NIS2 scope check: are you an essential or important entity?

A documented, step-by-step scope decision for NIS2: sector mapping, size-cap and group counting, size-independent rules, essential or important, jurisdiction, and where to register in the Benelux.

This guide is for anyone who has to answer the board’s first NIS2 question: are we in scope, and if so, as what? It turns the Directive’s scope rules into a decision sequence that you can document and defend. You will finish with a written scope decision for each legal entity: in or out, essential or important, which country has jurisdiction, and where to register. If you are out of scope, you will also have a view of what your customers may still ask of you.

Before you start

Collect the last approved annual accounts for each legal entity. You need headcount in annual work units, turnover and balance sheet total. Add the group structure chart with ownership and voting percentages, and a list of the services each entity provides and in which EU Member States. Ask legal or finance to check the figures. The decision depends on them, and a supervisor may ask how you calculated them.

Step 1: List your services and map them to Annex I and II

NIS2 scope starts with the type of entity, not the size. Annex I lists sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space. Annex II lists other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing (including medical devices, electronics, electrical equipment, machinery and vehicles), digital providers such as online marketplaces, search engines and social networks, and research^[1].

• List each service or activity per legal entity, not per brand or business unit.
• Match it to the Annex entity type and record the sector and subsector.
• Note borderline cases, such as an internal IT department compared with managed services sold to third parties. Record why you decided as you did.

Step 2: Check the rules that apply regardless of size

Some entities are covered whatever their size. Article 2(2) covers providers of public electronic communications networks or services, trust service providers, TLD name registries and DNS service providers. It also covers an entity that is the sole provider in a Member State of a service essential to critical activities, an entity whose disruption could significantly affect public safety, security or health or create systemic risk, an entity that is critical at national or regional level, and certain public administration entities. Entities identified as critical under the CER Directive (EU) 2022/2557 and providers of domain name registration services are also covered regardless of size^[1].

• Check each mapped service against these criteria.
• Ask whether the authority has notified you of an identification or a CER designation.
• If a criterion applies, go to Step 5 to classify the entity. The size test no longer decides whether you are in scope.

Step 3: Apply the size-cap rule

Otherwise, NIS2 applies only to entities that qualify as medium-sized or exceed the medium-sized ceilings under Recommendation 2003/361/EC^[1]. In practice, an entity is at least medium-sized if it has 50 or more staff, or if both its annual turnover and its balance sheet total exceed €10 million. It is large if it has 250 or more staff, or if its turnover exceeds €50 million and its balance sheet total exceeds €43 million^[2].

Category	Staff (AWU)	And: turnover	Or: balance sheet
Small (out unless Step 2 applies)	< 50	≤ €10m	≤ €10m
Medium	< 250	≤ €50m	≤ €43m
Large (exceeds medium ceilings)	≥ 250	or: turnover > €50m and balance sheet > €43m

• Use the figures from the latest approved accounts, with headcount in annual work units.
• Show your calculation, not just the result.

Step 4: Add partner and linked enterprises

The Recommendation does not size a legal entity on its own. Add the data of partner enterprises in proportion to the holding (generally 25% to 50%). Add the data of linked enterprises in full (generally above 50%, or where there is dominant influence)^[2]. NIS2 sets aside one provision of the Recommendation, Article 3(4) of its Annex, which deals with control by public bodies^[1]. As a result, a small subsidiary of a large group is usually treated as large. Recital 16 lets Member States weigh how independent an entity is from its group, including in its network and information systems. Check your authority’s published position before relying on that.

• Draw the ownership chain upwards and downwards, including partners of linked enterprises.
• Recalculate the size with the aggregated data.
• Write down any argument about independence and, if it matters, ask the authority.

Step 5: Classify as essential or important

Under Article 3, essential entities include Annex I entities that exceed the medium-sized ceilings (that is, large entities). They also include qualified trust service providers, TLD registries and DNS service providers of any size, medium-sized or larger public electronic communications providers, central government entities, CER critical entities, and entities a Member State designates. Every other in-scope Annex I or II entity is important^[3]. The classification changes how you are supervised. Essential entities face ex ante supervision, while important entities are mainly supervised ex post. It also sets the fine ceilings: at least €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important entities^[1].

• Record the classification for each legal entity and the article point it relies on.
• If entities in one group have different classifications, write that down explicitly.

Step 6: Determine jurisdiction and main establishment

The general rule is that the Member State where an entity is established has jurisdiction. Public electronic communications providers fall under each Member State where they provide services. DNS service providers, TLD registries, domain name registration providers, cloud, data centre and CDN providers, managed (security) service providers, online marketplaces, search engines and social networks fall under the Member State of their main establishment. That is where decisions on cybersecurity risk-management measures are predominantly taken. If that cannot be determined, it is where cybersecurity operations are carried out, and failing that, where the entity has the most employees in the EU. Non-EU providers of these services must designate a representative in the EU^[4].

• For each entity, note the rule that applies and the resulting Member State or States.
• For main-establishment cases, document where cybersecurity decisions are taken, for example in board minutes or a CISO mandate.

Step 7: Register in each relevant country

Registration typically asks for the entity name, address and contact details, IP ranges, sector and subsector, and the Member States where in-scope services are provided. Changes must be notified within two weeks^[3]. The Benelux routes are set out below. Each country also offers a scope tool that you can use to cross-check your own analysis.

• Register every in-scope legal entity in each country that has jurisdiction.
• Keep the confirmation and set a reminder to review the data each quarter.

Step 8: Plan for indirect impact if you are out of scope

An entity that is out of scope is not necessarily unaffected. In-scope entities must address supply chain security, including the security practices of their direct suppliers and service providers^[1]. Expect questionnaires, contract clauses and requests for evidence. Belgium’s CCB, for example, recommends that NIS2 entities ask their suppliers to implement at least CyFun BASIC^[5]. See also third-party risk management in 2026.

• List the customers that are likely to be in scope and what they may ask for.
• Prepare a standard security pack covering policies, a self-assessment and certificates.
• Repeat the scope check each year, or after a merger, acquisition or new service.

The companion template includes a scope decision worksheet for each entity, a size aggregation calculator and a jurisdiction and registration log. In Secrato, the outcome of your scope decision sets which NIS2 obligations and CyFun or ISO controls are activated for each entity.

How this connects to other frameworks

Financial entities under DORA follow DORA for ICT risk management and incident reporting. Your scope analysis should still record that DORA is the reason. CER critical entities are automatically in NIS2 scope. ISO/IEC 27001 does not decide scope, but a well-defined ISMS scope makes it much easier to show which services NIS2 measures cover. Read more on NIS2.

Frequently asked questions

We have 40 staff, €12m turnover and a €9m balance sheet. Are we medium-sized?

On those figures alone, no. With fewer than 50 staff and a balance sheet within €10 million, you stay small. Before you conclude, add the data of any partner or linked enterprises.

Is an internal group IT company a managed service provider?

That depends on the facts. Record what services it provides, to whom and on what contractual basis, and look for guidance from your national authority. If it serves only group companies, the analysis may differ from a company that sells to third parties.

Can we be in scope in more than one country?

Yes. Except for the digital types that follow the main-establishment rule, each establishment falls under the law of the Member State where it is established. Public electronic communications providers fall under each country where they provide services^[4].

What if our classification changes?

Notify the authority of changes to your registration data within two weeks^[3], and update your compliance plan. Moving from important to essential brings ex ante supervision and, in Belgium, mandatory conformity assessment.