Skip to content

NIS2 | Scope Determination

Guide for determining whether your organisation falls under NIS2 and in which category.

Decision process

  1. Identify the legal entity and exact service against Annexes I/II and the national service definitions.
  2. Assess size under Recommendation 2003/361/EC, including partner/linked enterprises. Article 3(4) of the Recommendation’s Annex does not apply for NIS2 (Art. 2(1)). The small-enterprise test combines fewer than 50 staff with turnover or balance sheet not exceeding EUR 10 million; it is not “any one financial threshold exceeded”. Apply the medium/large definitions to the actual organisation.
  3. Check Article 2 exceptions and national designation rules. DNS, TLD registries and specified trust/communications providers have special rules. Cloud, data-centre and CDN status alone does not remove the size test. Merely supplying an essential entity does not automatically make the supplier regulated.
  4. Determine essential/important status separately under Article 3. Large Annex I entities are generally essential; a medium-sized Annex I entity is not automatically essential. Specific exceptions apply.
  5. In the Czech Republic, determine the regulated service and higher/lower obligations under Act No. 264/2025 Coll. and its implementing decrees, then document and report the result where required.

For Czech size assessments, apply Section 7 of Act No. 264/2025 Coll.: state organisational units, territorial self-governing units and the Czech National Bank are not enterprises; entities whose technical assets are completely separate from the assets used for the assessed regulated service are not counted as partner or linked enterprises. Size rules apply by analogy to non-enterprise providers in science, research and education. Convert euro thresholds under Section 2(2) of Decree No. 408/2025 Coll..

Annex I — sectors of high criticality

Energy; transport; banking; financial market infrastructures; health; drinking water; waste water; digital infrastructure; ICT service management between businesses; public administration; space.

Annex II — other critical sectors

Postal and courier services; waste management; manufacture, production and distribution of chemicals; production, processing and distribution of food; specified manufacturing activities; digital providers; research.

A sector name is not enough

Annexes I and II identify particular types of entity. For example, distinguish:

  • Financial infrastructure: Annex I lists operators of trading venues and central counterparties. This does not automatically include every business in finance. Article 4 NIS2 addresses the relationship with DORA.
  • Medical devices: Annex I includes manufacturers of devices on the list of critical devices for public-health emergencies. Annex II covers other specified medical-device and in-vitro diagnostic manufacturers.
  • Public administration: Member States define central and regional entities; regional entities also require the assessment in Article 2(2)(f). Extension to local government under Article 2(5) is a national option, not automatic inclusion of every municipality.
  • Space: Annex I covers operators of specified ground-based infrastructure supporting space-based services, excluding providers of public electronic communications networks.
  • Food and waste: Annex II specifies wholesale distribution and industrial food production or processing. It excludes waste businesses for which waste management is not the principal economic activity.
  • Manufacturing: Annex II specifies medical devices and in-vitro diagnostics and NACE divisions 26–30: electronics and optics, electrical equipment, machinery, motor vehicles and other transport equipment.

Assess the service, legal entity, size and exceptions under Articles 2–3. In the Czech Republic determine the regulated service and higher/lower obligations under national law. Annex I membership alone does not mean essential-entity status.

Scope assessment checklist

  • Record the service, legal entity, Member State and exact statutory service definition.
  • Record staff, turnover, balance sheet and partner/linked-enterprise data, with the reference financial period.
  • Document the size calculation and any applicable exception or designation.
  • Determine essential/important status under Article 3; for Czech delivery record the higher/lower regime separately.
  • Record the legal basis, evidence, assessor, approval and review trigger; do not conclude from the sector name alone.
AspectEssentialImportant
SupervisionEx-ante and ex-post powers under Art. 32Ex-post powers under Art. 33 where there is evidence/indication of non-compliance
Risk measures and incident reportingArts. 20–23 within scopeArts. 20–23 within scope; not a different “standard” 72-hour-only timeline
PenaltiesNational ceilings implementing Art. 34(4)National ceilings implementing Art. 34(5)

Czech registration and implementation dates

Czech Act No. 264/2025 Coll. has applied since 1 November 2025. A provider whose service meets the registration conditions in Section 4(1) must notify NÚKIB within 60 days of meeting those conditions (Section 6(1)); the initial deadline for those meeting them at commencement expired on 31 December 2025. NÚKIB decides registration. Registration under Section 5 is initiated only by the authority, not through this notification duty (Section 6(3)). Use the NÚKIB portal.

Contact and supplementary details must be reported within 30 days of delivery of the registration decision (Section 11(1)). For duties under Sections 13(2) and 15(1)–(2), Sections 13(4) and 15(4) set the start of compliance for each regulated service no later than one year after delivery of its registration decision. This is not a new deadline for the initial service notification. A change from the lower to the higher regime starts new periods only for the duties listed in Section 9(2).

Digital services listed in Section 18(1) have a special regime: security measures follow Section 18(1) and the Commission implementing regulation, while Section 13(2) does not apply. Section 18(2) specifies the reportable incidents, excluding trust services from that paragraph; Section 18(3) limits Czech statutory duties where the provider has its main establishment or representative in another EU/EEA state, subject to its stated conditions. Apply these provisions separately when determining duties and deadlines; the general one-year period does not establish a blanket deferral under Section 18.

For previously regulated services and systems, Section 71(1) preserves the specified existing duties during the transition; the new method of incident reporting applies from delivery of the registration decision. Check the applicable regime, transitional rules and actual decision. Act No. 264/2025 Coll., Sections 6, 9, 11, 13, 15, 18 and 71.

For other Member States, check the applicable national law and transposition status; do not apply Czech dates EU-wide.

Scope Determination Record

Next Steps

  1. Scope determined
  2. ISMS requirements
  3. Questions to assess your obligations
  4. Register with national authority (if applicable)

Content reviewed: 6 September 2026. Primary sources: NIS2 — Arts. 2–3; Annexes I–II, NÚKIB — Czech law, NÚKIB — reporting, SME definition.