There are two ways into NIS2 scope. Most organisations only check one.

TL;DR

• NIS2 scope is not just a sector-and-size question; supply chain obligations can pull you in even if the directive does not apply directly.
• The EU deadline was 2024, but national laws, registration windows and enforcement activity are landing through 2025 and 2026.
• Essential and important entities face the same Article 21 security obligations; the main difference is supervision model and maximum penalty.
• Organisations selling into EU critical sectors should expect NIS2-driven contract clauses, questionnaires, and evidence requests from customers.
• 6clicks helps teams confirm obligations, map Article 21 to existing controls, collect evidence continuously, and manage supplier risk in one place.

Why this is urgent

The EU deadline was 2024. The obligations that actually bind you only went live in 2025 and 2026, which is exactly why this is a 2026 problem.

17 October 2024 was the date Member States were supposed to have NIS2 in national law. Most missed it. NIS2 is a directive, so it creates no direct obligations until each country passes its own statute, and that has only happened recently:

• The national laws are going live now. Germany's law took effect on 6 December 2025 with no transition period, its registration window running into 2026. Luxembourg transposed in May 2026. Roughly two-thirds of Member States now have laws in force, with more following through 2026. For most organisations, "the deadline" is a national go-live date in 2025–2026, not the 2024 EU date.
• 2026 is when enforcement starts biting. The European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU in July 2026 for late transposition. Now that supervisory regimes are live, legal commentators describe 2026 as the year the first NIS2 enforcement actions begin. For essential entities, regulators can inspect and audit without waiting for an incident, fines can reach €10m or 2% of global turnover, and under Article 20, senior management is personally accountable.
• The supply chain is already asking. In-scope organisations must manage supplier risk under Article 21(2)(d), so contract clauses, security questionnaires and evidence requests are landing on vendors right now, whether or not those vendors are directly in scope.
• Compliance takes time to build. The ten Article 21 measures demand evidence they work in practice, continuously, and not a one-off document. Standing up controls, collecting evidence, and proving effectiveness is a multi-month program, so starting after your national law goes live, or after the first audit request, is already behind.

The first step is knowing whether, and how, NIS2 applies to you. The rest of this page walks you through it.

Step 1: Which Annex is your sector in?

Note: Not in either column? Go to Step 4. You may still be in scope.

Step 2: What size are you?

Step 3: What the classification actually changes

Note: The obligations are identical. Only the supervision model and the penalty ceiling differ. Being classified as important is not a lighter compliance burden.

Step 4: In scope regardless of size

Size thresholds do not apply if any of these are true:

• You provide public electronic communications networks or services
• You are a trust service provider
• You are a TLD name registry or DNS service provider
• You are the sole provider in a Member State of a service essential to economic or societal activity
• Disruption to your service could significantly affect public safety, security, or health
• Disruption could cause significant systemic risk, particularly across borders
• You are designated a critical entity under the CER Directive
• You are a public administration entity

Step 5: The supply chain test

Not in scope directly? Your customers still are.

Article 21(2)(d) requires in-scope organisations to manage security risks in their supply chain and across supplier relationships. In practice, that obligation moves down the chain as contract clauses, security questionnaires, and evidence requests.

If you sell into energy, health, transport, public administration, or digital infrastructure in the EU, NIS2 will reach you through procurement whether or not it reaches you through the annexes.

Step 6: Where your obligations actually come from

NIS2 is a directive, not a regulation. It takes effect through each Member State's national law, and transposition has been uneven. Your specific thresholds, registration deadlines, and reporting channels are set by the country you operate in, not by the directive text.

Operating across several Member States means several sets of national rules.

Scope tells you whether the obligations apply. Article 21 tells you what they are. Ten security measures, each requiring evidence that they work in practice, with management personally accountable for approving and overseeing them under Article 20. See how the ten Article 21 measures map to ISO 27001 controls you may already have.

How 6clicks helps you get NIS2-ready

Scope is step one. 6clicks runs the rest. Once you know whether you are an essential entity, an important entity, or pulled in through the supply chain, the work is proving you meet the ten Article 21 measures, and keeping that evidence current. 6clicks brings scoping, controls, evidence, and reporting in one place.

See how 6clicks maps the ten Article 21 measures to controls you may already have. 
Speak with our team.