The essentials
The NIS2 dossier describes the sectors, the obligations and the timetable. This page stays on what raises the most questions for SME leaders: how size is calculated, and what it changes.
Where is the line between a small and a medium-sized enterprise?
The directive uses the European definition of SMEs, set by Recommendation 2003/361/EC. An enterprise is “small” as long as it employs fewer than 50 persons and its annual turnover or its balance sheet total does not exceed €10 million. It becomes “medium-sized” in two cases: it reaches 50 persons, or its turnover and its balance sheet total both exceed €10 million.
A company of 30 people can therefore enter the scope on its financial figures alone, if its activity appears in the annexes.
How is headcount counted?
Headcount is expressed in annual work units. One person working full time for the whole year counts as one unit; part-time and seasonal work count as fractions. It includes employees, persons working for the enterprise under its authority and treated as employees under national law, owner-managers, and partners engaged in a regular activity in the enterprise. Apprentices and students on a vocational training contract are not included.
The figures used are those of the last closed financial year. Turnover is calculated excluding VAT.
Subsidiary, holding, shareholdings: the group effect
An autonomous enterprise is measured on its own accounts. As soon as it has linked or partner enterprises, their figures are added to its own: in full for a linked enterprise, for example a parent company holding the majority of voting rights, and in proportion to the holding for a partner enterprise, from 25% of the capital or voting rights.
A subsidiary of 20 people owned by a group of 400 is therefore not a small enterprise under this calculation. Recital 16 of the directive nevertheless lets Member States take into account an entity’s independence from its group, in particular where its information systems and its services are separate. How France will use that option depends on the transposition law.
Five SME situations
| Situation | Reading |
|---|---|
| Packaging machinery manufacturer, 120 employees, autonomous company | Annex II activity (manufacture of machinery and equipment) and medium size: important entity. |
| Software vendor hosting its own online product, 35 people, €12 million turnover and €11 million balance sheet | Both financial thresholds are exceeded: medium-sized enterprise. It remains to check whether the service meets the Annex I definition of a cloud computing service. If so, important entity. |
| Managed IT services provider, 25 people, €3 million turnover, autonomous company | Activity listed in Annex I (managed service provider), but a small enterprise: out of scope. Its customers in scope will pass on their requirements by contract. |
| Domain name registrar, 8 people | In scope whatever its size. |
| Industrial supplies wholesaler, 80 employees | Medium size, but the activity is absent from the annexes: out of scope, unless designated by the State. |
These readings are examples. A real company is qualified on its accounts, its exact activity and its ownership structure.
What is expected of an SME in scope
The ten families of measures in Article 21 apply to every entity, but the directive wants them “appropriate and proportionate”. It names the criteria for that proportion: the entity’s exposure to risks, its size, the likelihood of incidents and their severity, including their societal and economic impact. The cost of implementation also counts. An SME does not have to replicate a large group’s set-up; it must be able to explain its choices.
Two obligations are the same whatever the size. Management approves the measures and answers for them. Significant incidents are reported within the set deadlines: early warning within 24 hours, notification within 72 hours, final report one month later.
Where to start with a small team
- Write down the qualification: activity, headcount, figures, group links, sources and date. One page is enough, provided it exists.
- Name who carries the subject at management level and who can be reached in an incident.
- List the services whose interruption stops the business, and the providers they depend on.
- Actually restore a backup and note how long it takes.
- Extend multi-factor authentication to email, remote access and administration accounts.
- Prepare the reporting sheet: who decides, who writes, to whom.
Frequently asked questions
Is an SME in scope an essential or an important entity?
Do apprentices and part-time staff count towards headcount?
A fund holds part of our capital: must its figures be added?
We are below the thresholds: what does NIS2 change for us?
How does an SME in scope make itself known to the authority?
Check your situation
The guided NIS2 assessment reviews the entity, the sector, the size, governance, suppliers and incidents. It takes about six minutes and returns a first reading of applicability. For a specific sector, see also NIS2 in manufacturing.