities a Member State identifies as essential under Article 2(2)(b) to (e).

Recommendation 2003/361/EC defines the SME category as enterprises with fewer than 250 persons and annual turnover not exceeding EUR 50 million and/or annual balance sheet total not exceeding EUR 43 million. Small enterprises are below 50 persons and EUR 10 million turnover and/or balance sheet total; microenterprises are below 10 persons and EUR 2 million turnover and/or balance sheet total.

The calculation can change when an entity has partner or linked enterprises. Recommendation 2003/361/EC requires proportional aggregation for partner enterprises and full aggregation for linked enterprises in the situations described in Article 6 of its Annex. NIS2 also states that Article 3(4) of that Recommendation does not apply for NIS2 purposes.

Article 3 requires Member States to establish a list of essential and important entities and entities providing domain name registration services by 17 April 2025, then review and update it regularly and at least every two years. The Commission Article 3(4) guidelines explain the information that Member States should require for those lists and for related registration mechanisms.

The scope record should therefore include both the entity's own legal analysis and any Member State registration, list, notification, or self-registration evidence. This is especially important for cross-border providers and for entities that may fall under Article 27 registration duties.