Do group companies count toward the NIS2 size?
Yes, by default. NIS2 uses the EU definition of SMEs, which adds the figures of linked and partner companies. Austria, Czechia, Estonia, Germany, Poland and Sweden make an exception for a company whose IT is independent of the group. In Denmark and Italy, the authority decides.
The national exceptions
In the last column: a cloud software company with 35 staff and EUR 5m turnover. Its group has 320 staff and EUR 70m turnover. The company runs its own IT, separate from the group. Checked 2026-11-03.
| Country | Rule | Example result |
|---|---|---|
| Austria | § 25 NISG 2026 Partner and linked company figures are not added when your network and information systems are organisationally, technically and operationally independent. | Out of scope Own figures |
| Czechia | § 7(c) Cybersecurity Act Partner and linked enterprise figures do not count when their technical assets are fully separate from the assets that the entity uses for the regulated service. | Out of scope Own figures |
| Denmark | Explanatory notes to § 4-5 NIS 2 Act The ministry says an entity can fall outside the Act when its partner and linked companies would lift it over the medium-size ceilings but the entity is independent. The test uses the independence of its systems and services. The authority decides. | Check with the authority The authority decides |
| Estonia | § 3(7) KüTS Partner and linked company figures are not added when your systems for the services are independent of the partner or linked company. | Out of scope Own figures |
| Germany | § 28(4) BSIG Partner and linked company figures are not added when your IT systems and processes are independent of the group. | Out of scope Own figures |
| Italy | Art. 3(4) D.Lgs. 138/2024 ACN can leave out partner and linked company figures. It looks at how independent your IT and your services are. The authority decides. Also Art. 3(10) D.Lgs. 138/2024: A group company is in scope at any size when it decides on the security measures of an NIS entity of the group, runs systems that entity depends on, runs its security operations, or provides it ICT or security services. | Check with the authority The authority decides |
| Poland | Art. 5(6)-(7) KSC Act Partner and linked company figures do not count when your information system is independent of the group's systems, or when you do not provide services jointly with the group. | Out of scope Own figures |
| Sweden | MCFFS 2026:1, 3 kap. 1 § A partner or linked enterprise that meets the size test only through its group is out of scope. This needs an independent production environment and a high degree of independence from the group. | Out of scope Own figures |
| Belgium | No exception found in the national law. Group figures count. | Essential entity Group figures |
| Bulgaria | No exception found in the national law. Group figures count. | Essential entity Group figures |
| Croatia | No exception found in the national law. Group figures count. | Essential entity Group figures |
| Cyprus | No exception found in the national law. Group figures count. | Essential entity Group figures |
| Finland | No exception found in the national law. Group figures count. | Essential entity Group figures |
| Greece | No exception found in the national law. Group figures count. | Essential entity Group figures |
| Hungary | No exception found in the national law. Group figures count. | Essential entity Group figures |
| Latvia | No exception found in the national law. Group figures count. | Essential entity Group figures |
| Lithuania | No exception found in the national law. Group figures count. | Essential entity Group figures |
| Luxembourg | No exception found in the national law. Group figures count. | Essential entity Group figures |
| Malta | No exception found in the national law. Group figures count. | Essential entity Group figures |
| Netherlands | No exception found in the national law. Group figures count. | Essential entity Group figures |
| Portugal | No exception found in the national law. Group figures count. | Essential entity Group figures |
| Romania | No exception found in the national law. Group figures count. | Essential entity Group figures |
| Slovakia | No exception found in the national law. Group figures count. | Essential entity Group figures |
| Slovenia | No exception found in the national law. Group figures count. | Essential entity Group figures |
The EU SME rules in short
- Autonomous
- No other company holds 25% or more of you, and you hold less than 25% of any other. Use your own figures.
- Partner
- A holding of 25% or more, without control. Add the partner's staff and financial figures in proportion to the holding.
- Linked
- One company controls the other, for example with a majority of the voting rights. Add 100% of the linked company's figures.
A small subsidiary of a large group is therefore usually large for NIS2.