Which laws likely apply?

1

Start from a typical entity

2

Sector

NIS2 is mainly sector + size. Pick all that apply.

Annex II — other critical

Postal & courier Waste management Chemicals Food production / processing / distribution Manufacturing (devices, electronics, machinery, vehicles) Digital providers (marketplace, search, social) Research

Product, AI, or not listed

Software / IoT product manufacturer (placing on EU market) AI system provider (high-risk / GPAI) Other / not listed above

3

Size

Micro / small Under 50 staff and under €10M turnover (indicative SME ceiling). Medium About 50–249 staff or €10M–€50M turnover — NIS2 “important” threshold in many Annex I cases. Large 250+ staff or €50M+ turnover — NIS2 “essential” threshold in Annex I high-criticality sectors. Size may not matter Some entities (e.g. qualified trust services, TLD/DNS, sole critical providers, central public admin) can be in scope regardless of size.

4

Also true

We place products with digital elements on the EU market We provide high-risk AI or GPAI We process personal data We provide ICT services to financial entities

5

Member State

Used for the competent authority and CSIRT — not to change which EU acts apply.