Does NIS2 Apply to Your Company? Quick Self-Assessment & Decision Guide

Reviewed 16 October 2026: Rechecked the financial screen, classifications, Romania’s July amendment and current primary guidance. Added the Romanian cross-border reporting trigger and clarified national size-rule differences. This is a screening guide, not a binding legal scope determination.

Part of: NIS2 Directive Explained for Small Companies covers security measures, incident reporting and management responsibilities.

A customer asks whether you are NIS2 compliant. Before buying a compliance package, establish whether your company is directly regulated, has contractual obligations as a supplier, or both.

TL;DR:

• The general size screen is 50 or more annual work units OR (turnover above €10 million AND balance sheet total above €10 million).
• Size alone does not establish coverage. Your actual service or activity, jurisdiction and specific exceptions matter.
• Small and micro-businesses can be covered under size-independent rules. Group ownership can also change the size calculation.
• A customer contract can require security controls without making you a directly regulated NIS2 entity.

The 3-Question Test

Use this as a screening process, then document the legal basis for your conclusion. The NIS2 Directive, Articles 2 and 3 and Annexes I and II, sets the EU framework. National legislation determines the applicable obligations and procedures.

Question 1: What Service or Activity Do You Actually Provide?

Match your activity to the entity types in the annexes, rather than relying on a broad industry label or your principal business code alone. A company can have more than one relevant activity.

Annex I, sectors of high criticality:

1. Energy
2. Transport
3. Banking
4. Financial market infrastructures
5. Health
6. Drinking water
7. Wastewater
8. Digital infrastructure
9. ICT service management, business-to-business
10. Public administration
11. Space

Annex II, other critical sectors:

1. Postal and courier services
2. Waste management
3. Manufacture, production and distribution of chemicals
4. Production, processing and distribution of food
5. Specified manufacturing categories
6. Digital providers: online marketplaces, search engines and social networking platforms
7. Research organisations

These are 18 sector headings, with more precise entity definitions underneath. For example, the road-transport category does not cover every road haulage company, and an ordinary online shop is not an online marketplace just because it sells products online.

No matching activity? Check national additions and specific designations before concluding you are outside direct scope. Then assess customer contracts separately.

Question 2: Is There a Rule That Applies Regardless of Size?

Do this check before excluding a small company. The EU framework includes size-independent coverage for public electronic communications networks/services, trust service providers, DNS providers and TLD registries. It also includes certain public administration and specifically identified critical entities.

Some services have a narrower obligation. For example, domain-name registration services have particular registration-data duties even where the full risk-management regime does not apply. Do not treat every domain reseller as a DNS provider or assume the same obligations apply to every category.

National authorities can identify entities because of their unique importance, public safety or systemic impact. A small supplier serving a hospital is not automatically designated critical; an actual statutory category or identification is required.

A size-independent rule applies? Confirm the national classification and obligations. Otherwise continue to the general size test.

Question 3: Do You Meet the General Size Test?

The European Commission’s SME definition combines a mandatory staff ceiling with a choice of financial ceiling. A small enterprise has fewer than 50 staff and turnover of €10 million or less OR balance sheet total of €10 million or less.

For the general NIS2 size screen, this means:

50 or more annual work units
OR
(turnover > €10 million AND balance sheet total > €10 million)

The two financial figures are joined by AND. A turnover figure above €10 million, on its own, does not establish that the company is medium or large. Exactly €10 million is within the small-enterprise financial ceiling.

Apply this using the proper accounting period, staff calculation, ownership data and rules for a change of status. National implementation and specific exceptions still require checking.

Size Threshold Details

Count Annual Work Units, Not Today’s Headcount

Under the EU SME recommendation, a full-time person working throughout the reference year counts as one annual work unit. Part-time and seasonal work count as fractions. The definition also includes owner-managers and certain regularly working partners.

Apprentices or students under qualifying training contracts are excluded, and maternity or parental leave is not counted. There is no universal rule that all contractors count after six months or that all seasonal workers are excluded. Check the applicable employment and national calculation rules.

Include Relevant Ownership Relationships

An autonomous company uses its own figures. Partner enterprises generally require proportionate aggregation, and linked enterprises generally require full aggregation under the SME rules. A small subsidiary cannot assume that only its own payroll and accounts matter.

Check national NIS2 provisions before applying this mechanically. For example, Germany’s BSIG section 28(4) provides a conditional exception for partner/linked companies that are independent in the relevant IT circumstances. That exception should not be assumed to apply in Romania.

Worked Examples

These examples assume an autonomous enterprise, settled accounting data, an activity covered by the ordinary size-based rule, and no special designation or exception.

Combining €5 million e-commerce turnover and €6 million consulting turnover gives €11 million turnover. It still does not establish coverage without the balance sheet, staff, actual regulated activity and exception checks.

Sector Coverage Details

Hosting, SaaS and Managed Services

Compare your actual service with the statutory definitions of cloud computing, data centres, CDN, DNS, managed services or managed security services. Selling a hosting plan or describing a product as SaaS does not, by itself, settle the legal classification.

Cloud services, data centres and CDNs appear under digital infrastructure. MSPs and MSSPs appear under ICT service management, a separate sector. DNS has size-independent coverage, while most of these other services use the ordinary size screen unless specifically designated.

Essential versus important is a second decision. Under the EU baseline, a covered medium-sized cloud provider is generally important, while a large Annex I provider is generally essential. Qualified trust providers, DNS providers and TLD registries have specific essential classifications regardless of size. National law can add distinctions.

Manufacturing and Food

Manufacturing coverage concerns the specified categories and entity definitions. It does not cover every manufacturer, and medical-device manufacturing is not universally covered at every size. Certain medical-device activities appear in Annex I, while other medical-device categories appear in Annex II.

Food coverage concerns food businesses engaged in wholesale distribution and industrial production and processing. Do not assume that a local restaurant or bakery falls within the annex just because it handles food.

Marketplaces, Agencies and Consultancies

An online marketplace with €12 million turnover and €4 million assets remains within the small financial test if it has fewer than 50 annual work units. A platform’s revenue does not replace the staff and balance-sheet analysis.

A marketing or development agency is not automatically regulated. If it actively manages customer IT systems, however, its services may meet the MSP definition. Assess that activity and size, then separately review contractual security obligations from customers.

Romania: Applicable Law and the July 2026 Change

Romania’s framework is OUG 155/2024, as amended, approved with amendments by Law 124/2025. Articles 5–9 address scope and classification, Article 18 addresses registration, and DNSC is the competent national authority.

For example, Romania explicitly classifies medium-sized MSSPs as essential in Article 5(4). Its rules cannot be replaced by a table labelling every Annex I company essential and every Annex II company important. Article 8 refers to Law 346/2004 for size classification while expressly excluding its Article 4⁵ public-ownership rule. Confirm the applicable accounting, staff and group-data rules for your entity.

Effective 6 July 2026, Law 123/2026 added an advisory committee consulted by DNSC on coordinated vulnerability disclosure. It also inserted Criminal Code Article 365¹, which excludes criminal character for specified acts only when all conditions in OUG 155 Article 36(5)–(6) are satisfied.

Those conditions include good-faith research, restrictions on data access and changes, avoiding disruption and prohibited techniques, DNSC agreement for public disclosure, and reporting within 48 hours of identifying the vulnerability. This is conditional protection for specified acts, not blanket authorisation to test systems. The amendment did not set a new general company-size threshold.

Existing Article 36 obligations also require covered entities to manage vulnerability reports and publish contact/reporting arrangements. Producers and suppliers that are essential or important entities have additional duties concerning vulnerabilities affecting their own ICT products and services. Check the complete article when defining your process.

What If You’re Covered?

1. Record your classification. Keep the relevant service definition, accounting data, ownership analysis, jurisdiction and statutory basis.
2. Check registration and deadlines. In Romania, Article 18 requires notification to DNSC within 30 days of the provisions becoming applicable to the entity. Use current DNSC forms and implementing orders.
3. Brief management. Approve a funded plan, identify responsible people and confirm training requirements. Outsourcing implementation does not transfer management accountability.
4. Establish incident reporting now. The EU baseline is an early warning within 24 hours of awareness of a significant incident, followed by notification within 72 hours and a final report within one month after that notification. Specific service and national rules can differ. Romania’s Article 15(3) separately requires reporting, without unjustified delay and within six hours of awareness, information enabling the national CSIRT to establish cross-border impact.
5. Prioritise controls and evidence. Our NIS2 requirements guide explains the risk-management categories. Backup restoration testing is one practical place to start.

An internal six- or twelve-month implementation estimate does not create a legal grace period. Confirm what is already due, address urgent risks and document remediation against actual obligations.

Book a gap analysis consultation for an assessment of technical controls, documentation and implementation priorities.

What If You’re Not Directly Covered?

Document why you are outside scope, including any exceptions checked. Reassess when services, ownership, size or national rules change.

Covered customers must manage supply chain risks. Their contracts may require incident notification, backup evidence, access controls, security questionnaires or certification. Those obligations deserve review even where they are contractual rather than direct NIS2 duties.

Build a useful security baseline: MFA for important accounts, tested backups, prompt patching, least-privilege access and staff training. The security readiness check and backup health check can identify discussion points, but neither is a legal scope determination.

Decision Tree Flowchart

Identify applicable jurisdiction and actual service/activity
  |
  +-- Size-independent category or critical designation?
  |     Yes -> Check national classification and obligations
  |     No  -> Continue
  |
  +-- Activity covered by Annex I/II or national extension?
  |     No  -> Check special duties, then customer contracts
  |     Yes -> Continue
  |
  +-- 50+ annual work units OR (turnover > €10M AND assets > €10M)?
        No  -> Generally outside ordinary size-based scope
        Yes -> Confirm medium/large status and essential/important tier

At every step: apply accounting, ownership and national rules.
Outside direct scope: customer security contracts may still apply.

What to Monitor Next

The Commission proposed targeted NIS2 amendments on 20 January 2026. A proposal does not itself change your obligations. This screening guide uses the enacted framework reviewed above, rather than treating proposed simplifications as law.

Choose and document a review schedule, and reassess when services, ownership, size or relevant law change. An annual review can be a useful internal convention, but it is not a universal NIS2 statutory interval.

Sources and review scope: This screening guide separates the general EU framework from Romanian rules and a specific German example. Confirm your entity’s result against the competent authority and current national provisions.

• Directive (EU) 2022/2555, especially Articles 2, 3, 21, 23 and Annexes I–II
• European Commission SME definition and user guide
• Romania OUG 155/2024, consolidated through 6 July 2026
• Romania Law 123/2026
• Germany BSIG section 28