nis2-entity-applicability-check
Use this before any NIS 2 gap work, and again after a merger, a new country, a new service line or a change in headcount or turnover across a threshold. You get two files in a new folder, ./nis2-entity-applicability-check/: a memo saying, entity by entity and country by country, whether NIS 2 applies and why (applicability-memo.md), and a spreadsheet you can open in Excel with the facts behind it, such as headcount, turnover and services (entity-facts.csv). This skill drafts for a human to review and sign; this skill never marks a control effective. The memo is a reasoned first pass for the company's legal owner to confirm, not a legal opinion.
Inputs to gather
Read the group structure, entities and countries, service catalogue, latest accounts, headcount by entity, and contracts that mention NIS 2. Ask the reader, in one message: which legal entities provide which services in which member states, whether any entity is part of a larger group or has partner companies, whether the company is a financial entity, and whether any authority has already contacted it.
Step 1: list entities and activities
Fill the facts spreadsheet (entity-facts.csv) with one row per legal entity: country of establishment, member states where it provides services, activities in plain words, headcount, annual turnover, balance sheet total, ownership links, and the source for each fact. Decide per entity, not per brand or group.
Step 2: test the sector
Compare each activity with the sectors and entity types in Annexes I and II of Directive (EU) 2022/2555, then with the national transposition law of each member state involved, because member states can widen the list. Record the exact annex entry or national provision that matches, or "no match". Record whether each national law is in force, partly in force or pending. Flag borderline activities (software plus managed services) for the legal owner.
Step 3: test size, the way the Directive counts it
Article 2 of the Directive applies to entities that are at least medium-sized under the European Commission definition of micro, small and medium-sized enterprises (Recommendation 2003/361/EC). That definition counts headcount and financial figures and adds data from partner and linked enterprises. The common trap: a small subsidiary of a large group can be large for this test. Record the calculation: entity figures, partner and linked additions, totals and the thresholds compared, each with its source. Note whether the national law adjusts how group data is counted.