A company that makes components, or runs a SaaS product, tends to assume cybersecurity-infrastructure rules are written for someone else - the utilities and the banks, not them. For mid-market manufacturers and digital-service providers, that assumption is the single most expensive mistake available, because NIS2 pulled exactly these sectors into scope, and getting the self-assessment wrong does not protect you if a regulator later disagrees.
So before anything else, it is worth working out properly whether you are in scope, and if so as what. For a mid-market manufacturer or digital provider, it comes down to three tests.
Test one: whether you are in a covered sector
NIS2 defines its reach through two annexes, and mid-market manufacturers and digital providers tend to land in the second one.
Annex I covers the sectors people think of as critical infrastructure: energy, transport, banking, financial market infrastructure, health, drinking and waste water, digital infrastructure, ICT service management, space, and public administration.
Annex II covers a second set that is less obviously "critical" but squarely in scope: postal and courier services, waste management, the manufacture of certain products, chemicals, food production and distribution, digital providers such as online marketplaces, search engines and social platforms, and research.
This is where mid-market firms are caught off guard. A company that manufactures in one of the covered product categories, or that operates a digital platform, is in a listed sector - even though it would never describe itself as critical national infrastructure. The first test is simply whether what you make or operate appears on either annex. For a great many mid-market manufacturers and digital providers, the honest answer is yes.
Test two: whether you are big enough - counting the parts you don't
Being in a covered sector is necessary but not sufficient. NIS2 generally applies from a size threshold - broadly, medium-sized enterprises and above, so a genuinely small firm in a covered sector may fall outside it.
The trap is in how size is calculated. The threshold is not measured on the single legal entity in isolation; it can take account of linked and partner enterprises - parent companies, subsidiaries, and significant shareholdings.
A mid-market firm that looks comfortably below the threshold on its own can be pulled above it once the group it belongs to is counted. This is the calculation that most often surprises firms: the entity feels small, but the group does not, and NIS2 looks at the relationship, not just the entity.
So test two is not "how many people do we employ." It is "what is our size once the linked and partner enterprises are included" - which is a different, and often larger, number.
Test three: essential or important
If the first two tests put you in scope, the third decides how heavily you are supervised. NIS2 sorts in-scope entities into two tiers, and the tier follows roughly from which annex you are in and how large you are.
Most mid-market manufacturers and digital providers in Annex II will fall into the important tier rather than the essential one. That matters, because important entities face reactive, ex-post supervision - scrutiny triggered by an incident or a complaint rather than routine audits, and lower maximum penalties than essential entities.
It is a lighter regime, but not a light one: the core obligations, the risk-management measures and the incident-reporting duty, are the same. The tier changes how closely you are watched and how hard you are penalised, not whether the obligations apply.
Knowing your tier is therefore the difference between preparing for the right level of scrutiny and preparing for the wrong one.
Why guessing wrong is not a defence
There is a tempting shortcut through all of this: conclude you are probably out of scope, and move on. It is worth being clear about what that shortcut costs if it is wrong.
An incorrect conclusion that you are out of scope does not protect you from supervisory action if an authority later reaches a different view.
NIS2 places the obligation to self-identify on the entity, which means the risk of getting it wrong sits with you, not with the regulator who failed to tell you. A firm that decided it was out of scope, and was mistaken, does not get to point at the absence of a letter from the authority as its defence.
That is why the self-assessment deserves to be done properly rather than assumed. The three tests are not onerous - sector, size-including-the-group, and tier, and running them deliberately is far cheaper than discovering, during an incident, that you were in scope all along and had prepared for none of it.
Where this leaves a mid-market firm
If you make a product or run a digital service, do not assume NIS2 passes you by. Run the three tests: check both annexes against what you actually do; calculate your size with the linked and partner enterprises included, not just the standalone entity; and, if you are in, establish whether you are essential or important so you prepare for the right level of supervision.
The firms that handle NIS2 badly are rarely the ones that tried and fell short. They are the ones that never established they were in scope - and a scope question answered by assumption rather than assessment is the one most likely to be answered wrong.
Frequently asked questions
Is my mid-market company in scope for NIS2?
Montro's position is that many mid-market manufacturers and digital-service providers are, even if they do not consider themselves critical infrastructure. Scope turns on three things: whether your sector appears on NIS2's annexes (Annex II covers manufacturing of certain products, digital providers, and more); whether you meet the size threshold once linked and partner enterprises are counted; and, if so, which tier you fall into.
A sector-and-size match usually means you are in scope, whatever your self-image.
Does NIS2 apply to manufacturers?
It applies to manufacturers of certain product categories listed in Annex II, provided they also meet the size threshold.
So "are we a manufacturer" is not the whole question, it is "do we manufacture in a covered category, and are we large enough once our group is counted." Many mid-market manufacturers meet both conditions without having realised it.
How is the NIS2 size threshold calculated?
NIS2 broadly applies from medium-sized enterprises upward, but the size calculation is not limited to the single legal entity. It can include linked and partner enterprises - parents, subsidiaries and significant shareholdings - following the EU's SME-definition methodology.
This is why an entity that looks small on its own can be in scope once the wider group is included, and it is the step mid-market firms most often get wrong.
What happens if we wrongly decide we are out of scope?
It offers no protection. An incorrect out-of-scope determination does not shield an entity from supervisory action if an authority later concludes it was in scope.
NIS2 puts the duty to self-identify on the entity, so the consequences of a wrong call fall on the firm, not the regulator. This is why a deliberate self-assessment - rather than an assumption, is worth the effort: the downside of guessing wrong is borne entirely by you.
