--- title: "Decide whether NIS2 covers you · Agent Wranglers" url: https://agentwranglers.se/playbook/compliance/security-laws/nis2-scope id: CMP-46 level: Recommended applies: eu-users region: EU updated: 2026-10-27 build: a2a6bdfed830 tokens: 774 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Decide whether NIS2 covers you For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: CMP-46 - Level: Recommended - Chapter: [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md) - Rule: Decide whether the NIS2 Directive covers you from your sector and size, record the decision, and register with the national authority when it does. - Check: The obligations register has a NIS2 entry computed from the facts file. When it applies, the entry holds the authority's registration reference and date. - Applies when: The project has users in the EU. - Region: European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds. - How: NIS2, Directive (EU) 2022/2555, covers medium and large firms in the sectors of its Annexes I and II. Digital ones include cloud computing, data centres, content delivery networks and managed IT or security services for businesses. Online marketplaces, search engines and social networks count too. DNS providers, top-level domain registries and trust services are covered at any size. Compute the size test with the [facts rule](https://agentwranglers.se/playbook/compliance/scope-and-ownership/scope-from-facts.md). Each EU country writes NIS2 into its own law, so read the national act of every country where you are established. Sweden's is the cybersäkerhetslag (2025:1506), as [Register with MCF when the Swedish cybersecurity law covers you](https://agentwranglers.se/playbook/compliance/security-laws/swedish-nis2-registration.md) says. Cloud, DNS and similar digital providers are supervised where their main establishment is. ## Sources - [NIS2 Directive (EU) 2022/2555](https://eur-lex.europa.eu/eli/dir/2022/2555/oj) - [Commission Recommendation 2003/361 on SME definition](https://eur-lex.europa.eu/eli/reco/2003/361/oj) ## Related rules - CMP-2 [Derive scope from recorded facts](https://agentwranglers.se/playbook/compliance/scope-and-ownership/scope-from-facts.md) in Compliance and governance - CMP-84 [Register with MCF when the Swedish cybersecurity law covers you](https://agentwranglers.se/playbook/compliance/security-laws/swedish-nis2-registration.md) in Compliance and governance **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers compliance and governance playbook`. In code you write, add a comment next to it with the same link. - Next: [Map the NIS2 measures to controls](https://agentwranglers.se/playbook/compliance/security-laws/nis2-measures.md) - [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md)