NIS2 Size Thresholds: Why It Takes 50 Staff — or Both €10M Figures — to Put You In Scope

The NIS2 size gate is stated wrongly on most pages that explain it, and the error changes answers. The popular shorthand — “50 employees or €10 million turnover” — pulls in companies that are out of scope and, less often, waves through companies that are in.

The operative rule, read off Article 2(1) of Directive (EU) 2022/2555 and the SME definition it borrows: on the size route you enter NIS2 scope the moment you stop being a small enterprise. That happens when you employ 50 or more annual work units, or when your annual turnover and your annual balance sheet total both exceed €10 million. One high financial figure on its own does not do it. Fifty staff on its own does.

The size test in one line — and the version to stop using

NIS2 does not write its own size criteria. Article 2(1) applies the Directive to Annex I and Annex II entities “which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises provided for in paragraph 1 of that Article”. Everything therefore turns on one borrowed definition [1][2].

Your figures (whole undertaking)	Enterprise class	NIS2 size gate
Under 50 AWU, and turnover or balance sheet at or below €10M	Small (or micro)	Out — unless a regardless-of-size rule catches you
50 or more AWU (any turnover, any balance sheet)	Medium-sized or larger	In
Under 50 AWU, but turnover and balance sheet both above €10M	Medium-sized	In
250+ AWU, or turnover above €50M and balance sheet above €43M	Large	In, and essential if the sector sits in Annex I

Germany wrote this structure straight into statute. Section 28(2) no. 3 of the BSI-Gesetz defines an important entity as one that “a) mindestens 50 Mitarbeiter beschäftigen oder b) einen Jahresumsatz und eine Jahresbilanzsumme von jeweils über 10 Millionen Euro aufweisen” — at least 50 staff or a turnover and a balance sheet total each above €10 million [5]. The connectors are the whole point: or between headcount and money, and between the two money figures.

Why the test is really “am I small?”

Recommendation 2003/361/EC never defines “medium-sized” directly. Its Annex defines the SME category as a whole (fewer than 250 persons, with turnover at or below €50 million and/or a balance sheet total at or below €43 million), then carves out small at Article 2(2) and micro at Article 2(3) [2]. Medium-sized is what is left over — which is why the practical question is never “am I medium-sized?” but “have I stopped being small?” People test for arrival at a size class the law defines only by subtraction, and the shorthand is what they end up with.

Size is also only one of two routes in. Article 2(2) to 2(4) catch certain entities regardless of size — public electronic communications providers, trust service providers, TLD registries and DNS providers, domain name registration services, entities designated as critical under Directive (EU) 2022/2557, and entities a Member State identifies as sole providers or systemically significant [1]. If any of those describe you, the arithmetic below is moot. Our full scope guide lists the sectors and the size-independent categories.

Counting staff: annual work units, not heads

Article 5 of the Annex measures headcount in annual work units (AWU) — “the number of persons who worked full-time within the enterprise in question or on its behalf during the entire reference year”. Part-time work counts “regardless of duration”, and part-year and seasonal work count “as fractions of AWU” [2].

Counts toward AWU	Does not count
Employees, full-time and part-time (pro-rated)	Apprentices and students on apprenticeship or vocational training contracts — zero, however many there are
Seasonal and part-year workers, pro-rated	The duration of maternity or parental leave
Owner-managers, and partners in regular activity who draw financial advantage from the enterprise
Seconded and interim staff treated as employees under national law

A worked example. A food producer has 62 names on the payroll: 38 full-time all year, 14 part-time at 0.5, 6 seasonal workers for four months (0.33 each), and 4 apprentices. The AWU count is 38 + 7 + 2 = 47. Sixty-two heads, 47 AWU, still small on the headcount criterion. In practice the gap is widest in retail, hospitality, agriculture and food processing, where seasonal contracts are routine — run the calculation rather than reading a number off the HR system. The Commission’s User guide to the SME definition adds one caveat: whether an interim or seconded worker counts as “an employee” is settled by national law, so a borderline count can differ between two Member States [3].

Turnover or balance sheet: the choice you are given

Article 2(2) of the Annex defines a small enterprise as one that “employs fewer than 50 persons and whose annual turnover and/or annual balance sheet total does not exceed EUR 10 million” [2]. That “and/or” is not sloppy drafting. The Commission’s user guide states the consequence flatly:

“Meeting the staff headcount criterion is mandatory in order to be considered an SME. However, an enterprise may choose to meet either the turnover or the balance sheet total ceiling. It does not need to satisfy both requirements and may exceed one of them without impact on its SME status.” [3]

The choice exists because trade and distribution businesses carry high turnover on thin assets while manufacturers carry the reverse; offering an option between a flow measure and a stock measure “ensures that SMEs engaged in different types of economic activity are treated fairly” [3].

Ireland’s National Cyber Security Centre publishes the clearest worked example from a national competent authority: “a small enterprise with 35 AWUs and an annual turnover of €1,000,000 but an annual balance sheet total of €50,000,000 would still be considered a small or micro enterprise based on its turnover” [4]. A balance sheet five times the ceiling, and the entity stays out — because turnover is the figure it is entitled to rely on.

When the two figures diverge: the four cases

Below 50 AWU, only one of four combinations puts you in scope.

Turnover	Balance sheet	Still small?	Size gate
≤ €10M	≤ €10M	Yes	Out
> €10M	≤ €10M	Yes — rely on the balance sheet	Out
≤ €10M	> €10M	Yes — rely on the turnover	Out
> €10M	> €10M	No — no ceiling left to rely on	In

Two consequences follow that the shorthand hides. A 40-person commodities trader on €15 million turnover and a €20 million balance sheet is a medium-sized enterprise and inside NIS2, despite being nowhere near 50 staff. And a 60-AWU regional manufacturer on €3 million turnover is also inside, despite being nowhere near €10 million, because it failed the mandatory headcount criterion and no financial figure can rescue it.

National summaries compress this differently, so read your own authority’s wording rather than a generic one. Ireland’s NCSC states the small-enterprise test in exactly the Recommendation’s terms, but its medium-sized row adds a lower financial bound — “annual turnover: €10-50 million or balance sheet total: €10-43 million” — that the Recommendation itself does not contain [4]. Read literally, that would put the 60-AWU, €3 million manufacturer outside; read as a description of the typical medium-sized firm, it would not. Germany’s statutory wording leaves no such gap [5]. Where a Member State has transposed the test into legislation, that text governs locally; where it has published a summary table, treat the Recommendation as controlling and the table as a guide.

Group structures: whose numbers you have to add

The figures are almost never just yours. Article 3 of the Annex sorts every enterprise into autonomous, partner (an upstream enterprise holds 25% or more of the capital or voting rights) or linked (majority of voting rights, power to appoint or remove the board, dominant influence by contract or articles) [2].

Article 6(2) then sets the arithmetic: add 100% of the data of any linked enterprise, and add partner data “proportional to the percentage interest in the capital or voting rights (whichever is greater)”. A 30% equity, 50% voting stake aggregates at 50%, not 30% [2].

Article 6(3) is the step almost no guide reproduces. Before you pro-rate a partner’s numbers, you must first add “100% of the data of enterprises which are linked to these partner enterprises” [2]. You are pro-rating the partner’s entire consolidated group, not the partner alone — which is how a modest minority stake in a small holding company can import a large headcount. For structures where two parents each hold a stake, see our guide to joint ventures and NIS2 scope.

Two adjustments apply on top:

• Public ownership does not strip SME status here. Annex Article 3(4) normally disqualifies any enterprise 25% or more controlled by public bodies from being an SME. NIS2 Article 2(1) switches it off in terms: “Article 3(4) of the Annex to that Recommendation shall not apply for the purposes of this Directive” [1]. A council-owned utility is therefore sized like a private company. Germany repeats the carve-out at Section 28(4) BSIG [5].
• Independence may be taken into account — where a Member State says so. Recital 16 indicates that Member States “are able to take into account the degree of independence an entity enjoys in relation to its partner or linked enterprises when applying Article 6(2) of the Annex”, particularly independence in the network and information systems it uses [1]. This is a recital and an option, not an obligation, and it creates no entitlement by itself. Germany has exercised it: Section 28(4) BSIG disapplies aggregation where the entity is independent of its partner or linked enterprises with regard to the nature and operation of its IT systems, components and processes [5]. Whether you can rely on it depends entirely on your own Member State’s transposition.

When the number actually bites

Crossing a ceiling once changes nothing. Article 4(2) of the Annex provides that exceeding or falling below a ceiling “will not result in the loss or acquisition of the status of medium-sized, small or microenterprise unless those ceilings are exceeded over two consecutive accounting periods” [2]. Figures come from the latest approved accounting period, with turnover calculated excluding VAT [2].

That gives a growing company roughly a year of visibility: the first set of accounts over the line is a warning, the second is the trigger. Use the interval — registration, governance sign-off and a first risk assessment are not same-quarter work.

One route removes the buffer entirely. The Commission’s user guide states that Article 4.2 “does not apply in the case of enterprises that exceed the relevant SME thresholds as a result of a change in ownership following a merger or acquisition”, because such a change is “not considered temporary”; those enterprises are assessed “on the basis of their shareholder structure at the time of the transaction”, so “the loss of SME status may be immediate” [3]. A target that was comfortably small can be in scope on completion day — see our M&A compliance checklist.

What to do with the answer

The size class settles more than a yes or no. Combined with your Annex, it also sets your supervision regime: Annex I entities above the medium ceilings are essential, and most other in-scope entities are important [1].

Role	What the size answer changes for you
Compliance officer	Document the calculation itself — AWU workings, which financial ceiling you relied on, the group perimeter, and the accounting periods used. The number is an assertion you will have to defend, not a fact on file.
Owner or finance director of an SME	Watch the pair of financial figures, not one of them. You lose small status only when both pass €10M — but you lose it on headcount alone at 50 AWU. Our small business compliance plan covers the first steps.
CISO or IT manager	If the entity is borderline, scope the security programme for the year after the second set of accounts, not the year of the trigger. See what changes at medium-enterprise level.
Board or C-suite	Group structure is a scope lever. Acquisitions, JV stakes above 25% and voting-rights changes all move the number, and an acquisition can move it on completion day.

Do not expect the regulator to settle it for you. Ireland’s NCSC states the position plainly: “It is not the role of the NCSC to confirm if entities are, or are not, in scope of the NIS2 Directive. This determination must be made by the entity as they know the specifics of their business” [4]. It offers a self-assessment tool, not a ruling. Scope is a self-declaration you defend on your own workings — which matters, because across the guidance pages reviewed for this article, three of four stated the boolean structure in a way that would give a different answer from the Directive for at least one realistic company profile.

If the answer is “in”, our five-step scope test resolves sector and jurisdiction, and the essential entity definition covers the second boundary at 250 AWU.

Frequently Asked Questions

Is the NIS2 threshold 50 employees or €10 million turnover?

Neither, on its own, and the “or” between them is misleading. You leave small-enterprise status at 50 or more annual work units regardless of your finances, or — below 50 AWU — when turnover and balance sheet total both exceed €10 million. Exceeding just one financial ceiling keeps you small [2][3].

Can a company with fewer than 50 employees be in NIS2 scope on size alone?

Yes. An entity under 50 AWU whose turnover and balance sheet total both exceed €10 million is a medium-sized enterprise and inside the Directive on the size route. Asset-heavy, high-turnover businesses with small teams are the typical case.

Do part-time and seasonal staff count toward the 50?

Yes, as fractions. Part-time work counts “regardless of duration” and seasonal and part-year work counts as fractions of an annual work unit. Apprentices and students on vocational training contracts count as zero, and maternity or parental leave is not counted [2].

Do we have to add our parent company’s headcount and turnover?

Generally yes. Add 100% of any linked enterprise’s data and a pro-rata share of any partner enterprise’s — at the greater of the capital or voting-rights percentage — including 100% of that partner’s own linked enterprises before the pro-rata [2]. Some Member States, Germany among them, allow the aggregation to be set aside where the entity is genuinely independent in its IT systems [1][5].

How quickly does crossing the threshold put us in scope?

Not immediately. Status changes only when the ceilings are exceeded over two consecutive accounting periods [2]. The exception is a merger or acquisition: there the two-period rule does not apply, and loss of SME status may be immediate [3].

Sources

1. European Parliament and Council, Directive (EU) 2022/2555 (NIS2), Articles 2 and 3, Recitals 7 and 16 — eur-lex.europa.eu (linked above)
2. European Commission, Recommendation 2003/361/EC concerning the definition of micro, small and medium-sized enterprises, Annex Articles 2-6 — eur-lex.europa.eu/eli/reco/2003/361/oj
3. European Commission, User guide to the SME definition — ec.europa.eu (linked above)
4. National Cyber Security Centre Ireland, NIS2 FAQ — ncsc.gov.ie (linked above)
5. Bundesministerium der Justiz, BSI-Gesetz (BSIG) § 28 — Besonders wichtige Einrichtungen und wichtige Einrichtungen — gesetze-im-internet.de (linked above)
6. Arthur Cox LLP, NIS2 & SME guidelines: How do they apply and thresholds — arthurcox.com
7. European Commission, DG Internal Market, Industry, Entrepreneurship and SMEs, SME definition — single-market-economy.ec.europa.eu

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.