The NIS2 Directive extends its scope to entities operating in specific sectors, even if they are not established in the EU. The directive places the emphasis on where an entity provides its services or carries out its activities, rather than on its physical headquarters.

Article 2, Paragraph 1 establishes that the directive applies to public or private entities of the types listed in Annexes I or II, “deemed to be medium-sized enterprises… or exceeding the ceilings for medium-sized enterprises… and providing their services or carrying out their activities within the Union.“

Article 2, Paragraph 2 further clarifies that the directive applies to the entities listed in Annexes I or II, regardless of their size, if their services are provided by:

• Providers of public electronic communications networks or publicly available electronic communications services;
• Trust service providers.

Article 2, Paragraph 4 specifies that the directive also applies to entities providing domain name registration services, regardless of their size.

Article 26 establishes the jurisdiction and territoriality of the directive. Specifically, Article 26, Paragraph 1(b) clarifies that certain entities fall under the jurisdiction of the directive based on the location of their main establishment in the EU. This includes domain name system service providers, top-level domain name registries, entities providing domain name registration services, cloud computing service providers, data center service providers, content delivery network providers, managed service providers, managed security service providers, as well as providers of online marketplaces, online search engines, and social networking services platforms.

To ensure compliance for entities not established in the EU but offering services within its borders, Article 26, Paragraph 3 requires such entities to designate a representative within the EU. This representative must be established in one of the Member States where the services are offered. Organizations in this situation that need to initiate a structured NIS2 compliance path may find specialized support useful for mapping applicable obligations and defining concrete actions.

Key Points:

• The applicability of the NIS2 Directive is based on where an entity operates or provides services, and not exclusively on where it is established.
• Entities operating in sectors such as electronic communications, trust services, and domain name registration, among others, are particularly subject to NIS2 even if they are established outside the EU, provided they offer services within the Union.
• The requirement to designate a representative in the EU ensures that non-EU entities can be held accountable for NIS2 compliance.

Additional Considerations:

• It is not specified how the EU intends to enforce the NIS2 Directive on entities operating in jurisdictions without cooperation agreements with the EU. Further research into this aspect may be necessary. For those who wish to start from the official text of the NIS2 Directive, the full reference document is available.