Who NIS2 applies to — Articles 2 to 4 and 26 to 28

NIS2 is Directive (EU) 2022/2555. The Directive "is addressed to the Member States" (Article 46). Thus its obligations apply to an entity through the national law that transposes the Directive. Read the national law of each Member State where the entity is in the scope of NIS2.

Use the tests below in this sequence:

• Article 2 tells you if the Directive applies to an entity.
• Article 3 tells you if the entity is an essential entity or an important entity. Article 3(3) and (4) and Articles 27 and 28 give information and data obligations for some entities.
• Article 4 tells you if a sector-specific Union legal act, for example DORA, causes "the relevant provisions of this Directive" not to apply to the entity.
• Article 26 tells you which Member State has the jurisdiction for the entity.

The Article 2 scope test

Article 2(1) of the NIS2 Directive gives the general scope test:

This Directive applies to public or private entities of a type referred to in Annex I or II which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises provided for in paragraph 1 of that Article, and which provide their services or carry out their activities within the Union.

Article 2(1) has three conditions, and all of them must apply:

• The entity is "of a type referred to in Annex I or II". Annexes I and II give sectors, subsectors and types of entity. The test is the type of entity, not only the sector.
• The entity is a medium-sized enterprise, or it is one of the entities that "exceed the ceilings for medium-sized enterprises". These two tests use Article 2 of the Annex to Recommendation 2003/361/EC.
• The entity is one of the entities "which provide their services or carry out their activities within the Union".

Recital 7 uses the name "size-cap rule" for the condition on the ceilings. Small enterprises and microenterprises are not in the scope of Article 2(1). The Directive applies to them only through Article 2(2) to (4), which apply "Regardless of their size". A Member State can also apply the Directive to some of them through Article 2(5).

Annexes I and II. Annex I gives 11 "sectors of high criticality": "Energy", "Transport", "Banking", "Financial market infrastructures", "Health", "Drinking water", "Waste water", "Digital infrastructure", "ICT service management (business-to-business)", "Public administration", and "Space". Annex II gives 7 "other critical sectors": "Postal and courier services", "Waste management", "Manufacture, production and distribution of chemicals", "Production, processing and distribution of food", "Manufacturing", "Digital providers", and "Research".

For each sector, the Annex gives the types of entity. For some sectors, the Annex also gives subsectors.

For example, Annex I, point 8 ("Digital infrastructure") gives these types of entity:

• "Internet Exchange Point providers"
• "DNS service providers, excluding operators of root name servers"
• "TLD name registries"
• "Cloud computing service providers"
• "Data centre service providers"
• "Content delivery network providers"
• "Trust service providers"
• "Providers of public electronic communications networks"
• "Providers of publicly available electronic communications services".

Entities providing domain name registration services are not in Annex I or Annex II. Article 2(4) gives their scope.

The ceilings of Recommendation 2003/361/EC. Article 2(1) of the Annex to the Recommendation gives the ceilings for SMEs:

The category of micro, small and medium-sized enterprises (SMEs) is made up of enterprises which employ fewer than 250 persons and which have an annual turnover not exceeding EUR 50 million, and/or an annual balance sheet total not exceeding EUR 43 million.

These rules of the Recommendation and of the Directive also apply to the condition on the ceilings:

• Public bodies — The Directive does not apply Article 3(4) of the Annex to the Recommendation (Article 2(1), second subparagraph). In Article 3(4) of that Annex, an enterprise is not an SME if "25 % or more of the capital or voting rights are directly or indirectly controlled, jointly or individually, by one or more public bodies". Article 3(2), second subparagraph, of that Annex gives some conditions in which this rule does not apply. Thus, for NIS2, an enterprise with this control by public bodies can be an SME.
• Two accounting periods — In Article 4(2) of that Annex, when the data of an enterprise are more than or less than the ceilings, this "will not result in the loss or acquisition of the status of medium-sized, small or microenterprise unless those ceilings are exceeded over two consecutive accounting periods".
• Partner enterprises and linked enterprises — In Article 6(2) of that Annex, the data of a partner enterprise are added in proportion: "Aggregation is proportional to the percentage interest in the capital or voting rights (whichever is greater)". The data of a linked enterprise are added at 100 %, "where the data were not already included through consolidation in the accounts". In recital 16 of the Directive, Member States "are able to take into account the degree of independence an entity enjoys in relation to its partner or linked enterprises" when they apply Article 6(2) of that Annex.

The condition "within the Union". The condition "within the Union" is a condition of Article 2(1). It gives no rule for entities that are not established in the Union. Article 26(3) gives that rule, but only for the types of entity in Article 26(1)(b). For Article 26(3), see the Article 26 section.

Article 2(2): Annex I or II types, "Regardless of their size". Article 2(2) starts as follows: "Regardless of their size, this Directive also applies to entities of a type referred to in Annex I or II, where:". One of these conditions is sufficient:

• Article 2(2)(a) — "services are provided by" providers of public electronic communications networks or providers of publicly available electronic communications services. Point (a) also includes trust service providers, and TLD name registries and DNS service providers.
• Article 2(2)(b) — "the entity is the sole provider in a Member State of a service which is essential for the maintenance of critical societal or economic activities".
• Article 2(2)(c) — "disruption of the service provided by the entity could have a significant impact on public safety, public security or public health".
• Article 2(2)(d) — "disruption of the service provided by the entity could induce a significant systemic risk, in particular for sectors where such disruption could have a cross-border impact".
• Article 2(2)(e) — "the entity is critical because of its specific importance at national or regional level for the particular sector or type of service, or for other interdependent sectors in the Member State".
• Article 2(2)(f) — the entity is a public administration entity "of central government as defined by a Member State in accordance with national law". Point (f) also includes a public administration entity "at regional level as defined by a Member State in accordance with national law that, following a risk-based assessment, provides services the disruption of which could have a significant impact on critical societal or economic activities".

A Member State identifies the entities of points (b) to (e) as essential entities or as important entities (Article 3(1)(e) and 3(2)). Article 3(5)(b) gives an obligation to the competent authorities: "By 17 April 2025 and every two years thereafter", they notify the Commission of information about the number of the entities of points (b) to (e). The information includes the sector, the subsector, and the type of service of these entities. It also names the provision of Article 2(2), points (b) to (e), that the Member State used for them.

Article 2(3) and (4): no Annex type, "Regardless of their size". These two provisions apply without an Annex I or II type:

• Article 2(3) — "Regardless of their size, this Directive applies to entities identified as critical entities under Directive (EU) 2022/2557."
• Article 2(4) — "Regardless of their size, this Directive applies to entities providing domain name registration services." In Article 6(22), such an entity is "a registrar or an agent acting on behalf of registrars, such as a privacy or proxy registration service provider or reseller".

Article 2(5): an alternative for Member States. In Article 2(5), "Member States may provide for this Directive to apply to: (a) public administration entities at local level; (b) education institutions, in particular where they carry out critical research activities."

Article 2(7) to (10): where the Directive does not apply.

• Article 2(7) — "This Directive does not apply to public administration entities that carry out their activities in the areas of national security, public security, defence or law enforcement, including the prevention, investigation, detection and prosecution of criminal offences." Recital 8 gives guidance on this rule. The rule "should apply to entities whose activities are predominantly carried out" in these areas. Entities "whose activities are only marginally related to those areas should not be excluded". Entities "with regulatory competences are not considered to be carrying out activities in the area of law enforcement".
• Article 2(8) — Member States "may exempt specific entities which carry out activities in the areas of national security, public security, defence or law enforcement, including the prevention, investigation, detection and prosecution of criminal offences". They can also exempt entities "which provide services exclusively to the public administration entities referred to in paragraph 7". They can exempt these entities from "the obligations laid down in Article 21 or 23 with regard to those activities or services". Then "the supervisory and enforcement measures referred to in Chapter VII shall not apply in relation to those specific activities or services". "Where the entities carry out activities or provide services exclusively of the type referred to in this paragraph", Member States "may decide also to exempt those entities from the obligations laid down in Articles 3 and 27".
• Article 2(9) — "Paragraphs 7 and 8 shall not apply where an entity acts as a trust service provider." Thus, when an entity "acts as a trust service provider", the rules of Article 2(7) and (8) do not apply to it.
• Article 2(10) — "This Directive does not apply to entities which Member States have exempted from the scope of Regulation (EU) 2022/2554 in accordance with Article 2(4) of that Regulation." In DORA Article 2(4), "Member States may exclude from the scope of this Regulation entities referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU that are located within their respective territories".

The Commission proposal COM(2026) 13 of 20 January 2026 contains changes to Article 2(2), point (a), and a new Article 2(3a). As of October 2026, these changes to Article 2 are not law. See also the proposals to amend NIS2.

Article 3 — Essential and important entities

Article 3(1) and (2) of the NIS2 Directive give two groups of entities: essential entities and important entities. The Article 3(3) list also includes a different group, entities providing domain name registration services (see below). In Article 3(1), these entities are essential entities:

• Article 3(1)(a) — "entities of a type referred to in Annex I which exceed the ceilings for medium-sized enterprises provided for in Article 2(1) of the Annex to Recommendation 2003/361/EC".
• Article 3(1)(b) — "qualified trust service providers and top-level domain name registries as well as DNS service providers, regardless of their size".
• Article 3(1)(c) — "providers of public electronic communications networks or of publicly available electronic communications services which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC".
• Article 3(1)(d) — "public administration entities referred to in Article 2(2), point (f)(i)", thus the public administration entities "of central government".
• Article 3(1)(e) — "any other entities of a type referred to in Annex I or II that are identified by a Member State as essential entities pursuant to Article 2(2), points (b) to (e)".
• Article 3(1)(f) — "entities identified as critical entities under Directive (EU) 2022/2557, referred to in Article 2(3) of this Directive".
• Article 3(1)(g) — "if the Member State so provides, entities which that Member State identified before 16 January 2023 as operators of essential services in accordance with Directive (EU) 2016/1148 or national law".

Article 3(2) gives the important entities:

For the purposes of this Directive, entities of a type referred to in Annex I or II which do not qualify as essential entities pursuant to paragraph 1 of this Article shall be considered to be important entities. This includes entities identified by Member States as important entities pursuant to Article 2(2), points (b) to (e).

For example, a medium-sized enterprise of an Annex I type is an important entity, unless a point of Article 3(1) applies to it. A large enterprise of an Annex II type is also an important entity, unless a point of Article 3(1) applies to it.

Entities providing domain name registration services. The Article 3(3) list includes "essential and important entities as well as entities providing domain name registration services". Thus these entities are a different group. These services are not a type in Annex I or II. Thus Article 3(2) does not apply to an entity for these services. Their obligations are in Article 3(4), Article 27 and Article 28.

Articles 20, 21 and 23 give obligations to essential and important entities. An entity providing domain name registration services can also be of an Annex I or II type, for example the type "Cloud computing service providers". Then Article 3(1) and (2) apply to the entity for that type. A point of Article 3(1) with no Annex type, for example point (f), can also apply.

Differences between essential and important entities. Articles 21 and 23 give the same obligations to essential entities and to important entities. The two groups are different in supervision (Article 32 or Article 33) and in the minimum levels of the maximum fines (Article 34(4) and (5)). Some enforcement measures apply only to essential entities (Article 32(4)(g) and 32(5)). For these differences, see NIS2 supervision and enforcement.

The entity list and the registry — Articles 3(3), 3(4) and 27

The NIS2 Directive gives two sets of information that entities send to the competent authorities. One set is for the Article 3(3) list of the Member State. The other set is for the Article 27 registry of ENISA. The time limits for changes are different.

The Article 3(3) list. Article 3(3) tells the Member States: "By 17 April 2025, Member States shall establish a list of essential and important entities as well as entities providing domain name registration services." They "shall review and, where appropriate, update that list on a regular basis and at least every two years thereafter".

The Article 3(4) information. In Article 3(4), "Member States shall require the entities referred to in that paragraph to submit at least the following information to the competent authorities":

• (a) "the name of the entity"
• (b) "the address and up-to-date contact details, including email addresses, IP ranges and telephone numbers"
• (c) "where applicable, the relevant sector and subsector referred to in Annex I or II"
• (d) "where applicable, a list of the Member States where they provide services falling within the scope of this Directive".

The entities notify changes to this information "without delay, and, in any event, within two weeks of the date of the change". Member States "may establish national mechanisms for entities to register themselves". The Commission, with ENISA, gives guidelines and templates for these obligations (Article 3(4), third subparagraph).

The Commission Guidelines on Article 3(4) (2023/C 324/02) are not binding. Annex I to these Guidelines gives a template for the Article 3(4) information. The template also contains the Article 27(2) information. Where applicable, entities send the Article 27(2) and (3) information through "the national mechanism referred to in Article 3(4)" (Article 27(5) and paragraph 6 of the Guidelines).

The Article 27 registry. In Article 27(1), ENISA "shall create and maintain a registry" of these types of entity:

• DNS service providers, TLD name registries, and entities providing domain name registration services
• cloud computing service providers, data center service providers, and content delivery network providers
• managed service providers and managed security service providers
• providers of online marketplaces, of online search engines and of social networking services platforms.

ENISA makes the registry from the information that it gets from the single points of contact. In Article 27(2), "Member States shall require entities referred to in paragraph 1 to submit the following information to the competent authorities by 17 January 2025":

• (a) "the name of the entity"
• (b) "the relevant sector, subsector and type of entity referred to in Annex I or II, where applicable"
• (c) "the address of the entity's main establishment and its other legal establishments in the Union or, if not established in the Union, of its representative designated pursuant to Article 26(3)"
• (d) "up-to-date contact details, including email addresses and telephone numbers of the entity and, where applicable, its representative designated pursuant to Article 26(3)"
• (e) "the Member States where the entity provides services"
• (f) "the entity's IP ranges".

These entities notify changes "without delay and in any event within three months of the date of the change" (Article 27(3)). The single point of contact sends the information to ENISA "without undue delay", but not the IP ranges of point (f) (Article 27(4)). Where applicable, the entities send the information through "the national mechanism referred to in Article 3(4)" (Article 27(5)).

The two time limits. For a change to the Article 3(4) information, the time limit is two weeks. For a change to the Article 27(2) information, the time limit is three months. An entity of an Article 26(1)(b) type in the scope of NIS2 is in the list and in the registry. Thus the two time limits apply to it.

In Article 2(8), Member States can exempt some entities from Articles 3 and 27. For Article 2(8), see the Article 2 section.

The Commission proposal COM(2026) 13 of 20 January 2026 changes Article 3(4) and Article 27. It also replaces the time limit of three months in Article 27(3). As of October 2026, the changes to Articles 3(4) and 27 are not law. See COM(2026) 13.

Sector-specific Union legal acts — Article 4

Article 4 of the NIS2 Directive tells you when a sector-specific Union legal act causes "the relevant provisions of this Directive" not to apply to essential or important entities. Article 4(1) is as follows:

Where sector-specific Union legal acts require essential or important entities to adopt cybersecurity risk-management measures or to notify significant incidents and where those requirements are at least equivalent in effect to the obligations laid down in this Directive, the relevant provisions of this Directive, including the provisions on supervision and enforcement laid down in Chapter VII, shall not apply to such entities. Where sector-specific Union legal acts do not cover all entities in a specific sector falling within the scope of this Directive, the relevant provisions of this Directive shall continue to apply to the entities not covered by those sector-specific Union legal acts.

Article 4(2) gives the test for "equivalent in effect". Point (a) or point (b) is sufficient:

The requirements referred to in paragraph 1 of this Article shall be considered to be equivalent in effect to the obligations laid down in this Directive where:

(a) cybersecurity risk-management measures are at least equivalent in effect to those laid down in Article 21(1) and (2); or

(b) the sector-specific Union legal act provides for immediate access, where appropriate automatic and direct, to the incident notifications by the CSIRTs, the competent authorities or the single points of contact under this Directive and where requirements to notify significant incidents are at least equivalent in effect to those laid down in Article 23(1) to (6) of this Directive.

Article 4 is a test in Union law. When its conditions apply, "the relevant provisions of this Directive" do not apply to the entity. Article 4 gives no procedure for an entity to select the sector-specific Union legal act. Article 4 gives no obligation to record the result of the test, but an entity can record it.

The Commission Guidelines on Article 4. In Article 4(3), the Commission gives guidelines on Article 4(1) and (2) "by 17 July 2023". The Commission Guidelines on Article 4(1) and (2) (2023/C 328/02) are not binding. The Guidelines give this guidance:

• Articles 9 and 16 "should apply in their entirety for sectors, despite the existence of sector-specific Union legal acts" (point 36). These two Articles give obligations to the Member States and to EU-CyCLONe, not to entities.
• Articles 3(3) and 27(2) "should not apply to entities for which a sector-specific Union legal act applies with respect to cybersecurity risk-management and reporting requirements". But "This does not preclude Member States from including such entities in the list" (point 37).
• Article 20 "should not apply in the case of sector-specific Union legal acts within the meaning of Article 4 of that Directive applying with respect to cybersecurity risk-management requirements" (point 37).

DORA. DORA is Regulation (EU) 2022/2554. DORA Article 1(2) is as follows:

In relation to financial entities identified as essential or important entities pursuant to national rules transposing Article 3 of Directive (EU) 2022/2555, this Regulation shall be considered a sector-specific Union legal act for the purposes of Article 4 of that Directive.

In DORA, the financial entities are the entities of DORA Article 2(1), points (a) to (t) (DORA Article 2(2)). Recital 28 of NIS2 gives the DORA provisions that "should apply instead of those provided for in this Directive". These are the provisions "relating to information and communication technology (ICT) risk management, management of ICT-related incidents and, in particular, major ICT-related incident reporting, as well as on digital operational resilience testing, information-sharing arrangements and ICT third-party risk". Recital 28 continues: "Member States should therefore not apply the provisions of this Directive on cybersecurity risk-management and reporting obligations, and supervision and enforcement, to financial entities covered by Regulation (EU) 2022/2554."

Article 2(10) is a different rule. NIS2 does not apply to entities that a Member State exempted from DORA "in accordance with Article 2(4) of that Regulation". For Article 2(10), see the Article 2 section. For NIS2 and DORA together, see NIS2 and DORA.

Jurisdiction — Article 26

Article 26 of the NIS2 Directive tells you which Member State has the jurisdiction for an entity in the scope of NIS2. In Article 26(1), entities "shall be considered to fall under the jurisdiction of the Member State in which they are established". Article 26(1) gives a different rule for three types of entity:

• Article 26(1)(a) — "providers of public electronic communications networks or providers of publicly available electronic communications services, which shall be considered to fall under the jurisdiction of the Member State in which they provide their services".
• Article 26(1)(b) — the types of entity that Article 27(1) also gives for the registry. These entities are in the jurisdiction of the Member State "in which they have their main establishment in the Union under paragraph 2". For the types, see the section on the entity list and the registry.
• Article 26(1)(c) — "public administration entities, which shall be considered to fall under the jurisdiction of the Member State which established them".

The main establishment. Article 26(2) gives the main establishment of an entity of an Article 26(1)(b) type in this sequence:

• First, the Member State "where the decisions related to the cybersecurity risk-management measures are predominantly taken".
• If "such a Member State cannot be determined or if such decisions are not taken in the Union", the Member State "where cybersecurity operations are carried out".
• If "such a Member State cannot be determined", the Member State "where the entity concerned has the establishment with the highest number of employees in the Union".

Entities that are not established in the Union. Article 26(3) is as follows:

If an entity as referred to in paragraph 1, point (b), is not established in the Union, but offers services within the Union, it shall designate a representative in the Union. The representative shall be established in one of those Member States where the services are offered. Such an entity shall be considered to fall under the jurisdiction of the Member State where the representative is established. In the absence of a representative in the Union designated under this paragraph, any Member State in which the entity provides services may take legal actions against the entity for the infringement of this Directive.

In Article 26(4), "The designation of a representative by an entity as referred to in paragraph 1, point (b), shall be without prejudice to legal actions, which could be initiated against the entity itself." In Article 6(34), the representative is "a natural or legal person established in the Union explicitly designated to act on behalf of" an entity of these types that is not established in the Union.

Recital 116 gives the test for an entity that "offers services within the Union". The test is "whether the entity is planning to offer services to persons in one or more Member States". In recital 116, this is not sufficient: "The mere accessibility in the Union of the entity's or an intermediary's website or of an email address or other contact details, or the use of a language generally used in the third country where the entity is established". In recital 116, these facts "could make it apparent that the entity is planning to offer services within the Union": "the use of a language or a currency generally used in one or more Member States with the possibility of ordering services in that language, or the mentioning of customers or users who are in the Union".

Article 26(3) applies only to the types of Article 26(1)(b). The Directive gives no rule on a representative for other types of entity.

The Commission proposal COM(2026) 13 of 20 January 2026 adds a point (d) on "air carriers" to Article 26(1) and replaces Article 26(3). As of October 2026, the changes to Article 26 are not law. See COM(2026) 13.

Article 28 — Database of domain name registration data

Article 28 of the NIS2 Directive applies to TLD name registries and to entities providing domain name registration services. In Article 28, Member States "shall require" these entities to do these tasks:

• Article 28(1) — "to collect and maintain accurate and complete domain name registration data in a dedicated database with due diligence in accordance with Union data protection law as regards data which are personal data".
• Article 28(2) — The database has "the necessary information to identify and contact the holders of the domain names and the points of contact administering the domain names under the TLDs". This information includes "(a) the domain name; (b) the date of registration; (c) the registrant's name, contact email address and telephone number; (d) the contact email address and telephone number of the point of contact administering the domain name in the event that they are different from those of the registrant".
• Article 28(3) — "to have policies and procedures, including verification procedures, in place to ensure that the databases referred to in paragraph 1 include accurate and complete information". These policies and procedures are "made publicly available".
• Article 28(4) — "to make publicly available, without undue delay after the registration of a domain name, the domain name registration data which are not personal data".
• Article 28(5) — "to provide access to specific domain name registration data upon lawful and duly substantiated requests by legitimate access seekers, in accordance with Union data protection law". The entities "reply without undue delay and in any event within 72 hours of receipt of any requests for access". Their "policies and procedures with regard to the disclosure of such data" are "made publicly available".
• Article 28(6) — Compliance "shall not result in a duplication of collecting domain name registration data". Thus, Member States "shall require" these entities "to cooperate with each other".

Relevant entities of Implementing Regulation (EU) 2024/2690

The Commission Implementing Regulation (EU) 2024/2690 applies directly to its relevant entities (Article 16). An entity of a type in Article 1 of that Regulation is a relevant entity when it is an essential entity or an important entity (recital 1 of that Regulation). Article 1 gives a list of all the types of relevant entity. For this list, the Annex and the conditions for a significant incident, see the Article 21(5) section of the cybersecurity measures section.

Scope in Modulos

Modulos gives NIS2 as two Frameworks, each with the name NIS2: OFF-15 for the Organization and MFF-15 for each AI System. Modulos recommends that you make these scope decisions for the entity before you add the Frameworks. For the decisions, the steps and the Requirements, see How to use the NIS2 Frameworks in Modulos.

NIS2 compared with DORA and the EU AI Act

Below, we compare the scope rules of NIS2, DORA and the EU AI Act.

Item	NIS2 (Directive (EU) 2022/2555)	DORA (Regulation (EU) 2022/2554)	EU AI Act (Regulation (EU) 2024/1689)
Entities in the scope	Article 2(1): entities of an Annex I or II type that are medium-sized enterprises or that "exceed the ceilings for medium-sized enterprises". These entities "provide their services or carry out their activities within the Union". Article 2(2) to (4): conditions "Regardless of their size"	Article 2(1): the entities of points (a) to (u). Points (a) to (t) are "financial entities" (Article 2(2)). Article 2(3): entities that DORA does not apply to	Article 2(1), points (a) to (g): "providers", "deployers", "importers and distributors", "product manufacturers", "authorised representatives of providers", and "affected persons". Point (a): "providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union", “irrespective of whether those providers are established or located within the Union or in a third country”. Point (b): "deployers of AI systems that have their place of establishment or are located within the Union". Point (c): "providers and deployers of AI systems that have their place of establishment or are located in a third country", "where the output produced by the AI system is used in the Union"
Groups	Article 3(1) and (2): essential entities and important entities. Articles 2(4) and 3(3): entities providing domain name registration services, a different group with obligations in Articles 3(4), 27 and 28	No group of essential or important entities	No group of essential or important entities. “providers” and “deployers” have different obligations (Chapter III, Section 3). The obligations also apply to "prohibited AI practices" (Article 5), "high-risk AI systems" (Article 6), "general-purpose AI models" (Chapter V), and transparency (Article 50)
Other Union legal acts	Article 4: "the relevant provisions of this Directive" do not apply where a sector-specific Union legal act is "at least equivalent in effect". Article 2(10): NIS2 does not apply to entities that a Member State exempted from DORA "in accordance with Article 2(4) of that Regulation"	Article 1(2): DORA "shall be considered a sector-specific Union legal act for the purposes of Article 4" of NIS2, for financial entities identified as essential or important entities	Article 2(2) and (13): rules for "high-risk AI systems" related to "Union harmonisation legislation" of Annex I. Article 2(3) to (12): other limits of the scope

For more information, see Frameworks compared.

Where to go next

NIS2 overview

Dates, transposition, guidance, and the proposals for NIS2

Cybersecurity measures (Articles 20 and 21)

Management bodies, the Article 21 measures, and Implementing Regulation (EU) 2024/2690

Incident reporting (Article 23)

Significant incidents, the Article 23 reports and their time limits, and Articles 29 and 30

Supervision and enforcement (Articles 31 to 37)

Supervision of essential and important entities, enforcement measures, and administrative fines

How to use the NIS2 Frameworks in Modulos

The two Frameworks, the decisions before you add them, the steps, and the Requirements

NIS2 vs DORA

How NIS2 and DORA apply to financial entities

Sources

• Directive (EU) 2022/2555 (NIS2) of 14 December 2022, OJ L 333, 27.12.2022, p. 80 (EUR-Lex): Articles 2, 3, 4, 6(22) and (34), 26, 27, 28, 32(4)(g) and (5), 33(1), 34(4) and (5), and 46. Annexes I and II. Recitals 7, 8, 16, 28, and 116.
• The Recommendation 2003/361/EC of the Commission of 6 May 2003 "concerning the definition of micro, small and medium-sized enterprises", OJ L 124, 20.5.2003, p. 36 (EUR-Lex): Annex, Articles 2(1), 3(2), 3(4), 4(2), and 6(2).
• Article 3(4) Guidelines of the Commission, "Commission Guidelines on the application of Article 3(4) of Directive (EU) 2022/2555" (2023/C 324/02), OJ C 324, 14.9.2023 (European Commission): paragraphs 1, 2, and 6.
• Article 4 Guidelines of the Commission, "Commission Guidelines on the application of Article 4(1) and (2) of Directive (EU) 2022/2555" (2023/C 328/02), OJ C 328, 18.9.2023 (European Commission): points 36 and 37.
• Regulation (EU) 2022/2554 (DORA) (EUR-Lex): Articles 1(2) and 2(1) to (4).
• The Implementing Regulation (EU) 2024/2690 of the Commission of 17 October 2024, OJ L, 2024/2690, 18.10.2024 (EUR-Lex): Articles 1, 2, 3 to 14, and 16. Recital 1.
• Regulation (EU) 2024/1689 (EU AI Act), with the changes up to 27 July 2026 (EUR-Lex): Articles 2, 5, 6, and 50. Chapter III, Section 3, and Chapter V.
• COM(2026) 13, the Commission proposal of 20 January 2026 for changes to Directive (EU) 2022/2555 (EUR-Lex): Article 1, points (1), (2), (10), and (11).

Disclaimer

This page gives general information. It is not legal advice.

NIS2 applies to an entity through the national law that transposes the Directive. The Commission Implementing Regulation (EU) 2024/2690 applies directly to its relevant entities. Only a Member State identifies the entities of Article 2(2), points (b) to (e). For a decision about an entity, read the Directive on EUR-Lex and the national law, and get legal advice.