Is your company in scope of NIS2 – or are you getting NIS2 requirements from customers?
Start by finding out whether your company is in scope itself. The NIS2 check gives a first indication in under a minute, based on your answers about your activities and size. Companies that are not in scope themselves can still be affected through security requirements from customers.
The check uses the same sector and size tests as our RegCheck assessments.
Are we in scope of NIS2?
Whether your company is in scope depends on, among other things, what activities you carry out, the size of the company and specific exceptions. Start with the NIS2 check for a first indication.
We're getting NIS2 requirements from customers – what applies to us?
Customers can place security requirements on their suppliers as part of their NIS2 work. That does not automatically mean your company is in scope of the law itself. Start by separating your own scope from the requirements in the customer relationship.
Read about customer requirements ↓Outside NIS2? You can still get requirements from customers.
- A company is not automatically in scope of NIS2 just because it supplies an entity that is.
- The customer's obligations on supply chain security can lead to questions, contractual requirements and requests for security documentation.
- Which requirements apply in the customer relationship needs to be assessed based on the contract and what the company delivers.
- The NIS2 check gives an indication of the company's own scope.
How Regweaver helps with your NIS2 work
Regweaver OS connects services and digital dependencies, supplier relationships, requirements and documentation in structured workflows. You can follow who needs to respond, what documentation has been provided and what needs follow-up.
Set and follow up requirements
Assign requirements to internal owners and suppliers for the service or dependency concerned. Collect responses and documentation, request additions and follow up actions with clear ownership.
Respond to customer requirements
As a supplier, you respond to the requirements the customer has assigned to your company and provide documentation for the relevant service and scope. Additions and updates get a documented history.
Gather facts on changes and incidents
Document affected services and dependencies, known impact, contact persons and actions. Keep the information in one place for dialogue and follow-up between customer and supplier.
Preserve traceability
Follow the link between requirements, responses, documentation, decisions and actions. The history shows who provided information, reviewed the documentation and decided on the next step.
What NIS2 requires, in brief.
Security measures
Entities in scope must take appropriate risk management measures for their network and information systems, for example incident handling, business continuity and access control.
Supply chain
The measures include security in relations with direct suppliers and service providers. This is where requirements on suppliers come from.
Management
Management must approve and oversee the security measures and undergo training. In Sweden, a court may, on application by the supervisory authority and under specific conditions, impose a temporary ban on holding a management role.
Significant incidents
Significant incidents must be reported without undue delay. Normally, an early warning is due within 24 hours and an incident notification within 72 hours of the entity becoming aware of the significant incident. The final report is normally due within one month of the incident notification.
In Sweden, NIS2 is implemented through the Cybersecurity Act (2025:1506), in force since 15 January 2026. Since 1 July 2026, notifications of entities are received by NCSC at the Swedish National Defence Radio Establishment (FRA).
Sources: Directive (EU) 2022/2555 (NIS2) · Cybersecurity Act (2025:1506) · NCSC: Notifying an entity (Swedish) · All sources and details
Who's affected.
Can be in scope of the law
Affected through customer requirements
Teams doing the work
How scope is assessed — details and sources
Size is calculated from annual work units, annual turnover and balance sheet total. Under the EU definition, a company is normally no longer small at 50 or more annual work units, or when both annual turnover and balance sheet total exceed €10 million. The Swedish notification guidance, however, uses 50 or more persons, or annual turnover or balance sheet total above €10 million. This difference needs to be taken into account in borderline cases.
Figures from partner and linked enterprises (for example a group) can be counted in. Swedish guidance describes how the calculation is done, and how authorities read the financial limb, in more detail.
A change of size category normally requires the thresholds to be passed in two consecutive financial years. Special situations are described in the guidance.
Some entities are in scope regardless of size, for example certain digital infrastructure providers.
Trust service providers have a shorter deadline for the incident notification. If the incident is still ongoing, a progress report is submitted, followed by a final report within one month of the incident being handled.
The check uses the same sector and size tests as our RegCheck assessments.
Sources
Want a broader mapping?
With RegCheck you get a broader mapping of which EU regulations affect your company and how you may be affected through requirements in the value chain.
Continue to RegCheck →Related: Multi-tier value chain governance
Not sure if NIS2 applies to you?
Take the NIS2 check — under a minute, an indication right away.
Monitor NIS2
We watch for changes and send a reviewed notice when something actually changes.
See the monitoring option