Agent Wranglers

CMP-46Recommended EU law

Decide whether NIS2 covers you

Decide whether the NIS2 Directive covers you from your sector and size, record the decision, and register with the national authority when it does.

By Agent Wranglers. Updated .

Region

European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

How to do it

NIS2, Directive (EU) 2022/2555, covers medium and large firms in the sectors of its Annexes I and II. Digital ones include cloud computing, data centres, content delivery networks and managed IT or security services for businesses. Online marketplaces, search engines and social networks count too. DNS providers, top-level domain registries and trust services are covered at any size. Compute the size test with the facts rule. Each EU country writes NIS2 into its own law, so read the national act of every country where you are established. Sweden's is the cybersäkerhetslag (2025:1506), as Register with MCF when the Swedish cybersecurity law covers you says. Cloud, DNS and similar digital providers are supervised where their main establishment is.

How to check

The obligations register has a NIS2 entry computed from the facts file. When it applies, the entry holds the authority's registration reference and date.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/compliance/security-laws/nis2-scope">Agent Wranglers compliance and governance playbook</a>. In code you write, add a comment next to it with the same link.