NIS2 & SME Guidelines: How Do They Apply And Thresholds

• Published date: 11 December 2025
• Law Firm: Arthur Cox
• Author: Vivian Spies, Colin Rooney, Olivia Mullooly, Ian Duffy and Rob Corbet

The NIS2 Directive ("NIS2"), building on the foundations of the original NIS Directive introduced in 2016, is aimed at enhancing and further harmonising the EU's cybersecurity framework. NIS2 expands the scope of covered entities and industries, to ensure better protection for critical infrastructure across the EU (see our video series for more general discussion on NIS2).

This article examines the criteria and thresholds applied under NIS2 for determining which entities are in scope and the extent of their obligations, with a particular focus on micro, small, and medium-sized enterprises (SMEs). We aim to highlight that an entity's turnover / balance sheet and the number of people they employ are not the sole determining factors in this regard, as many entities which meet these thresholds may still fall within the scope of NIS2, or face additional obligations, where they have access to significant additional resources.

Relevant criteria

Broadly speaking, two criteria are used to determine whether an entity is within scope of NIS2, and the extent of their obligations:

• The sector within which the entity operates; and
...