Skip to content
Overlap

§ NIS2 check

Does NIS2 apply to me?

Four questions about what you do and how big you are. You get a likely answer and the reasons for it. Nothing you choose leaves your browser.

Pending · not yet lawIreland has not yet passed its NIS2 law. See the Ireland tracker. The Irish rules may add detail, and the authorities decide who is listed.

1 Does your business do any of these?

Tick all that apply. These are short summaries; the Annexes to NIS2 list the exact types.

Covered whatever your size

Sectors of high criticality (Annex I)

Other critical sectors (Annex II)

2 How many people work for you?

Count staff across your whole group if you are part of one. Under the EU SME definition, linked and partner businesses usually count too.

3 Which is true of your last accounts?
4 Do you supply products or services to businesses in those sectors?

For example IT support, software, cloud services, security, or anything they rely on to run.

§ How we work it out

How we work it out

  1. Sector. NIS2 covers the types of business listed in its Annex I and Annex II.
    The official text · Art 2(1)
    This Directive applies to public or private entities of a type referred to in Annex I or II which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises provided for in paragraph 1 of that Article, and which provide their services or carry out their activities within the Union.
  2. Size. Only medium-sized and larger businesses are covered, with some exceptions. Under the EU SME definition you are at least medium-sized if you have 50 or more staff, or both your turnover and balance sheet total are over €10 million. You are large if you have 250 or more staff, or turnover over €50 million and a balance sheet total over €43 million.
    The official text · SME definition, Annex Art 2(2)
    Within the SME category, a small enterprise is defined as an enterprise which employs fewer than 50 persons and whose annual turnover and/or annual balance sheet total does not exceed EUR 10 million.
  3. Size does not matter for some. Public communications networks and services, trust services, DNS services and TLD registries are covered whatever their size (Art 2(2)(a)). So is domain name registration (Art 2(4)). A small business can also be brought in if a Member State identifies it, for example as the sole provider of an essential service (Art 2(2)(b) to (e)).
  4. Essential or important. Large businesses in Annex I sectors are usually “essential entities”. Most others in scope are “important entities”. Qualified trust service providers, TLD registries and DNS service providers are essential whatever their size (Art 3(1)).
  5. Suppliers. NIS2 makes covered businesses look at the security of their direct suppliers (Art 21(2)(d) and 21(3)). If you supply them, expect to be asked about your security even if NIS2 does not cover you directly.

Read the text: Article 2, Article 3 and the Annexes of Directive (EU) 2022/2555; Recommendation 2003/361/EC for the SME definition. Rules read on 18 October 2026.

This is an indicative check, not legal advice. Sector definitions refer to other EU laws, and the Irish law and authorities have the final word.