Are we in scope for NIS2? How to decide
NIS2 (Directive (EU) 2022/2555) is transposed into national law across the EU, with dates varying by member state (Denmark 1 July 2025, Sweden 15 January 2026; the Netherlands expected around mid-2026). Many companies are unsure whether they are covered. Here is a practical walkthrough.
Who is directly in scope?
Two conditions normally apply together: you operate in a listed sector, and you meet the size threshold.
- Sectors: energy, transport, banking, financial infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management (B2B), public administration, space, plus post, waste, chemicals, food, manufacturing, digital providers and research.
- Size: as a rule, medium and large enterprises, meaning at least 50 employees or at least EUR 10 million turnover.
Essential or important entity?
Essential entities (larger companies in the most critical sectors) are under proactive supervision. Important entities are under reactive supervision. Both must meet the same baseline security measures.
The supply chain pulls in smaller companies too
Even if you are below the threshold, you are reached indirectly: in-scope entities must impose security requirements on their suppliers. In practice that means contract clauses, security questionnaires and evidence requests, regardless of your own size.
What to do now
Map whether you are directly in scope, clarify the classification, and build a baseline evidence pack that holds up for both regulators and customer due diligence. An answer without documentation is not provable in practice.
How PowerQuant helps
- Take the free 2-minute scope check to see whether and how you are covered.
- Quick Scan (fixed price): a signed readiness report you can show customers and auditors.
Frequently asked questions
Does NIS2 only apply to IT companies? No. The sector list is broad and includes manufacturing, food and waste, among others. Companies outside the list are often reached through the supply chain.
Is national law already in force everywhere? No. Dates vary by member state; for example Denmark applied it from 1 July 2025 and Sweden from 15 January 2026, while the Netherlands is expected around mid-2026.
Indicative overview, not legal advice. Verified against Directive (EU) 2022/2555 and national transposition status as of 1 July 2026.