YTYK You think you know

Card 3 of 18 Scope — who is covered ●●○ Working knowledge

The size cap, and who is caught anyway

Scope is sector and size. In general an entity is caught once it is at least medium-sized — 50 staff, or €10 million in turnover and balance-sheet total. Annex I entities above the large threshold are essential; medium ones, and Annex II entities, are important.

Why it is like this

The size rule keeps the regime off the corner shop while catching the organisations whose failure is felt beyond themselves. It also gives national authorities a count they can work with, rather than a judgement call per company.

Not to be confused with

An exemption for small organisations. A list of entities is in scope regardless of size: DNS service providers, TLD name registries, trust service providers, and providers that are the sole provider of a critical service in a Member State, among others.

In practice

A 40-person trust service provider is in scope on identity alone. A 40-person chemicals distributor, in the same country, is not.

Source: Directive (EU) 2022/2555 (NIS2) — Art. 2 and Art. 3. Read on .

Predict Check yourself

A 30-person company operates the only submarine cable landing station in its Member State. In scope?

  1. Yes — size thresholds do not apply when the entity is the sole provider of a service critical to society.
  2. No — it is below the medium-sized threshold, and there is no exception to that.
  3. Only if it voluntarily registers with the national authority.
  4. Only once it reaches 50 staff or €10 million turnover.
Show the answer

Yes — size thresholds do not apply when the entity is the sole provider of a service critical to society.

Article 2(2) catches certain entities regardless of size, including where the entity is the sole provider in a Member State of a service essential to the maintenance of critical societal or economic activities.