[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nis2\u002F2":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nis2","2","Article 2","Scope",0,"NIS2 Directive","**What it asks for.** The Directive applies to public and private entities of a type listed in Annex I or Annex II that qualify as medium-sized enterprises or exceed the ceilings for medium-sized enterprises, and that provide services or carry out activities in the Union. Certain entities are in scope regardless of size.\n\n**In practice.** Entities in scope regardless of size include providers of public electronic communications networks or services, trust service providers, top-level domain name registries and DNS service providers, sole providers of a service essential to societal or economic activities in a Member State, entities whose disruption could have significant impact, central government public administration entities, and entities identified as critical under the CER Directive. Organisations should map each legal entity against the Annex sectors, apply the size test using the EU SME definition, and check national transposition, which can extend scope. Keep a documented scoping decision reviewed when the business changes.\n\n**Common gaps.** Organisations often assess scope at group level only, miss smaller subsidiaries caught by the size-independent rules, or ignore national laws that go beyond the Directive.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022L2555#art_2","Read the article on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]