In brief
An organisation is generally in scope of NIS2 if it is a type of entity listed in Annex I or II and is at least a medium-sized enterprise under the EU definition. Some entities are in scope regardless of size. In-scope entities are either essential or important, which determines supervision and maximum fines.
How do I check whether my company is in scope of NIS2?
Under Article 2(1), an organisation is generally in scope if: (1) it is a type of entity listed in Annex I or Annex II, (2) it qualifies at least as a medium-sized enterprise under Recommendation 2003/361/EC, and (3) it provides services or carries out activities in the EU.
Some entities are in scope regardless of size, for example providers of public electronic communications, trust service providers, TLD name registries and DNS service providers, and critical entities.
In-scope entities are then classified as essential or important. This classification affects the type of supervision and the maximum fines.
Important: the obligations apply if the organisation meets the criteria – regardless of whether it has registered with the competent authority.
What we see in practice: many organisations meet the criteria but do not recognise it in time, or start implementing measures and collecting evidence too late.
The three basic criteria in Article 2(1)
An entity is generally in scope if it meets all three criteria at the same time.
Type of entity in Annex I or II
The organisation is one of the types of entities listed in Annex I (sectors of high criticality) or Annex II (other critical sectors).
At least a medium-sized enterprise
Under the EU definition (Recommendation 2003/361/EC), as a rule: 50 or more employees, or an annual turnover and an annual balance sheet total both above EUR 10 million. Data of partner and linked enterprises are taken into account.
Services or activities in the EU
The organisation provides its services or carries out its activities within the European Union.
How NIS2 defines who is in scope
For most organisations, two things need to be checked:
- whether they are a type of entity listed in Annex I or II,
- whether they reach the size-cap threshold in Article 2(1).
Article 2(2) to (4) also sets out special cases in which size is not decisive.
Note for Slovenia: Member States may apply the criteria more narrowly. In Slovenia, an entity in Annex I or II sectors is in scope by size only if it has at least 50 employees and at the same time at least EUR 10 million annual turnover or balance sheet total (source: URSIV). The cases regardless of size still apply.
Sectors: Annex I and Annex II
NIS2 classifies entities by type and sector. The key question is whether your activity or service falls into one of the categories in Annex I or II – regardless of which activity is registered as your main one.
Annex I – sectors of high criticality
- Energy – electricity, district heating and cooling, oil, gas, hydrogen
- Transport – air, rail, water, road
- Banking – credit institutions
- Financial market infrastructure
- Health – healthcare providers, reference laboratories, pharmaceuticals, medical devices, research and development
- Drinking water
- Waste water
- Digital infrastructure – IXPs, DNS, TLD registries, cloud computing providers, data centres, CDNs, trust service providers, public electronic communications networks
- ICT service management (B2B)
- Public administration
- Space
Annex II – other critical sectors
- Postal and courier services
- Waste management
- Manufacture, production and distribution of chemicals
- Production, processing and distribution of food
- Manufacturing – medical devices, computers and electronics, electrical equipment, machinery, motor vehicles, other transport equipment
- Digital providers – online marketplaces, online search engines, social networking platforms
- Research organisations
In scope regardless of size
Article 2(2) to (4) lists the cases in which entities of a type in Annex I or II are in scope regardless of the number of employees, turnover or balance sheet total.
Typical examples
- providers of public electronic communications networks or publicly available electronic communications services,
- trust service providers,
- TLD name registries and DNS service providers,
- providers of domain name registration services,
- the sole provider in a Member State of a service essential for critical societal or economic activities,
- critical entities under Directive (EU) 2022/2557.
Public administration and identified entities
- public administration entities of central government,
- regional public administration entities, following a risk-based assessment,
- entities whose disruption could significantly affect public safety, security or health, or cause systemic risk,
- entities that are critical because of their specific importance at national or regional level.
Member States may also include local public administration and education institutions (Article 2(5)).
Essential and important entities (Article 3)
Once you have established that your organisation is in scope, the next step is to determine whether you are an essential or an important entity. The type of supervision and the maximum fines depend on this.
| Criterion | Essential entities | Important entities |
|---|---|---|
| Size | Types of entities in Annex I that exceed the ceilings for medium-sized enterprises – as a rule, 250 or more employees, or an annual turnover above EUR 50 million and a balance sheet total above EUR 43 million | Entities in Annex I or II that do not qualify as essential entities |
| Special cases | Qualified trust service providers, TLD name registries and DNS service providers regardless of size; medium-sized providers of public electronic communications; central government; critical entities; entities identified by a Member State | Many entities in Annex II and medium-sized entities in Annex I |
| Supervision | Proactive supervision, including inspections and security audits (Article 32) | Supervision after the fact, when there are indications of non-compliance (Article 33) |
| Maximum fines | At least EUR 10 million or 2% of total worldwide annual turnover (Article 34) | At least EUR 7 million or 1.4% of total worldwide annual turnover (Article 34) |
| In practice | Higher expectations regarding governance, demonstrability and supervision | The same basic obligations, but a lighter supervisory regime |
Deadlines in Slovenia
If your organisation operates in Slovenia, the following deadlines apply; the competent authority is URSIV.
| Date | What applies |
|---|---|
| National NIS2 rules in force; reporting of significant incidents applies from that day. | |
| Deadline for the first registration with URSIV for entities that already met the criteria. | |
| Deadline for adopting measures for former operators of essential services, state administration bodies and electronic communications operators. | |
| Deadline for adopting risk management measures for all other essential and important entities. |
Source: URSIV, guidance on NIS2 implementation in Slovenia, version 1.4. An organisation that meets the criteria later must register within 30 days.
Then comes ongoing compliance – The obligations do not end with registration or a one-off project. Ongoing risk management, implementation of measures, reporting and demonstrable implementation are required.
What must an in-scope entity actually do?
NIS2 requires cybersecurity risk management measures to be established, implemented and demonstrated.
Organisational and governance part
- registration with the competent authority (Article 3(4)),
- approval and oversight of measures by the management body (Article 20),
- policies and procedures,
- risk management,
- incident handling and crisis management,
- supply chain security,
- cyber hygiene and staff training,
- training of the management body.
Reporting significant incidents (Article 23)
- early warning: without undue delay, within 24 hours of becoming aware,
- incident notification: without undue delay, within 72 hours,
- intermediate report: at the request of the CSIRT or competent authority,
- final report: no later than one month after the incident notification,
- if the incident is still ongoing when the final report is due, a progress report.
Important: documentation alone is not enough. What counts is the ability to demonstrate implemented measures, accountability, management decisions and actual readiness.
Management accountability: under Article 20, the management body must approve the risk management measures, oversee their implementation and can be held liable for infringements. Compliance is therefore not only an IT or legal topic, but a management topic.
A quick five-step check
This procedure is a good first filter. For a formal assessment of your status we recommend a short scope assessment with an expert.
Check the type of entity
Is your organisation one of the types of entities in Annex I or Annex II? Take all relevant activities into account, not just the primary registered activity.
Check the size
Are you at least a medium-sized enterprise under the EU definition, including partner and linked enterprises? If so, you probably meet the size criterion of Article 2(1).
Check the cases regardless of size
If you are smaller, check whether you fall under Article 2(2) to (4).
Determine the category
If you are in scope, check whether you are an essential or an important entity, as this affects supervision and maximum fines.
Take action
Do not delay registration, gap analysis, documentation, implementation of measures and collection of evidence.
Not sure? – Contact Regulus Ai for a scope assessment: type of entity, sector, scope and proposed next steps.
How Regulus Ai helps you achieve compliance
From establishing scope to readiness for supervision – in clear phases and with evidence that withstands supervision. More on the service: NIS2 compliance.
1. Scope assessment
We review the type of entity, sector, IT/OT scope, critical services and relevant deadlines, and assess whether your organisation is an essential or important entity.
2. Gap analysis and prioritised plan
We review the gaps between the NIS2 requirements and the actual state of your organisation and define a prioritised action plan.
3. Documentation, registers and evidence
We help establish policies, procedures, asset, risk and supplier registers and the BIA, and a structure of evidence that is also useful during supervision.
4. Preparation for supervision
We set up evidence management, an audit trail, a record of decisions, the status of measures and reports for management, internal audit and communication with supervisory authorities.
Start with a scope assessment.
Book an initial consultationFrequently asked questions about NIS2 scope
How do I check whether my organisation is in scope of NIS2?
Check whether the organisation is a type of entity listed in Annex I or II of NIS2, whether it qualifies at least as a medium-sized enterprise under Recommendation 2003/361/EC and whether it provides services or carries out activities in the EU (Article 2(1)). Also check the cases in Article 2(2) to (4), where size is not decisive.
Can an organisation with fewer than 50 employees be in scope?
Yes. Some entities are in scope regardless of size, for example providers of public electronic communications networks or services, trust service providers, TLD name registries and DNS service providers, the sole provider of an essential service in a Member State, critical entities and central government public administration entities.
What is the difference between an essential and an important entity?
The difference lies in the classification under Article 3, the type of supervision and the maximum fines. Essential entities are mainly large entities in Annex I sectors and certain entities regardless of size; important entities are the other in-scope entities. Essential entities are supervised proactively (Article 32), important entities after the fact (Article 33).
What are the deadlines for registration and incident reporting?
Entities must submit their details to the competent authority (Article 3(4)); in Slovenia, the first registration deadline was 19 December 2025. Under Article 23, significant incidents require an early warning within 24 hours, an incident notification within 72 hours and a final report within one month of the notification.
What happens if an organisation does not achieve compliance?
The competent authority carries out supervision and can order corrective measures and impose fines. Beyond formal non-compliance, it matters a great deal in practice whether the organisation can demonstrate implemented measures, accountability and a record of decisions.
Does Regulus Ai also help with registration and preparation for supervision?
Yes. Regulus Ai helps from the initial scope assessment and registration to gap analysis, documentation, registers, evidence management, the audit trail and preparing the organisation for supervision.
How long does preparing for compliance take?
It depends on the size, sector, IT/OT complexity and current state of the organisation. For some organisations it is a project of several months, for others a longer transformation of governance, processes and demonstrability.
Where can I find official information about NIS2?
The official text of the directive is published on EUR-Lex. National competent authorities publish additional guidance on registration and supervision in their Member State.
Sources
- Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 20, 23 and Annexes I and II – EUR-Lex
- Commission Recommendation 2003/361/EC – definition of micro, small and medium-sized enterprises, EUR-Lex
- URSIV – guidance on NIS2 implementation in Slovenia, version 1.4 (January 2026, in Slovenian)
Published: · Last updated: · Prepared by the Regulus Ai team
Don't guess – check your status
Regulus Ai offers a scope assessment: type of entity, sector, indicative classification, scope and proposed next steps.