Who decides whether our company is in NIS2 scope?
In most countries you assess it yourself first, against the criteria in your national law, and the authority can confirm or correct the result. NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. sets the framework: sector and entity type in Annex I or II, size under the EU definition, and the exceptions that apply regardless of size (Article 2). Member States must draw up a list of essential and important entities (Article 3(4)) and, in practice, usually rely on companies to register themselves; some also notify companies they consider in scope. In Germany, the BSI can register an entity itself if it fails to do so (section 33(3) BSIG). So document your assessment: activities, sector mapping, group figures, the conclusion and who signed it off. If the result is unclear, ask the national authority or a lawyer. A vendor cannot make this decision for you.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
This answer also appears, with more context, here: NIS2 scope and duties
Read next
Related questions
- Do we have to register under NIS2, and with whom?
- Why are our customers suddenly sending NIS2 supplier questionnaires?
- How do we answer “do you have intrusion detection?” on a customer questionnaire?
- What should a company do first to prepare for NIS2?
- How does a small or mid-sized company do a cyber risk assessment for NIS2?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.