NIS2 - Directive (EU) 2022/2555
NIS2 Scope Checker
Check whether NIS2 applies to your organisation, your entity class, obligations and fine exposure.
How this is calculated
- Scope: you are in scope if you provide services in the EU, your sector is in Annex I or II, and you are at least medium-sized - approximated as 50 or more employees or turnover above EUR 10 million (Art 2(1) and Recommendation 2003/361/EC). DNS service providers, TLD registries, trust service providers, public electronic communications providers and central-government public administration are in scope regardless of size (Art 2(2)).
- Class: essential if you are in an Annex I sector and large (250 or more employees or turnover above EUR 50 million), a DNS provider, TLD registry or qualified trust service provider of any size, central-government public administration, or a public e-comms provider of medium size or larger (Art 3(1)). Every other in-scope entity is important (Art 3(2)). Cloud, data centre, CDN, MSP and MSSP providers follow the normal size rule.
- Fine: the higher of EUR 10 million or 2% of worldwide turnover for essential entities, and EUR 7 million or 1.4% for important entities (Art 34(4)-(5)). These are the minimum maximums the Directive requires national law to provide.
- The tool does not ask for a balance sheet, so it cannot apply the Recommendation’s alternative balance-sheet ceilings (EUR 10 million for small, EUR 43 million for medium enterprises).
Worked example
The calculator run on its default inputs:
- Sector
- ICT service management (MSP / MSSP)
- Employees (headcount)
- 60 people
- Annual turnover (€ millions)
- €12 million
- Provides services or carries out activities in the EU
- Yes
Likely IN SCOPE - Important entity
€7,000,000
- Entity classification
- Important entity
- Basis
- Listed sector at medium size or larger (Art. 2(1)); not essential, so important (Art. 3(2))
- Maximum administrative fine (the floor the Directive sets for national law)
- €7,000,000 or 1.4% of worldwide turnover → €7,000,000
An MSP with 60 staff and EUR 12 million turnover is medium-sized, and ICT service management is an Annex I sector, so it is in scope. It is not large, and MSPs are not in scope regardless of size, so it is an important entity. 1.4% of EUR 12 million is EUR 168,000, below the EUR 7 million figure, so the maximum fine shown is EUR 7,000,000.
Sources
- NIS2 Directive - Directive (EU) 2022/2555 (EUR-Lex) - scope (Art 2), essential and important entities (Art 3), management duties (Art 20), incident reporting (Art 23), fines (Art 34)
- Commission Recommendation 2003/361/EC (EUR-Lex) - the staff, turnover and balance-sheet ceilings for small and medium-sized enterprises
Sources last checked September 2026.
Limitations
NIS2 is a directive, so each member state’s transposition law sets the details, including registration, designation of extra entities and the actual fine ceilings. Group structures (partner and linked enterprises count toward size) and entities active in several sectors are not modelled. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.