Does the NIS2 Directive actually apply to our company, and how do we verify it?

Everyone has been getting these letters lately. Legal departments at primary contractors are just copy-pasting standard template forms to their entire vendor list. Because of your headcount and turnover limits, you are not a direct addressee of NIS2, which means you have zero obligation to report to the state. Don't panic and set aside hundreds of thousands of euros for consultants—negotiate the contract terms instead.

Even if you aren't directly bound by the directive, your client will still require basic cyber hygiene standards. Typically they want to see: Multi-factor authentication (MFA), network-isolated data backups, a basic incident response plan, and internal security awareness training for staff. Implementing these is essential for your business health anyway.

There are three official sources you should verify: 1) The annex lists in Italy's national transposition decree (decreto legislativo). 2) The SME sizing calculation guide published by the ACN. 3) If you are part of a corporate group or holding structure, the combined headcount and turnover of all affiliated companies (even if you look small on your own, the group total could push you over the threshold).

Dear colleague, in order to preserve your commercial relationship with the lead enterprise, it is strongly advised not to leave the inquiry unanswered. It would be appropriate to issue a formal letter stating that pursuant to statutory headcount and revenue thresholds, your company does not qualify as an "essential" or "important" entity, but that you remain prepared to disclose your current security controls to ensure supply chain integrity.

Big corps love dumping their own compliance burdens onto SMEs. By telling you "you're covered under NIS2," they're probably trying to get you to foot the bill for expensive audit costs. You aren't directly liable. Consult your lawyer and make it clear to the client that you won't accept heavy contractual penalties that exceed the statutory framework.

We are of a similar scale (42 staff, 8 million EUR turnover). We received the exact same letter from a client in the energy sector. We paid 1,200 EUR to an independent IT legal counsel to draft a technical-legal opinion confirming we are out of scope and submitted it to the client. They dropped the issue and we were exempted from the audit.

If you're under 50 employees and 10 million in revenue, NIS2 doesn't legally apply to you directly, but your prime client can still make it a contractual condition to keep doing business with them.

i feel the same way then if you get three different answers on a topic, the question was asked wrong.

don't hesitate to ask; those who don't ask always pay more and correct me if I'm wrong.

I think it's hard to be that definitive about who does nis2 apply to. When making a decision, first look at what data you have on hand.

If you post the result here, it will help others too.

We've heard this a lot, but it never happened like that for us. When making decisions, write down the worst-case scenario too, not just the best.

Good luck with that.

Correct.

To get into the details: The biggest time-waster for us was not knowing who had the final say.

Of course it varies if your situation is different.

Could you elaborate on that? The biggest time-waster for us was not knowing who had the final say.

When making decisions, write down the worst-case scenario too, not just the best. If I were you, I'd go this route.

Sorry, but this doesn't apply in every case. anyway when you try to change everything at once nothing settles.

Good luck with that.

I'd appreciate it if you shared the outcome.

I went through the same thing two years ago. The answer varies greatly by industry; there is no one-size-fits-all rule.

My question might sound amateurish, sorry about that. The biggest time-waster for us was not knowing who had the final say.

Hope this helps.

saved.