Does NIS2 apply to your company? Check your status, duties and deadlines
Answer about 20 short questions on your activity, sector, size and customers. See whether you are likely an essential or important entity, what that means, which deadlines apply and where your security gaps are.
Check my status
Not legal advice
This is a preliminary, automated assessment based on your answers. NIS2 is a directive: each Member State transposes it into national law, and that law decides who is covered, how to register and what the deadlines are. Use the result to prepare a conversation with counsel or your national authority.
Questionnaire
How the check works
Scope. NIS2 covers organisations that provide services or carry out activities in the EU, belong to one of the entity types in Annex I or II, and are at least medium-sized. Some types are covered regardless of size: qualified trust service providers, TLD registries, DNS providers, providers of public electronic communications and central government bodies.
Size. We apply the thresholds of Commission Recommendation 2003/361/EC: fewer than 50 people and turnover or balance sheet up to €10 million is small; fewer than 250 people and turnover up to €50 million or balance sheet up to €43 million is medium; above that is large. Turnover and balance sheet are linked with “or”, so a company of 49 people with €60 million turnover and €50 million balance sheet is large.
Category. Large entities in Annex I sectors are essential; medium Annex I entities and medium or large Annex II entities are important. Essential entities are supervised before and after incidents, important ones after the fact. The obligations are the same.
Your measures. Twelve checks follow the ten areas of Art. 21(2), management accountability (Art. 20) and incident reporting (Art. 23). Yes = 2 points, partly = 1, no or don’t know = 0. Groups are weighted; if governance scores zero, the stage cannot be higher than Initial.
Every rule, article and date sits in a published rules file (nis2-rules.v1.json). The calculation runs in your browser; your answers are not sent anywhere until you request the report.
What this tool does not cover
- Sector-specific acts that replace parts of NIS2 for some entities, such as DORA for financial entities.
- The CER Directive on the physical resilience of critical entities, beyond asking whether you have been identified under it.
- National extensions: some Member States cover more entities or set shorter deadlines than the Directive.
- Aggregation of figures for groups, partner and linked enterprises: we flag it but do not calculate it.
Sources
| Source | What we use |
|---|---|
| Directive (EU) 2022/2555 (NIS2), EUR-Lex | Art. 2, 3, 20, 21, 23, 26–28, 32–34; Annex I and II |
| Commission Recommendation 2003/361/EC, EUR-Lex | Size classes: micro, small, medium |
| Directive (EU) 2022/2557 (CER), EUR-Lex | Critical entities |
| Regulation (EU) 2022/2554 (DORA), EUR-Lex | Financial sector lex specialis |
FAQ
Does NIS2 apply to my company?
It is likely to apply if you provide services or carry out activities in the EU, your organisation matches one of the entity types in Annex I or II of the Directive, and you are at least medium-sized (50 or more people, or more than €10 million in both turnover and balance sheet). Some types are covered regardless of size. The checker above walks you through these tests in about five minutes.
What is the difference between essential and important entities?
The obligations are the same: risk-management measures, management accountability and incident reporting. The difference is supervision and fines. Essential entities are supervised proactively (ex ante and ex post) and face maximum fines of at least €10 million or 2% of worldwide turnover; important entities are supervised after the fact (ex post) and face maximum fines of at least €7 million or 1.4%.
What are the NIS2 fines?
The Directive sets minimum maximums: for essential entities at least €10 million or 2% of total worldwide annual turnover, whichever is higher; for important entities at least €7 million or 1.4%. Member States set the exact penalties in national law and may go higher. Management can also be held personally liable.
What must I report and when?
For a significant incident: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours and a final report no later than one month after the notification. Reports go to your national CSIRT or competent authority.
I am a software vendor. Does NIS2 affect me if my customers are regulated?
Even if you are not in scope yourself, your regulated customers must manage supply-chain security under Art. 21(2)(d). Expect security questionnaires, audits and contract clauses. Managed service providers, managed security providers and cloud providers are in scope directly if they are at least medium-sized.
Does my country’s NIS2 law already apply?
The transposition deadline was 17 October 2024, but Member States adopted their laws at different times. The result shows the national authority for the countries we track; we show a transposition status only after a person has checked it against the official source, with the date of that check.
Is this legal advice?
No. It is a preliminary, automated assessment based on your answers and on the rules version shown on the page. National law decides; confirm the result with counsel or your national authority.
Can YuSMP help with a gap assessment?
Yes. We map your current measures to Art. 21, run penetration tests and security audits, prepare SOC 2 and ISO 27001 evidence and build secure development practices. Use the form under your result.
Services and industries
Penetration testing and security audits
Test whether your measures work, with a report you can show to customers and auditors.
SOC 2 and ISO 27001 readiness
Policies, controls and evidence that also cover most of Art. 21.
Cloud and DevOps
Logging, backups, recovery and multi-factor access in your cloud.
GDPR compliance consulting
Personal data incidents and NIS2 incidents often overlap.
EU AI Act compliance
When your product includes AI features.