Article 2: Scope
NIS2 Art. 2, Chapter I
1. This Directive applies to public or private entities of a type referred to in Annex I or II which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises provided for in paragraph 1 of that Article, and which provide their services or carry out their activities within the Union. Article 3(4) of the Annex
855 words in the official text.
Across the acts
- This provision citesGDPR
This Directive applies without prejudice to Regulation (EU) 2016/679, Directive 2002/58/EC, Directives 2011/93/EU (27) and 2013/40/EU (28) of the European Parliament and of the Council and Directive (EU) 2022/2557.
See it on the crossover map - This provision citesGDPR
Entities, the competent authorities, the single points of contact and the CSIRTs shall process personal data to the extent necessary for the purposes of this Directive and in accordance with Regulation (EU) 2016/679, in particular such processing shall rely on Article 6 thereof.
See it on the crossover map - This provision citesDORAArticle 2(4)
This Directive does not apply to entities which Member States have exempted from the scope of Regulation (EU) 2022/2554 in accordance with Article 2(4) of that Regulation.
See it on the crossover map
Sits inside (1)
Cites (3)
Cited by (5)
Recitals (2)
Recitals matched by wording (9)
These recitals name no article. The dataset matched them to this one by text similarity, and they are marked so nobody reads a match as a citation.
Source texts: the Official Journal, through the Publications Office. Dataset built 2026-07-29. Study aid, not legal advice.
Every connection on this page is drawn from the official text of Directive (EU) 2022/2555. Study aid, not legal advice.
See how NIS2 sits beside the other three acts on the crossover map, or find what your role must do in the obligations checklist.