Does NIS2 Apply to My Company? Find Out in 5 Minutes

You've asked yourself the same question, probably right after getting a security questionnaire from a client, or after reading yet another alarmist article: "does this NIS2 thing actually affect me?" The short answer is that it depends on three things: your sector, your size, and who your clients are. The long answer takes five minutes to work through, following a path with a few hurdles along the way, and that's exactly what we're doing here.

Here's the picture up front. EU Directive 2022/2555 (NIS2) was transposed into Italian law through Legislative Decree 138/2024, which took effect on October 16, 2024. The competent authority is ACN (the National Cybersecurity Agency). Companies that fall within scope had to register on the ACN platform during the window that opened in early 2025, and 2026 is when the concrete obligations kick in: baseline security measures and incident notification become operational in the first months of the year, while the full regime matures by autumn 2026. If you haven't registered yet and you should have, you're already behind.

Before diving in, a note of honesty. NIS2 isn't a checklist you tick off in an afternoon. Figuring out whether it applies to you is just the first step — and even if you find you're outside the direct scope, you could still get pulled in through the back door, as a supplier. Let's go through it all, in order.

The three filters: sector, size, supply chain

NIS2 doesn't look at revenue in the classic sense, and it doesn't apply to "all digital companies." It works through progressive elimination. You have to pass three filters in sequence. If you stop at the first one, you're outside the direct scope (but read the supply-chain section anyway). If you clear all three, you're in.

1. Sector filter. Does your business belong to one of the sectors listed in Annexes I and II of the decree?
2. Size filter. Do you exceed the size thresholds (employees, or turnover and balance sheet)?
3. Supply-chain filter. Even if you're outside the first two, is a client of yours who is subject to NIS2 asking you for contractual security guarantees?

Let's take them one at a time, because this is where almost everyone gets the self-assessment wrong.

Filter 1: are you in a NIS2 sector?

The decree distinguishes two groups. The sectors in Annex I are considered "highly critical," those in Annex II are "other critical sectors." The practical difference mostly affects whether you're classified as an essential or an important entity (more on that shortly).

Highly critical sectors (Annex I)

• Energy (electricity, gas, oil, district heating, hydrogen)
• Transport (air, rail, water, road)
• Banking and financial market infrastructure
• Health (hospitals, laboratories, manufacturing of medical devices and critical medicines)
• Drinking water and wastewater
• Digital infrastructure (data centres, cloud, DNS, TLD registries, electronic communications networks)
• Management of B2B ICT services (managed service providers and managed security service providers)
• Public administration (per the criteria in the Italian decree)
• Space

Other critical sectors (Annex II)

• Postal and courier services
• Waste management
• Manufacturing, production and distribution of chemicals
• Production, processing and distribution of food
• Manufacturing of medical devices, electronics, machinery, vehicles and other means of transport
• Digital service providers (online marketplaces, search engines, social networking platforms)
• Research

Watch out for manufacturing, because it's the most common trap. Plenty of business owners reason like this: "I make furniture, I'm not critical infrastructure, I'm out." Wrong. If you produce medical devices, electronic components, machinery, motor vehicles or processed food, you're in Annex II. A machine shop in the north-east of Italy supplying components for industrial equipment falls squarely under "manufacturing of machinery," full stop.

If, after reading these lists, your sector doesn't show up anywhere — say you run a communications agency, a retail shop, or a general consulting practice — filter 1 excludes you from the direct scope. Feel free to skip ahead to filter 3, because the supply chain could still pull you in.

Filter 2: do you clear the size thresholds?

Being in a covered sector isn't enough on its own. NIS2 uses the medium and large enterprise criterion, borrowed from the EU recommendation on SMEs. In practice, you need to be above the small-enterprise threshold. Generally, you're in scope if:

• You have at least 50 employees, or
• Your annual turnover and balance sheet total both exceed €10 million.

If you have fewer than 50 employees and stay under €10 million on both turnover and balance sheet, NIS2 generally doesn't apply to you directly. There's an important exception: some categories are in scope regardless of size. That covers entities such as providers of electronic communications networks, DNS service providers, TLD registries, trust service providers, public administration bodies (per the criteria in the decree), and entities identified as critical to national security. If you're a telecoms provider or a DNS service, being small won't save you.

Essential or important? The distinction that changes the fines

If you clear filters 1 and 2, the decree classifies you as either an essential or an important entity. In broad strokes: large companies in the highly critical Annex I sectors tend to be essential, while medium-sized companies and Annex II entities tend to be important. The security obligations are substantially the same, but the supervisory regime differs (more stringent and proactive for essential entities) and so does the cap on fines. We've dedicated a separate deep dive to NIS2 fines for companies and how they're calculated, because the numbers are scarier than the words.

Filter 3: are you a supplier to a NIS2 entity? The knock-on effect

This is the part almost no article explains properly, and it's the one that drags in thousands of Italian SMEs who thought they were safe. NIS2 requires obligated entities to manage the risk arising from their own supply chain. In plain terms: if a company is in scope, it has to assess the security of its suppliers and demand guarantees from them.

What does that mean for you if, say, you're a 15-person software house, a firm managing a hospital's IT infrastructure, or a components supplier to an energy company? It means your NIS2 client, in order to be compliant itself, is required to push security requirements down onto you through the contract. Not because the law classifies you directly as a NIS2 entity, but because your client can't afford to have a supplier who is its weak link.

The numbers explain why this piece matters so much. Industry data shows supply-chain compromises have grown roughly fourfold in five years, and today around 30% of breaches involve a third party. An attacker doesn't breach the hospital directly — they breach the small supplier that holds the credentials into the hospital's management system. That's exactly why NIS2 forces the big players to vet the small ones.

How it actually shows up

In practice, this is what it looks like when it lands on your desk:

• A security questionnaire attached to a contract renewal, with dozens of questions on backups, authentication, access management, and staff training.
• Contract clauses requiring you to notify incidents to the client within tight time windows.
• A request to prove you've carried out a recent security audit or vulnerability assessment.
• In some cases, a request for a certification or alignment with a framework such as ISO 27001.

If you can't respond credibly, the risk isn't a fine from ACN (that lands on your client): the risk is losing the contract. A NIS2 client will replace a non-compliant supplier with one that offers real guarantees. That's the actual economic engine pushing the whole supply chain to raise its game — far more than the fines themselves. To structure a solid response to these requests, it's worth starting from our complete guide to IT security audits for SMEs, which ties together risk assessment, technical measures, and documentation.

The 5-minute decision tree

Let's put it all together in a flow you can run through right now, with pen and paper.

Pay attention to step 4: even a flat "no" doesn't give you a licence to ignore security. The 2026 Clusit Report shows SMEs account for roughly 72% of attack targets in Italy, with Italy making up about 10% of incidents worldwide and severe attacks rising at a double-digit rate. NIS2 or no NIS2, you're a target. The difference is that if you're in scope, security becomes a legal obligation with personal liability for management; if you're not, it remains a matter of business survival all the same.

If you're in scope: what changes in 2026 (in brief)

Covering every single measure isn't the point of this article, but here's the overview to grasp the scale of it. If you're a NIS2 entity, you need to address risk analysis, incident management, business continuity and backups, supply-chain security, basic IT hygiene and training, access control, and encryption where relevant. And above all: responsibility for making sure all of this happens falls on management, and can no longer be delegated to the IT department. CEOs and boards answer for it personally, and the decree also mandates training for directors.

On timing, remember the two key deadlines: notification of significant incidents to ACN becomes operational in the first part of 2026, while full implementation of security measures matures by autumn. If you want the precise deadline-by-deadline timeline, we've mapped it all out in our dedicated article on NIS2 deadlines for 2026, and you'll find the step-by-step operational detail in our guide to NIS2 obligations for SMEs.