Does NIS2 apply to companies based outside the EU?

It can, if they provide services in the EU. NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. applies to entities that provide their services or carry out their activities within the Union (Article 2), and Article 26 sets which Member State has jurisdiction: as a rule the one where the entity is established, with special rules for providers of public electronic communications, for public administration and for certain digital providers, such as DNS and cloud providers, data centres, managed service and managed security service providers, online marketplaces, search engines and social networks, which fall under the country of their main establishment in the EU. A provider of those digital services that is not established in the EU but offers services there must designate a representative in a Member State. Non-EU companies outside these categories usually meet NIS2 through their EU customers' supplier requirements.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 40 questions on NIS2 scope and dutiesAll topics