What happens if we grow or acquire a company and cross the NIS2 size threshold?
You come into scope from the moment you meet the criteria under your national law, and the clock for registration and the measures starts. Growth in headcount or turnover, or an acquisition that makes you part of a larger group, can change whether you count as medium-sized or large, and in which category you fall. Check the figures at each year-end and before any acquisition closes, using the EU method for counting staff, turnover and balance sheet, including partner and linked enterprises. National laws set when duties begin: in Germany, section 33(1) of the BSIG requires registration no later than three months after an entity first or again counts as particularly important or important. Build the risk-management measures before you cross the line, not after, and include the target's security in acquisition due diligence.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.