When is a company affected by NIS2?

When it operates in one of the 18 NIS2 sectors and has at least 50 employees or more than EUR 10 million in annual revenue. Both criteria must apply.

I am not directly affected – do I still need to act?

Often yes, indirectly: affected customers pass security requirements on to their suppliers and service providers by contract. Being able to provide evidence is an advantage.

How quickly can applicability be clarified?

A sound initial assessment is possible in a short time. Our NIS2 Quick Check (1–2 days, EUR 2.5–4.5k) delivers an applicability check, gap analysis and roadmap.

Is NIS2 applicable to you? Sectors, thresholds, obligations

All guidesAndreas Behrens, FutureProfAIUpdated: 02 October 20265 min read

The rule of thumb: sector plus size

Companies are affected if they operate in one of the 18 NIS2 sectors and have at least 50 employees or more than EUR 10 million in annual revenue. Both criteria must apply: a large company outside the sectors is usually not directly affected, and neither is a small company within a sector.

Step 1: Do you belong to a NIS2 sector?

Classic critical areas such as energy, transport, health, water and digital infrastructure.
Further sectors that are often underestimated – such as manufacturing, food production, waste management, chemicals or digital services.
What counts is the actual activity, not the industry label in the commercial register.

Step 2: Do you exceed the size threshold?

From 50 employees or EUR 10 million in annual revenue, NIS2 applies in the affected sectors.
Depending on size and sector, the law distinguishes “important” and “essential” entities – with different fine ranges.
For corporate groups, attributing affiliated companies may matter – this should be checked case by case.

Step 3: The supply-chain effect

Even companies that are not affected themselves feel NIS2: affected companies must manage the security of their supply chain and pass requirements on to service providers and suppliers by contract. Questionnaires, evidence and audit rights in contracts are the result.

What applies if you are affected

Registration with the BSI – the registration deadline already ended in March 2026.
Risk management measures under Art. 21, from policies and backup to emergency planning and supply-chain security.
Reporting obligations for significant incidents: early warning within 24 hours, report after 72 hours, final report after one month.
Management responsibility: management must approve measures, oversee their implementation and undergo training – and is personally liable.

Key point: clarify applicability first – it determines registration, obligations and priorities. Unclear cases should be assessed and documented.

Fixed-price NIS2 Quick Check

Which fines apply?

For essential entities up to EUR 10 million or 2 % of global annual revenue, for important entities up to EUR 7 million or 1.4 %. In addition, management is personally liable.

Note: this text provides a general overview and does not constitute legal advice.

Free risk triage

In 30 minutes we clarify where you stand and what makes sense next.

Book a call

Checking NIS2 applicability: is your company affected?