Does NIS2 apply to me? How to know if your company is covered
The question “does NIS2 apply to me?” comes down to two facts: your sector and your size. However, the directive includes exceptions that reach small companies. Its requirements also travel down to many suppliers through contracts. This guide helps you check with the criteria of Directive (EU) 2022/2555, updated to October 2026.
In 30 seconds: NIS2 covers companies in its 18 sectors that are not small. In other words, those with 50 or more employees, or with annual turnover and balance sheet both above €10 million. Some entities fall in scope whatever their size, such as DNS providers. And if you sit below the threshold, your in-scope customers will pass their requirements on to you by contract.
Does NIS2 apply to me? A two-step test
The directive combines two filters that work together. First, your activity must appear in Annex I or Annex II. Then your company must be larger than a small enterprise. If you pass both filters, the answer to “does NIS2 apply to me?” is yes. After that, you only need to know whether you are an essential or an important entity.
Step 1: is your activity listed in the annexes?
Annex I lists the sectors of high criticality, while Annex II lists other critical sectors. Within each sector, moreover, only the types of entity named in the annex count. So read the exact subsector rather than the general label.
| Annex | Sectors included |
|---|---|
| Annex I: high criticality (11 sectors) | Energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, business-to-business ICT service management, public administration and space. |
| Annex II: other critical sectors (7 sectors) | Postal services, waste management, chemicals, food, manufacturing (medical devices, electronics, electrical equipment, machinery and vehicles), digital providers and research. |
If your activity is not in the table, the answer to “does NIS2 apply to me?” is usually no, except through contracts. Incidentally, Spain’s 2025 draft bill added private security and the nuclear industry. That text never became law, though, so the EU list is what counts today.
Step 2: are you above the small-enterprise size?
The general rule refers to Recommendation 2003/361/EC on SMEs. You fall in scope if you have 50 or more employees. You also fall in scope if your annual turnover and balance sheet both exceed €10 million. In addition, the calculation includes the figures of partner and linked enterprises in your group. As a result, a small subsidiary of a large group may fall within scope, although each country can weigh its degree of independence.
When does NIS2 apply to me even as an SME?
Article 2(2) lists entities that fall in scope whatever their size. So, if you appear on this list, the answer to “does NIS2 apply to me?” does not depend on your headcount:
- Providers of public electronic communications networks or services.
- Trust service providers, such as electronic signature services.
- Top-level domain name registries and DNS service providers.
- Central government bodies and critical entities under Directive (EU) 2022/2557.
- The sole provider in a country of an essential service.
- Any entity whose disruption would significantly affect public safety, security or health.
In the last two cases, the national authority has to identify you expressly. But Spain still has no official list of entities, because the law is missing.
The supply-chain effect
In fact, this is the most common case among SMEs. Many suppliers first ask “does NIS2 apply to me?” when a customer sends them a security questionnaire. That happens because Article 21 obliges entities to manage the security of their supply chain. So they will ask you for questionnaires, notification clauses and audit rights. To answer them in an orderly way, use our practical NIS2 checklist for SMEs.
Does NIS2 apply to me as an essential or an important entity?
The category changes supervision and fines, but not the list of measures. Essential entities, however, face supervision at any time, whereas important entities face it only after the fact.
| Aspect | Essential entity | Important entity |
|---|---|---|
| Who | Annex I entities with 250 or more employees, or above €50m turnover and €43m balance sheet; also the cases in Article 3(1). | All other Annex I and II entities within scope. |
| Supervision | Ex ante: inspections and audits at any time. | Ex post, when there are signs of non-compliance. |
| Maximum fine | At least €10m or 2% of worldwide turnover. | No less than €7m or 1.4% of worldwide turnover. |
In both cases the higher figure applies. Moreover, these are minimums: Spanish law may raise them but never lower them.
What do I need to do if NIS2 does apply to me?
When the answer to “does NIS2 apply to me?” is yes, the obligations fall into four blocks:
| Obligation | What it requires |
|---|---|
| Risk management (Article 21) | Ten minimum measures, from incident handling and backups to supply-chain security and multi-factor authentication. |
| Reporting (Article 23) | Early warning within 24 hours, notification within 72 hours and a final report within one month. |
| Governance (Article 20) | Management approves the measures, oversees their implementation and takes training. |
| Registration (Article 3) | Submit your details, sector and countries, and report any change within two weeks. |
You do not need to start from scratch, because our 90-day implementation plan sets these measures out by phase. And if the board’s role worries you, review what liability management takes on.
And in Spain? The law has still not arrived
The transposition deadline passed on 17 October 2024 and Spain has still not brought the directive into national law. The draft Cybersecurity Coordination and Governance Act of January 2025 never reached the Official State Gazette (BOE). For that reason, the European Commission referred Spain to the CJEU on 8 July 2026. Then Royal Decree 806/2026 dissolved Parliament on 6 October and called elections for 29 November. As a result, the draft bill is on hold and the law will not pass in 2026.
Meanwhile, Royal Decree-Law 12/2018, which transposed the first NIS directive, remains in force. But this gives you no breathing space, because it does not change the answer to “does NIS2 apply to me?” either. Your European customers also apply the directive already. We cover it in what the dissolution of Parliament means for transposition.
A one-afternoon check: does NIS2 apply to me?
- Look up your activity in Annexes I and II, by type of entity.
- Calculate headcount, turnover and balance sheet with your group’s figures.
- Review Article 2(2) in case you fall in scope whatever your size.
- Check your customers’ contracts and questionnaires.
- Record the conclusion and date it, since it changes as you grow.
If, in the end, the answer to “does NIS2 apply to me?” is yes, run a gap analysis against Article 21. And if it is no, keep the evidence, because customers and auditors will ask for it.
Frequently asked questions
Does NIS2 apply to me if I run an SME?
As a general rule, no, if you have fewer than 50 employees and do not exceed €10 million in both turnover and balance sheet. However, you fall in scope if Article 2(2) lists your activity, for example as a DNS provider. Your in-scope customers may also require their measures from you by contract.
Does NIS2 apply to me if I am only a supplier to an in-scope company?
Not directly, unless your activity and size bring you in. Even so, your customer must manage its supply chain and will ask you for measures and evidence. So meeting part of Article 21 ends up as a condition for keeping that customer.
Does NIS2 apply to me if I operate in several countries?
Yes, if you meet the criteria. As a general rule, each Member State where you have an establishment supervises you. By contrast, cloud, data centre, DNS and digital platform providers answer to the country of their main establishment.
What happens if I do not comply?
The directive requires maximum fines of at least €10 million or 2% of worldwide turnover for essential entities. For important entities, the floor is €7 million or 1.4%. In addition, management can answer for non-compliance. Although these penalties will reach Spain with the national law, your customers already demand measures by contract.
Should I wait for the Spanish law before starting?
That is not a good idea, because the technical content already sits in the directive and Spanish law cannot water it down. Besides, putting the measures in place with evidence takes months.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps
Atalaya GRC helps you answer “does NIS2 apply to me?” service by service and record the conclusion. Then it loads the ten Article 21 measures with their evidence and applies the “one control, many regulations” principle. That way, what you already hold for ISO 27001 or ENS counts here too. Moreover, the regulatory clock tracks the 24- and 72-hour deadlines, while the third-party register keeps supplier questionnaires in order. You will find more on our NIS2 page.
