Does NIS2 apply to companies outside the EU?

NIS2's Extraterritorial Application

Yes, the NIS2 Directive applies to companies outside the EU under specific circumstances. This extraterritorial reach represents a significant expansion of EU cybersecurity regulation beyond its borders, similar to how GDPR affects non-EU organizations.

When NIS2 Applies to Non-EU Companies

Criterion 1: Providing Services Within the EU

A non-EU company falls under NIS2 if it:

• Offers services to customers in EU member states
• Operates digital infrastructure used by EU entities
• Provides critical services accessed from the EU
• Manages systems that could impact EU essential or important entities

Examples of Covered Non-EU Entities

Cloud Service Providers

• US-based cloud providers serving EU customers
• Services: IaaS, PaaS, SaaS offerings
• Applies regardless of where data centers are located

Managed Service Providers

• Global MSPs providing security or IT management to EU clients
• Includes managed security service providers (MSSPs)
• Applies if managing critical infrastructure or systems

Software Vendors

• Companies providing software to critical sectors in the EU
• Especially relevant for cybersecurity, infrastructure, or operational technology software
• SaaS providers serving EU essential or important entities

Online Platforms

• Social networks with users in the EU
• Online marketplaces serving EU customers
• Search engines used by EU residents
• (Note: Size thresholds apply: typically 45M+ monthly active users)

Digital Infrastructure Providers

• DNS service providers
• Content delivery networks (CDNs)
• Other critical internet infrastructure

Criterion 2: Establishment in the EU

A company is considered "established" in the EU if:

Decision-Making Location

• Decisions related to cybersecurity risk management are predominantly taken in the EU
• Cybersecurity operations decisions are made within the EU

Main Establishment

• The establishment with the highest number of employees is in the EU
• Headquarters or operational center is located in an EU member state

Practical Example A US company with:

• Headquarters in New York
• Major development center in Dublin (larger than US office)
• Serves both US and EU customers

This company would be subject to NIS2 because its main establishment (by employee count) is in the EU.

Requirements for Non-EU Companies

1. EU Representative Requirement

Non-EU companies must:

Designate a Representative

• Appoint a legal or natural person established in one of the EU member states where services are offered
• This representative acts as the point of contact for NIS2 compliance

Representative's Responsibilities

• Serve as liaison with competent authorities
• Ensure compliance documentation is available
• Facilitate communications regarding incidents
• Support audits and inspections
• May be held accountable for compliance failures

Not Required to Be

• An employee (can be external counsel or service provider)
• Located in every member state (one EU representative suffices)
• The same representative as used for GDPR compliance (but can be)

2. Compliance Obligations

Non-EU companies must meet the same requirements as EU entities:

Risk Management

• Implement appropriate technical and organizational measures
• Conduct regular risk assessments
• Maintain business continuity plans
• Manage supply chain security

Incident Reporting

• Report significant incidents within NIS2 timelines
• Provide early warning (24 hours)
• Submit incident notification (72 hours)
• Complete final report (one month)

Governance

• Ensure management oversight of cybersecurity
• Provide management training
• Train relevant staff
• Document compliance efforts

Cooperation

• Respond to authority requests
• Participate in information sharing
• Submit to audits when required
• Implement binding instructions

3. Jurisdiction and Enforcement

Which Member State's Laws Apply?

• Generally, the member state where the representative is located
• Or the member state where services are primarily offered
• May vary based on national implementation

Enforcement Authority

• National competent authority of the relevant member state
• Can impose penalties on non-EU entities
• May coordinate with other member states for cross-border issues

Penalties for Non-Compliance

Non-EU companies face the same penalties as EU entities:

Essential Entity Classification

• Fines up to €10 million or 2% of global annual turnover (whichever is higher)
• Non-monetary penalties (compliance orders, audits, service restrictions)

Important Entity Classification

• Fines up to €7 million or 1.4% of global annual turnover (whichever is higher)
• Similar non-monetary consequences

Enforcement Mechanisms

• Penalties can be enforced within the EU
• Asset seizure in EU jurisdictions
• Service blocking or restrictions
• Reputational damage in EU markets

Comparison with GDPR's Extraterritorial Reach

NIS2's approach to non-EU companies is similar to GDPR but with key differences:

Aspect	NIS2	GDPR
Trigger	Providing services to EU	Processing EU residents' data
Representative	Required if outside EU	Required if outside EU
Scope	Critical services/sectors	Data protection
Penalties	€10M/2% or €7M/1.4%	€20M/4%
Focus	Cybersecurity measures	Data privacy

Companies already compliant with GDPR's extraterritorial requirements have a compliance framework they can adapt for NIS2.

Practical Implications for Global Companies

US Companies

Common Scenarios

• Cloud providers (AWS, Azure, Google Cloud) serving EU customers
• SaaS companies with EU clients
• Managed service providers supporting EU operations
• Technology companies with EU offices

Key Considerations

• Determine if services fall under NIS2 sectors
• Assess entity classification (essential vs. important)
• Designate EU representative
• Align with existing EU compliance programs (GDPR, etc.)

UK Companies Post-Brexit

Current Status

• UK is no longer an EU member state
• UK companies serving EU = non-EU companies for NIS2 purposes
• Must comply if providing services to EU

UK's Own Regime

• UK has its own cyber regulations (separate from NIS2)
• Companies may need dual compliance (UK + EU)
• Monitor UK's evolving cybersecurity framework

Asian Companies

Common Scenarios

• Manufacturing equipment providers to EU industries
• Technology companies with EU customers
• E-commerce platforms serving EU consumers
• Cloud or digital infrastructure providers

Key Considerations

• Language barriers for compliance documentation
• Time zone challenges for incident reporting
• Cultural differences in cybersecurity approaches
• Need for EU legal expertise

Supply Chain Implications

Even if your company doesn't directly fall under NIS2, you may be indirectly affected:

Supplier Requirements

EU entities subject to NIS2 must:

• Assess supplier cybersecurity practices
• Include security requirements in contracts
• Monitor supplier compliance
• Report supplier-related incidents

What This Means for Non-EU Suppliers

• May be required to demonstrate NIS2-aligned security measures
• Could face contract requirements mimicking NIS2 obligations
• Might need to participate in security assessments
• May be asked to report incidents affecting EU customers

Competitive Considerations

• NIS2 compliance may become a competitive differentiator
• EU customers may prefer compliant suppliers
• Compliance could be prerequisite for public sector contracts
• May influence vendor selection criteria

Determining Your Obligations

Assessment Questions

1. Do you provide services to EU customers?

   • If yes, proceed to next question
   • If no, NIS2 likely doesn't apply directly

2. Are you in a covered sector?

   • Energy, transport, healthcare, finance, digital infrastructure, etc.
   • Check the 18 sectors listed in NIS2

3. Do you meet size thresholds?

   • Essential: 250+ employees or €50M+ turnover
   • Important: 50+ employees or €10M+ turnover

4. Is your EU presence substantial?

   • Do you have offices in the EU?
   • Where are decisions made?
   • Where is your largest establishment?

5. Are you a critical service provider?

   • Do you provide infrastructure, cloud, or critical services?
   • Are your services essential to EU operations?

Getting Definitive Answers

Consult with Experts

• EU legal counsel specializing in cybersecurity regulation
• Compliance consultants with NIS2 expertise
• Industry associations for sector-specific guidance

Contact National Authorities

• Reach out to relevant national competent authority
• Request guidance on applicability
• Understand specific requirements

Review Member State Implementation

• Check transposition in relevant member states
• Identify any national variations
• Understand registration requirements

Compliance Strategies for Non-EU Companies

Option 1: Full Compliance

When Appropriate

• Significant EU business
• Critical services to EU entities
• Long-term EU market commitment

Implementation

• Appoint EU representative
• Implement NIS2 requirements
• Establish EU-specific incident reporting
• Train staff on EU obligations

Option 2: Regional Adaptation

When Appropriate

• Services offered globally with EU subset
• Different risk profiles by region
• Existing regional compliance structures

Implementation

• Create EU-specific compliance program
• Segment systems/processes for EU customers
• Maintain regional documentation
• Coordinate global and regional requirements

Option 3: Withdrawal from EU Market

When Appropriate

• Minimal EU revenue
• High compliance costs relative to EU business
• Strategic decision to focus on other markets

Considerations

• Impact on existing EU customers
• Competitive implications
• Future market entry barriers
• Reputational effects

Integration with Existing Compliance Programs

Leverage Existing Frameworks

ISO 27001

• Many NIS2 requirements align with ISO 27001 controls
• Can use certification as evidence of good practices
• Reduces duplication of effort

SOC 2

• Demonstrates security controls
• Useful for cloud and service providers
• Accepted by many EU customers

NIST Cybersecurity Framework

• Widely recognized approach to risk management
• Can map to NIS2 requirements
• Familiar to many US companies

Harmonize with GDPR

If already GDPR-compliant:

• Use existing representative structure
• Align incident reporting procedures
• Leverage data protection impact assessments
• Integrate security measures

Future Developments

Monitor Evolving Guidance

EU-Level Guidance

• European Commission implementing acts
• ENISA (European Union Agency for Cybersecurity) guidance documents
• Cross-border cooperation frameworks

National Implementation

• Member state transposition variations
• National authority guidance
• Sector-specific requirements

Anticipate Enforcement Trends

Initial Focus

• Registration and basic compliance
• Incident reporting adherence
• Management training verification

Future Priorities

• Advanced technical measures
• Supply chain security depth
• Cross-border coordination effectiveness

NIS2's extraterritorial reach means that many non-EU companies must comply with EU cybersecurity requirements when serving the European market. This represents a significant compliance obligation but also demonstrates the EU's commitment to securing its critical infrastructure and services.

For non-EU companies, the key is to assess whether NIS2 applies to your operations, understand the specific requirements, and implement an appropriate compliance strategy. Early action allows you to integrate NIS2 requirements into existing security programs, designate representatives, and prepare for enforcement.

The extraterritorial application of NIS2 reflects a global trend toward more stringent cybersecurity regulation. Companies operating internationally should expect similar requirements to emerge in other jurisdictions, making robust cybersecurity practices not just a compliance necessity but a business imperative.