Check if NIS2 applies to your organisation

Where you are set up

NIS2 covers organisations that provide services or work in the EU. Each EU country applies it through its own law, usually to the organisations set up there.

Your sector

NIS2 lists 18 sectors in two annexes. Large organisations in the first list are usually essential entities; the rest are usually important entities.

Your digital service

Some digital services are covered whatever the provider’s size, so the kind of service can settle the answer on its own.

Kind of public body

NIS2 covers central government bodies whatever their size. Each country decides on regional bodies after assessing the risks, and on local bodies if it chooses to.

Staff

NIS2 usually covers medium-sized organisations and larger. Size follows the EU’s rules for company size, which look at staff, turnover and balance sheet.

Turnover and balance sheet

With fewer than 50 staff, you still count as medium-sized if both figures are over €10 million. With 50 to 249 staff, you count as large if turnover is over €50 million and the balance sheet total over €43 million.

Named by an authority

A country can bring an organisation under NIS2 whatever its size, for example as the only provider of an essential service. Critical entities under the EU’s critical entities law are covered too.

NIS2 covers an organisation in a listed sector whatever its size if it:

• provides a public telecom network or service, a trust service, a top-level domain registry, DNS or domain name registration
• is the only provider in its country of a service that society or the economy depends on
• could seriously affect public safety, security or health if its service stopped
• could cause a serious wider risk if its service stopped, especially across borders
• is critical for its sector, nationally or in its region
• is a critical entity under the EU’s critical entities law, or a central government body

• Your management approves the security measures, oversees them and takes training.
• Security measures in at least the ten areas NIS2 lists, from incident handling and backups to supplier checks and multi-factor sign-in.
• Reports on significant incidents to your country’s incident response team or authority.
• Telling your customers, where appropriate, about significant incidents likely to affect your service.
• Your details on your authority’s list, kept up to date.

• In Lithuania

  Lithuania applies NIS2 through its Cyber Security Law, supervised by the NKSC, the national cybersecurity centre. Your duties start once the NKSC registers you in its cybersecurity information system.

• Lithuania covers more than NIS2

  Its law also covers hosting providers, domain registrars and organisations that manage state information resources, whatever their size.

• Lithuania’s revenue test

  In Lithuania, a sector from the second list counts only if it brings in more than half of your yearly revenue.

• A Lithuanian reporting difference

  In Lithuania, the final report is due within a month of the early warning, not of the 72-hour notification.

• In the Netherlands

  The Netherlands applies NIS2 through the Cyberbeveiligingswet, in force since 15 August 2026. Register on mijn.ncsc.nl, and report changes within two weeks.

• The Netherlands covers more than NIS2

  Dutch law makes provinces, municipalities and water boards essential entities. It can also bring in higher education institutions by naming them.