Does NIS2 apply to my company?

NIS2 may apply directly to your organisation, or it may affect the security requirements your customers put in their contracts. Those situations need different answers. Start with the legal entity and the services it provides.

Check your activities and size

The EU rules generally cover medium-sized and large entities in specified sectors, including parts of digital infrastructure, healthcare and manufacturing. Being a technology company does not, by itself, settle the question. Compare your actual services with the covered entity types. The European Commission’s NIS2 overview describes the sectors and general size rule.

Do not use “fewer than 50 employees” as an automatic exemption. Some entity types and designated entities are covered regardless of size. Ownership relationships can also affect the size assessment. Check the exceptions and the applicable national rules against the Commission’s scope guidance.

Check the rules in your country

NIS2 is an EU directive implemented through national law. Establish which country’s rules and competent authority apply to your entity and services, particularly if you operate across borders.

For Dutch organisations, the NCSC states that the Cyberbeveiligingswet entered into force on 15 August 2026. Its guidance covers scope and obligations, including registration. This information was checked on 21 October 2026; use the NCSC’s current Cyberbeveiligingswet guidance for your assessment and any subsequent changes.

Record your assessment, including the entity, relevant services, size calculation and the basis for the conclusion. If the classification is uncertain, confirm it with the competent authority or a qualified adviser before relying on an exemption.

Respond to customer requirements separately

A customer asking for access controls or incident reporting does not automatically put you directly in scope. Their request may reflect their own supply-chain obligations or commercial requirements. Read what the contract actually asks you to do and identify any obligations your team cannot yet meet.

An ISO 27001 certificate can support the discussion, but it does not replace a NIS2 applicability assessment or prove that every applicable legal duty is fulfilled.

Turn the assessment into assigned work

If you are in scope, establish the applicable registration and reporting requirements as well as the security measures you need to maintain. Assign responsibility for each obligation. If you are outside scope, retain the reasoning and revisit it when your services or ownership change.

Yrso can help track the resulting checks and evidence. A tool cannot decide your legal classification for you.