Cybersecurity1 credit

NIS2 scope check: essential or important entity — and the penalty maximum that comes with it

Pick your sector from the 18 sectors in Annexes I and II, enter employees, turnover, balance sheet total and group turnover, and the check determines your classification — essential entity, important entity or likely out of scope — with the statutory penalty maximum for that category and an indicative ceiling based on the turnover you enter.

nis2 v1.0.0 · vintage 2026.1 · draft free
Example outcome
ClassificationEssential
Sector — Energy, Annex I300 FTE
Statutory maximum — essential entity€10M / 2%
Indicative ceiling — 2% of €1,000M group turnover€ 20M
sha256 a3f19c47e8b2d05f6c91a4e7d23b8f50…

Who it’s for

01CISOs and security officers who must establish which supervisory regime the organisation falls under before setting up a programme.
02IT directors and CIOs who need a substantiated scope determination to justify budget and priority internally.
03Data protection and compliance officers who want the classification and its penalty maximum documented per group entity.

What the tool does

✓ 18 sectors from Annex I (11) and Annex II (7), with sub-sector selection and the supervisor recorded in the vintage✓ Size class: large at ≥ 250 employees, or turnover > €50M and balance sheet total > €43M; medium at ≥ 50 employees or turnover > €10M✓ Size-independent entities — such as DNS providers, TLD registries and trust service providers — always in scope regardless of size✓ Classification: essential entity, important entity or likely out of scope, with the rule that drove the outcome✓ Statutory penalty maximum per category: €10M / 2% for essential and €7M / 1,4% for important entities✓ Indicative ceiling: the higher of percentage × basis and the fixed amount, with group turnover as the basis once you enter it
01 — Form
Case and key figures — a handful of fields.
02 — Draft
Full outcome layout, free.
03 — Pay and receive
Via Mollie, VAT/VIES handled.
04 — Report
Certified PDF + public hash.

How the NIS2 classification is reached

Two variables drive your classification: the annex your sector sits in and the size of your organisation. A large undertaking in an Annex I sector is an essential entity; in an Annex II sector, an important entity. Medium-sized organisations are always an important entity, whichever annex applies (Art. 3(2)). Micro and small organisations fall outside scope, unless they are size-independent — in which case the annex applies in full again.

The thresholds are applied exactly as the source test states them, sharp edges included: on the financial leg, “large” requires both turnover and balance sheet total to be exceeded, and the medium test does not look at the balance sheet at all. An organisation with €51M turnover and a €43M balance sheet therefore lands on medium, not large. The report states which rule fired, with tool version and dataset vintage, so that outcome is traceable rather than surprising.

Frequently asked questions about this tool

Is the penalty figure shown a legal determination?
No. €10M / 2% (essential) and €7M / 1,4% (important) are the statutory maxima per category. The amount alongside them is an indicative arithmetic ceiling: the higher of percentage × basis and the fixed amount, where the basis is the group turnover you enter, or your own turnover if you leave group turnover empty. It is not a fine, not an expectation, and not an estimate of enforcement likelihood.
What does “likely out of scope” mean?
That on this test’s size thresholds you land in micro/small and are not marked as a size-independent entity. The check does not assess whether a supervisor might designate you individually, nor your position in the chain of an entity that is in scope. If you are unsure about the size-independent category, switch it on and compare both outcomes.
Which sectors does the check cover?
The 18 sectors in the vintage: energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management (B2B), public administration and space (Annex I), plus postal and courier services, waste management, chemical industry, food production and distribution, manufacturing (critical products), digital providers and research (Annex II). If your activity falls outside that list, the check returns no classification — the sector choice is mandatory and has no residual category.
Try the draft — free and without an account.
You pay only when you unlock the report.
Start the calculation

Related tools

All 36 tools →
NIS2 scope check: essential or important entity — and the penalty maximum that comes with it — Jurical