Glossary · NIS2
Size-Cap Rule
The NIS2 rule that brings organisations into scope based on size: at least 50 employees or over EUR 10 million in annual turnover, in a covered sector.
Explained in depth: Who NIS2 applies to
NIS2 applies, as a general rule, to organisations in Annex I and II sectors that qualify as at least medium-sized enterprises under the EU SME definition: 50 or more employees, or annual turnover or balance sheet total above EUR 10 million. Large enterprises (250+ employees, or turnover above EUR 50 million) in Annex I sectors are generally essential entities; medium-sized ones are generally important entities. There are exceptions in both directions. Certain entities are in scope regardless of size, including qualified trust service providers, TLD registries, DNS service providers, and sole providers of critical services in a member state. Conversely, member states can extend scope nationally. Company group structures matter too: employee counts and turnover may need to include linked and partner enterprises under the SME definition.
Why it matters
The size-cap rule is where most scoping mistakes happen, particularly for groups of companies and for entities hovering near the thresholds. Getting it wrong means either an unregistered in-scope entity (an infringement in itself) or unnecessary compliance spend.