Is your company under NIS2, and is it essential or important?

The Directive lists types of entity by sector; a company is in scope by being one of them, not by being a supplier to one. Pick the row that describes what you provide. A software company that runs its product as a service is usually a cloud computing service provider; one that operates customers' systems is a managed service provider.

Sizes as the Annex to Recommendation 2003/361/EC defines them, counted for the enterprise with its partner and linked enterprises. The Directive's Article 2(1) takes medium-sized enterprises and larger. Crossing a ceiling in one accounting period does not change the status: under Article 4(2) of the same Annex it changes only when the ceilings are exceeded, or fallen below, in two consecutive accounting periods.

Article 2(2) to (4) bring some entities in whatever their size. The first four are decided by what you provide; the next two need an act of your member state, which will have told you; the last is a status under the critical entities Directive.

Article 26 gives every entity one member state. For cloud, data centre, content delivery, managed service, managed security, marketplace, search engine and social networking providers it is the main establishment in the Union, the place where the cybersecurity decisions are predominantly taken; a provider not established in the Union designates a representative in a state where it offers services (Article 26(3)).