Does NIS2 apply to your small business? A plain-English guide

If you run a small business in the EU, you've probably heard the term "NIS2" somewhere — a client email, a supplier questionnaire, a LinkedIn post from a compliance consultant. Most of the coverage is written for large enterprises, which leaves smaller business owners with one real question unanswered: does this actually apply to me?

The honest answer is: probably not directly, but it might reach you anyway. Here's how the rules actually work.

What NIS2 is, in one paragraph

NIS2 (Directive (EU) 2022/2555) is the EU's updated cybersecurity law. It replaces the original 2016 NIS Directive and significantly widens both the number of sectors covered and the number of companies within those sectors that are regulated. The directive entered into force in January 2023, and EU member states were required to transpose it into national law by 17 October 2024 — so it's now live (or in the process of becoming fully enforced) across the EU, with national laws implementing it at slightly different paces.

Are you directly in scope? Two things decide it: sector and size

NIS2 splits regulated organisations into essential entities and important entities. Both categories only apply to companies operating in specific sectors listed in the directive's annexes:

On top of sector, there's a size threshold. As a general rule, NIS2 applies to medium and large organisations: roughly 50 or more employees, or more than €10 million in annual turnover or balance sheet total. Micro and small businesses below that threshold are generally excluded — with some specific exceptions regardless of size, such as sole providers of a critical service in a country, public administration bodies, providers of public electronic communications networks, and top-level domain name registries or DNS service providers.

So if you're a small business outside these sectors, or below the size threshold, you are very likely not directly regulated by NIS2.

Then why does everyone keep asking about it?

Because NIS2 doesn't stop at the companies it directly regulates. One of its core requirements — supply chain security — obliges every in-scope company to assess and manage the cybersecurity risk of its suppliers and service providers. In practice, that means a mid-size logistics company, hospital, or software vendor that is covered by NIS2 has to start asking its own vendors (that's potentially you) to demonstrate basic security controls.

This is showing up as security questionnaires attached to contract renewals, clauses requiring MFA and incident reporting, and occasionally full vendor security audits — sent to businesses that have never heard of NIS2 and aren't in scope themselves. If your biggest customer is a hospital, an energy company, a bank, or a larger IT/software provider, this is worth expecting even if the law never touches you directly.

What NIS2 actually requires (the baseline measures)

Whether you're formally in scope or just trying to satisfy a customer's security questionnaire, the underlying requirements (Article 21(2) of the directive) are the same practical baseline:

If you're formally in scope: reporting deadlines and penalties

Entities that are directly regulated face strict incident reporting timelines: an early warning to the national authority or CSIRT within 24 hours of becoming aware of a significant incident, a more detailed notification within 72 hours, and a final report within one month. Penalties for non-compliance are substantial — up to €10 million or 2% of global annual turnover for essential entities, and up to €7 million or 1.4% of turnover for important entities, whichever is higher in each case.

If you're a small supplier rather than a directly regulated entity, these specific fines don't apply to you — but losing a contract for failing a security review carries its own cost.

What to actually do about it