NIS2 for managed service providers: who is actually in scope, and what Article 21 requires

A managed service provider is not automatically inside NIS2. Directive (EU) 2022/2555 lists ICT service management in Annex I, Article 2(1) applies a size cap to that listing, and the Article 2(2) list that removes the cap does not name managed service providers. This runbook derives the scoping decision, the Article 21(2) controls, the Article 23 clock and the registration duties from the clauses.

Prerequisites

Each maps to a clause the determination depends on.

• Staff headcount, turnover and balance-sheet total for the last closed financial year, consolidated per the linked and partner enterprise rules in Recommendation 2003/361/EC.
• The Annex entity type you match. Managed service providers and managed security service providers sit in Annex I under ICT service management, business-to-business.
• The transposing act of the member state where risk-management decisions are predominantly taken. Malta transposed through Subsidiary Legislation 460.41.
• Any written identification under Article 2(2), points (b) to (e), the range Article 3(1)(e) and Article 3(2) fix as the identification route.
• Union-wide user counts per managed service, which two of the four MSP reporting thresholds in Implementing Regulation (EU) 2024/2690 are expressed against.
• The management-body member who will approve the measures under Article 20(1), by name.

The scope test lives in two instruments

Article 2(1) applies the Directive to Annex I and Annex II entity types that qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or that exceed the medium-sized ceilings. The size test therefore sits outside NIS2. Per the Commission's SME definition guidance, an enterprise is small when it employs fewer than 50 persons and its turnover and/or balance-sheet total does not exceed EUR 10 million.

Article 2(2) disapplies the size cap, and it is a closed list. Points (b) to (e) cover sole providers of a service essential to critical societal or economic activities, entities whose disruption could significantly affect public safety, security or health, entities capable of inducing significant systemic risk, and entities critical at national or regional level. Point (f) is public administration entities, a category rather than a designation power an authority can apply to a provider. Managed service providers appear nowhere in the list, so a sub-threshold MSP enters scope only where a member state identifies it under points (b) to (e), the range Article 3(1)(e) and Article 3(2) both fix.

Classification follows Article 3. Annex I entities exceeding the medium-sized ceilings, meaning 250 staff or more, or turnover above EUR 50 million with a balance sheet above EUR 43 million, are essential under Article 3(1)(a). Article 3(2) makes every other in-scope entity important, which changes the supervisory regime and the fine ceiling.

The scoping check

This encodes the two instruments and nothing else. Every duty is gated on the scope line, so an out-of-scope run reports nothing owed.

param(
  [Parameter(Mandatory)][int]    $StaffHeadcount,
  [Parameter(Mandatory)][double] $TurnoverEur,
  [Parameter(Mandatory)][double] $BalanceSheetEur,
  [ValidateSet('AnnexI','AnnexII','NotListed')][string] $AnnexListing = 'AnnexI',
  [switch] $IdentifiedUnderArticle2Para2
)

# Recommendation 2003/361/EC, Annex Art. 2: SMALL is fewer than 50 persons AND
# turnover and/or balance sheet at or below EUR 10 million.
$isSmallOrMicro = ($StaffHeadcount -lt 50) -and
                  (($TurnoverEur -le 10e6) -or ($BalanceSheetEur -le 10e6))

# Same Article: EXCEEDS the medium ceilings at 250+ persons, OR turnover above
# EUR 50 million AND balance sheet above EUR 43 million.
$exceedsMediumCeilings = ($StaffHeadcount -ge 250) -or
                         (($TurnoverEur -gt 50e6) -and ($BalanceSheetEur -gt 43e6))

if ($AnnexListing -eq 'NotListed') {
  $scope = 'OUT: not an entity type listed in Annex I or Annex II'
} elseif ($IdentifiedUnderArticle2Para2) {
  $scope = 'IN: size cap disapplied by Art. 2(2)(b)-(e), per Art. 3(1)(e)'
} elseif ($isSmallOrMicro) {
  $scope = 'OUT of Art. 2(1): below the size cap, no Art. 2(2) trigger recorded'
} else {
  $scope = 'IN: Art. 2(1) default scope'
}

# Gated on scope: a sub-threshold provider owes neither the Art. 3(4) listing
# nor the Art. 27(2) submission.
if ($scope -notlike 'IN*') {
  $class        = 'n/a'
  $ceiling      = 'n/a'
  $supervision  = 'n/a'
  $registry     = 'n/a'
  $jurisdiction = 'n/a'
} else {
  $registry     = 'Art. 3(4) national list + Art. 27(2) registry: name, sector, addresses, contacts, member states served, IP ranges'
  $jurisdiction = 'Art. 26(1)(b): member state of main establishment, determined under Art. 26(2)'
  if ($AnnexListing -eq 'AnnexI' -and $exceedsMediumCeilings) {
    $class       = 'ESSENTIAL (Art. 3(1)(a))'
    $ceiling     = 'Art. 34(4): at least EUR 10 000 000 or 2% of the worldwide annual turnover of the undertaking the entity belongs to, whichever is higher'
    $supervision = 'Art. 32: ex ante and ex post, incl. Art. 32(5) suspension and management-prohibition powers'
  } else {
    $class       = 'IMPORTANT (Art. 3(2))'
    $ceiling     = 'Art. 34(5): at least EUR 7 000 000 or 1,4% of the worldwide annual turnover of the undertaking the entity belongs to, whichever is higher'
    $supervision = 'Art. 33: ex post only, no management-prohibition power'
  }
}

[pscustomobject]@{
  Scope           = $scope
  Classification  = $class
  MaxFineCeiling  = $ceiling
  SupervisionMode = $supervision
  RegistryDuty    = $registry
  Jurisdiction    = $jurisdiction
} | Format-List | Out-String -Width 96

Expected output

Two worked examples on hypothetical figures. First, a 62-person provider, EUR 8.4 million turnover, EUR 3.1 million balance sheet.

Scope           : IN: Art. 2(1) default scope
Classification  : IMPORTANT (Art. 3(2))
MaxFineCeiling  : Art. 34(5): at least EUR 7 000 000 or 1,4% of the worldwide annual turnover
                  of the undertaking the entity belongs to, whichever is higher
SupervisionMode : Art. 33: ex post only, no management-prohibition power
RegistryDuty    : Art. 3(4) national list + Art. 27(2) registry: name, sector, addresses,
                  contacts, member states served, IP ranges
Jurisdiction    : Art. 26(1)(b): member state of main establishment, determined under Art. 26(2)

The second changes only size: 38 staff, EUR 11.2 million turnover, EUR 4.9 million balance sheet. The small test holds, so every downstream duty reports n/a.

Scope           : OUT of Art. 2(1): below the size cap, no Art. 2(2) trigger recorded
Classification  : n/a
MaxFineCeiling  : n/a
SupervisionMode : n/a
RegistryDuty    : n/a
Jurisdiction    : n/a

Article 21(2), and where the technical detail lives

Article 21(2) lists ten measures as a minimum, and for managed service providers the detail is not left to national guidance. Commission Implementing Regulation (EU) 2024/2690, applicable since 7 November 2024, covers points (a) to (j) in full under its Article 2(1), and its Annex expands those ten letters into thirteen numbered points.

Annex point 13, environmental and physical security, has no dedicated letter of its own. The Annex maps it to points (c), (e) and (i) at once, which is why a mapping built one letter at a time tends to lose it. Point 9 is why a bare "TLS 1.2 and above" line fails review: the Annex asks for a cryptography policy with defined algorithms, key lengths and a review cadence, and NIST SP 800-52 Rev. 2 is a usable basis for the TLS part.

Points 11 and 11.7 are where a Microsoft 365 estate carries most of its evidence: administrative role coverage, phishing-resistant methods for privileged accounts, just-in-time elevation. The M365 Security Scorecard reads that configuration against a control baseline, and Microsoft 365 tenant hardening covers remediation.

The reporting clock, and what counts as significant

Article 23(1) requires notification of any incident with a significant impact on the service, and separately requires informing recipients where it may adversely affect them. Article 23(4) sets the sequence.

Article 3(1) of CIR (EU) 2024/2690 makes an incident significant where, among other criteria, direct financial loss exceeds EUR 500 000 or 5% of the entity's total annual turnover in the preceding financial year, whichever is lower. Article 3(2) excludes scheduled interruptions and planned maintenance.

Article 10 adds four criteria specific to managed service providers and managed security service providers. Point (a) is complete unavailability for more than 30 minutes. Point (b) is limited availability for more than one hour affecting the smaller of 5% of the service's Union users or one million users. Point (c) is a compromise of the integrity, confidentiality or authenticity of service data as a result of a suspectedly malicious action. Point (d) is the same compromise affecting the smaller of 5% of Union users or one million users.

Supervision, jurisdiction and personal exposure

Supervision and enforcement sit with the national competent authorities designated under Article 8, exercising the powers in Articles 31 to 34. ENISA has no supervisory or enforcement power and cannot impose a fine: its Regulation (EU) 2019/881 mandate covers the Article 12 vulnerability database, the Article 27 registry and technical guidance.

Managed service providers and managed security service providers fall under the jurisdiction of their main establishment in the Union, per Article 26(1)(b). Article 26(2) fixes that establishment as the member state where risk-management decisions are predominantly taken, failing that where cybersecurity operations are carried out, failing that the member state holding the establishment with the highest number of employees in the Union.

Article 20(1) requires management bodies to approve the measures and oversee implementation, and provides that they can be held liable for infringements of Article 21. Article 20(2) requires them to follow training. Article 32(5) carries the operative power over individuals: where earlier enforcement fails, the competent authority may suspend a certification or authorisation and request a prohibition on a natural person at chief executive or legal representative level exercising managerial functions. That power sits in the essential-entity regime, and Article 33, governing important entities, carries no equivalent.

The Article 34 ceilings the script prints are measured against the turnover of the undertaking the entity belongs to, not the entity alone. They are ceilings member states must make available. Article 34 sets no tariff and records no observed outcome.

Side effects

A positive determination starts two registrations. Article 3(3) required member states to establish a national list of essential and important entities by 17 April 2025, and Article 3(4) requires listed entities to submit name, address and contact details including IP ranges, sector and subsector, and the member states served. Article 27(2) separately requires MSPs and MSSPs to submit a comparable set, against a deadline of 17 January 2025 that has passed. Article 27(5) lets that data travel through the national Article 3(4) mechanism where one exists, merging the route while both duties remain.

Alongside those come the Article 20 approval and training duties on named individuals, the Article 23 notification machinery with an on-call path fast enough for 24 hours, and the Article 21(2)(d) supply-chain obligations customers will push into contracts.

A negative determination has its own effect. Customers inside scope must manage security in their supplier relationships under Article 21(2)(d), so a provider outside scope is still asked to evidence the same controls contractually. Being out of scope removes the regulator, not the questionnaire.

Rollback

A legal classification is corrected, never rolled back. Version the determination with the exact inputs and clause references that produced it, so a later change is a diff rather than an argument. Where an Article 3(4) or Article 27(2) submission was made in error, correct it in writing with the same competent authority and keep that correspondence with the determination.

Limitations

This runbook determines scope and classification from the Directive text and the directly applicable Implementing Regulation. Obligations bind through national transposing law: member states may add stricter requirements, identify sub-threshold entities under Article 2(2), points (b) to (e), and set procedural detail the Directive leaves open. Transposition is incomplete. On 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify transposition measures.

The script handles the ordinary case only. It does not model the linked and partner enterprise aggregation in Recommendation 2003/361/EC, which can push a small subsidiary above the ceilings through its owners, and it does not handle entities matching several Annex types. It says nothing about Articles 5 to 9 and 11 to 14 of CIR 2024/2690, which cover other digital-provider types. None of this is legal advice. A determination close to a threshold, or turning on group structure, needs a lawyer qualified in the relevant member state.

Last verified 2026-07-28. Article and Annex references checked against Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690 on EUR-Lex, size thresholds against the Commission's SME definition guidance, transposition status against the Commission's NIS2 policy page. The PowerShell block was executed on PowerShell 7.6.4 with both input sets, and each expected-output block is the emitted text with trailing spaces stripped.