A software company is in scope for NIS2 if it is a medium-sized or larger enterprise operating in a sector type listed in Annex I or II and providing services in the EU, or if a size-independent rule applies. Most pure software vendors are not named as a sector, but cloud, managed service and certain digital providers are.
Step 1: Does the entity type appear in Annex I or II?
Article 2 applies the directive to "entities of a type referred to in Annex I or II". For software and IT firms, the relevant lines are:
- Annex I, digital infrastructure: cloud computing service providers, data centre service providers, content delivery network providers, DNS service providers, TLD name registries, trust service providers, Internet Exchange Point providers, and providers of public electronic communications networks or services.
- Annex I, ICT service management (business to business): managed service providers and managed security service providers.
- Annex II, digital providers: online marketplaces, online search engines and social networking platforms.
A company that sells ordinary packaged or SaaS software is not automatically on that list. Whether a SaaS product counts as a "cloud computing service" depends on the directive's definition and on national guidance, so check both.
Your customers matter too. Many Annex I and II sectors (energy, transport, health, banking, public administration and others) are themselves in scope. They must manage supply chain risk under Article 21(2)(d), so you may face contractual requirements without being directly regulated.
Step 2: Check the size rule
Article 2(1) covers entities that qualify as medium-sized enterprises under Recommendation 2003/361/EC, or exceed the medium-size ceilings. The Article says the recommendation's Article 3(4) does not apply, which changes how linked enterprises are counted. Look up the thresholds in the recommendation and apply them to your group.
Step 3: Check the size-independent rules
Article 2(2) to (4) applies the directive regardless of size where, for example:
- the entity provides public electronic communications networks or services, trust services, or is a TLD registry or DNS provider;
- it is the sole provider in a member state of an essential service;
- disruption could have significant impact on public safety, security or health, or create systemic risk;
- it is a critical entity under Directive (EU) 2022/2557;
- it provides domain name registration services.
Step 4: Check national law and exemptions
Member states can add scope (Article 2(5) mentions local public bodies and education institutions). Entities exempted from the financial sector regulation DORA under its Article 2(4) are also outside NIS2 (Article 2(10)). Each country also keeps a register of entities and requires you to submit details such as name, contact details and sectors (Article 3(4)), so check whether you must register.
Step 5: Document your conclusion
Write a one page scope memo: the Annex line you considered, the size calculation, the countries where you provide services, and the date. If the answer is "out of scope", keep the memo anyway. Customers often ask.
Safeguard's asset discovery and SBOM and dependency scanning can help you list what you run and ship, which feeds the supply chain answers customers may request.
Quick check
Does selling software to EU banks put me in NIS2 scope?
Not by itself. Scope depends on your own entity type and size. Banks must manage supplier risk, so you may see contract requirements, and under DORA ICT providers face their own rules.
Is there a single EU register of in-scope companies?
No. Article 3 has each member state build its own list of essential and important entities.
Sources
Last reviewed: 19 October 2026.
