the finder

what applies to me?

Six questions, answered in your browser. Nothing is sent anywhere. You get a starting list and the question to take to a lawyer.

last checked 2 November 2026not legal advicenothing is sent anywhere
1. what does your company do
2. how many people work there, counting linked companies in your group
3. turnover and balance sheet, same group count
4. do you sell software or IT services to financial companies
5. does anyone at work use AI tools
6. have customers asked for a certificate or audit report

your starting list

    This list is a reading of the EU texts as of 2 November 2026. National law, and being named individually by a member state, can change the answer. Take it to a lawyer before you rely on it.

    are you in scope of NIS2?

    1. Is your activity one of the entity types in annex I or II?
      yes
      noOff the list. A customer's contract or your state can still pull you in.
    2. Are you a trust service, DNS, top-level domain or public communications provider?
      no
      yesIn scope at any size.
    3. Do you have 50 or more staff, counting your group?
      no
      yesIn scope.
    4. Are turnover and balance sheet both above €10 million, counting your group?
      yes
      noBelow the size test, unless your state names you individually.
    5. In scope. Read your national act for your label and dates.

    basis NIS2 Art. 2(1), 2(2), Annex I, Annex II; Recommendation 2003/361 Art. 2(2), 6(2)

    fyi Last checked 2 November 2026. This is not legal advice. It is a plain reading of the texts listed on this page, and national law can add to them. Before you rely on it in front of a regulator, an auditor or your board, have a lawyer confirm it for your company. What this means.

    your next step

    Write down the answer you were least sure of, and ask your lawyer that one first.

    see the work that overlaps