NIS2 – are you really out of scope? A practical look at key criteria and common misconceptions

NIS2 captures a wide range of medium and large entities operating in sectors listed in its Annexes I and II, including but not limited to energy, banking, ICT services, digital infrastructure, healthcare, and waste management. In certain cases, entities may also fall within scope irrespective of size where they perform particularly critical functions. As a starting point for an initial self-assessment, entities should consider in particular:

• whether they operate in a covered sector; and 
• whether they meet the EU SME thresholds for a medium or large enterprise.

A self-assessment can be initially conducted using our AG NIS2 self-assessment tool available here.

While this looks straightforward, applying these thresholds correctly is where key misconceptions may arise.

A robust scoping exercise typically focuses on a small number of core dimensions:

• Sector – whether the organisation’s activities fall within Annex I or II of NIS2; 
• Size – employee, turnover, and balance sheet thresholds, including group aggregation; 
• Structure – ownership and control relationships affecting SME qualification; 
• Role – whether the entity provides services that are critical or essential; 
• Documentation – whether the assessment is recorded, reasoned, and defensible. 

Misinterpretations tend to arise where one of these elements is considered in isolation – for example, focusing only on headcount, or applying an overly narrow reading of sectoral activities.

“We are too small to be in scope”

Size is not always assessed on a standalone basis. Under EU rules on group structures, relationships between affiliates may require aggregation of employee numbers and financial data. As a result, a seemingly small local entity can qualify as a medium or large undertaking when assessed at group level.

“Employee numbers only include our direct staff”

The concept of “employees” is broader than traditional employment contracts. It may extend to part-time staff, contractors, and individuals working under mandate or B2B arrangements, depending on how the workforce is structured in practice.

“If we were in scope, the regulator would tell us”

NIS2 reverses this logic. There is no requirement for prior notification by authorities. Organisations are expected to proactively assess their status and be able to justify it. The absence of regulatory engagement does not indicate that an entity is out of scope.

“We already have cybersecurity measures, so we are compliant”

Existing frameworks (e.g. ISO standards or internal policies) may provide a useful starting point, but they are not sufficient in themselves. NIS2 requires organisations to implement and evidence specific measures relating to governance, accountability, incident handling, business continuity, supply chain security, access controls, cybersecurity training, and technical safeguards. Compliance depends not only on having measures in place, but also on documenting, maintaining, and demonstrating them in line with regulatory expectations.

For most organisations, several practical implications follow:

• active determination is required – status under NIS2 must be assessed, not assumed; 
• cross-functional cooperation is necessary – legal, IT, risk, compliance and management input is typically needed; 
• documentation is critical – conclusions must be supported by clear evidence and reasoning; 
• existing frameworks can be leveraged – but usually require some to NIS2 requirements; 
• incident response must be structured – including clear escalation and reporting processes aligned with NIS2 requirements. 

In practice, organisations tend to approach this in phases: first confirming scope, then conducting a gap analysis, followed by prioritised implementation.