NIS2 jurisdiction: which Member State supervises you, and how the main establishment rule works

NIS2 jurisdiction follows a default in Article 26: you are supervised by the Member State where you are established. Three exceptions apply. Public telecoms providers answer to each Member State they serve. Cloud, data centre, DNS, managed service and platform providers answer to the Member State of their main establishment. Public administration answers to the Member State that established it.

This guide covers the general rule, the three exceptions, the main establishment test, managed service providers, non-EU providers, mutual assistance, groups in several countries, and a checklist.

Type of entity	Member State with jurisdiction	NIS2
Most essential and important entities	Each Member State where the entity is established	Art. 26(1)
Public electronic communications networks and services	Each Member State where it provides its services	Art. 26(1)(a)
DNS, TLD registries, domain registration, cloud, data centre, CDN, MSP, MSSP, online marketplaces, search engines, social networks	One: the Member State of the main establishment in the EU	Art. 26(1)(b), 26(2)
Public administration entities	The Member State that established them	Art. 26(1)(c)
Those digital providers, if not established in the EU	Where their EU representative is established	Art. 26(3)

Which Member State has jurisdiction under NIS2?

Article 26(1): entities in scope “shall be considered to fall under the jurisdiction of the Member State in which they are established”. For most companies that ends the analysis.

Recital 114 says establishment “implies the effective exercise of activity through stable arrangements”; whether through a branch or a subsidiary, the legal form is not the determining factor. It does not depend on where the network and information systems are physically located: a server room abroad does not by itself move your jurisdiction.

An entity is a person created and recognised under the national law of its place of establishment (Article 6(38)), so each subsidiary is its own entity. Where one entity is established or provides services in more than one Member State, recital 113 says it “should fall under the separate and concurrent jurisdiction of each of those Member States”.

For a manufacturer, the largest plant decides nothing: there is no “main production facility” test. The main establishment rule applies only to the digital providers in Article 26(1)(b).

What are the three exceptions?

Public electronic communications providers

Providers of public electronic communications networks or publicly available electronic communications services fall under the jurisdiction of each Member State “in which they provide their services” (Article 26(1)(a)). A mobile operator active in three countries answers to three authorities.

Digital infrastructure and digital providers

DNS service providers, TLD name registries, domain name registration services, cloud computing, data centre and content delivery network providers, managed service providers, managed security service providers, and online marketplaces, search engines and social networking platforms fall under the Member State of their main establishment in the Union (Article 26(1)(b)). Recital 114 gives the reason: their services are cross-border by nature, so “only one Member State should have jurisdiction”. The sector detail is in NIS2 for cloud, data centres and digital infrastructure.

Public administration

Public administration entities fall under the jurisdiction of the Member State that established them (Article 26(1)(c)), wherever they operate.

How is the main establishment determined?

Article 26(2) sets three tests, applied in order:

1. The Member State where “the decisions related to the cybersecurity risk-management measures are predominantly taken”.
2. If that cannot be determined, or those decisions are not taken in the Union: the Member State where cybersecurity operations are carried out.
3. If that cannot be determined either: the Member State where the entity has the establishment with the highest number of employees in the Union.

The first test is about substance, not the registered office. In practice, look at who approves the Article 21 measures, where the security lead sits and where the budget is decided. Article 20 requires the management body to approve those measures, so its minutes are the first evidence. The second test matters when a parent outside the EU decides.

Where are managed service providers supervised under NIS2?

In one Member State. MSPs and MSSPs are in Annex I (ICT service management, business-to-business) and follow the main establishment rule in Article 26(1)(b), wherever their customers are. Whether you are in scope, what applies and the incident thresholds for managed services are in NIS2 for MSPs and MSSPs.

These providers also feed ENISA’s EU-wide registry (Article 27), including their main and other EU establishments or representative and the Member States they serve. The first deadline was 17 January 2025; changes are due within three months.

What if a provider is not established in the EU?

A provider of a type listed in Article 26(1)(b) that is not established in the Union but offers services there “shall designate a representative in the Union” (Article 26(3)). The representative must be established in one of the Member States where the services are offered, and that Member State has jurisdiction. Authorities and CSIRTs may address the representative in place of the entity itself (Article 6(34)).

Without a representative, any Member State in which the entity provides services may take legal action against it for infringing the directive. Designating one does not shield the entity: legal actions against the entity itself remain possible (Article 26(4)).

Offering services means intent, not reach. Under recital 116, a website merely accessible in the Union is not enough; a Member State’s language or currency with ordering in that language is an indicator.

The Commission’s proposal of 20 January 2026, COM(2026) 13, would extend the representative duty to every essential or important entity not established in the EU. It would also place air carriers under the Member State whose licensing authority granted their operating licence. Both are proposals, not law.

Can another Member State still supervise you?

Yes, through cooperation. Where an entity provides services in several Member States, or has its systems in one and serves another, Article 37 requires the authorities to cooperate. At a minimum:

1. an authority taking supervisory or enforcement measures informs and consults the others, via the single point of contact;
2. an authority may request another to take supervisory or enforcement measures;
3. on a substantiated request, an authority provides mutual assistance proportionate to its resources, including information requests, inspections and targeted security audits.

Refusal is allowed only on narrow grounds, such as lack of competence or national security. Joint supervisory actions are possible by common agreement (Article 37(2)).

For the digital providers, Article 26(5) goes further. A Member State that receives a mutual assistance request may, within the limits of that request, take supervisory and enforcement measures against a provider that offers services or has a network and information system on its territory. Recital 113 adds that Member States should not impose enforcement measures or penalties more than once for the same conduct.

Incident reports go to the CSIRT or competent authority of the Member State with jurisdiction (Article 23(1)). Where an incident concerns two or more Member States, that body informs the others and ENISA where appropriate (Article 23(6)).

How does NIS2 jurisdiction work for groups in several countries?

NIS2 does not provide for group-level registration. Scope and jurisdiction are assessed entity by entity, with one nuance: for the digital providers in Article 26(1)(b), recital 114 says that where a group of undertakings carries out the services, the controlling undertaking’s main establishment is the group’s main establishment. Size counts the group: under Recommendation 2003/361/EC, data of linked and partner enterprises are aggregated, so a 40-person subsidiary of a large group is usually not small. See the NIS2 scope guide.

Four examples, using Member States A, B and C:

• Machinery manufacturer. Parent in A, subsidiary in B, sales branch of the parent in C. The parent registers in A, the subsidiary in B. The branch is a stable arrangement of the parent, so recital 113 points to concurrent jurisdiction of C too. Check C’s registration rules.
• Managed service provider, one company, offices in A, B and C. The board in A approves security policy, the security operations team sits in B, most staff are in C. The main establishment is A, which supervises. B and C can act on a mutual assistance request.
• Telecoms operator serving A, B and C. All three have jurisdiction.
• Cloud provider outside the EU, selling in A’s language and currency. It must designate a representative in a Member State where it offers services. Until it does, each of them may act.

National laws restate these rules: see NIS2 in Germany and NIS2 in Belgium.

Transposition is uneven. On 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify transposition measures. If one of your entities is established there, check the current status on the Commission’s transposition page and with the national authority.

What Article 26 leaves open, and how to close it

Article 26 turns on facts it does not tell you how to prove: “predominantly taken” has no definition. A group that runs one security programme still has to show each authority that its own entity approved and implemented the measures, because Article 20 places that duty on each entity’s management body.

A sensible approach is one jurisdiction record per legal entity, reviewed whenever the organisation changes:

NIS2 JURISDICTION RECORD (one per legal entity)

Entity name and registration number:
Member State of incorporation:
Other establishments (branches, offices), by Member State:
Member States where services are provided:
Annex I or II sector, subsector and entity type:
Size, incl. linked and partner enterprises:
Essential or important:
Rule applied:  [ ] 26(1)    establishment
               [ ] 26(1)(a) where services are provided
               [ ] 26(1)(b) main establishment
               [ ] 26(1)(c) public administration
               [ ] 26(3)    EU representative
Main establishment test (26(1)(b) only):
  1. Where Art. 21 decisions are predominantly taken:
     Evidence (board minutes, approvals, roles):
  2. Where cybersecurity operations are carried out:
  3. Establishment with most EU employees:
Competent authority and CSIRT, per Member State:
Registration reference and date, per Member State:
Owner and next review date:

The harder part is the evidence. In practice, tag each control and evidence item with the entity and country it covers, so one programme answers each authority. The CloudSoul platform collects that evidence continuously from the systems, with a person reviewing the exceptions. If you are not yet sure which entities are in scope, start with the NIS2 checker. The wider programme is on the NIS2 compliance page.

NIS2 jurisdiction checklist

• List every legal entity in the group, its establishments and where it provides services.
• Assess scope per entity, counting linked and partner enterprises for size.
• Record which Article 26 rule applies to each entity and why.
• For digital providers, document the main establishment test with board minutes and roles.
• Register each entity with its authority; non-EU listed providers designate a representative.
• Name the CSIRT for each jurisdiction in your incident procedure.
• Review the record after any reorganisation, acquisition or move of the security team.

Sources

• Directive (EU) 2022/2555 (NIS2), Articles 3, 6, 20, 23, 26, 27 and 37 and recitals 113 to 116, EUR-Lex.
• Commission Recommendation 2003/361/EC on the definition of micro, small and medium-sized enterprises, EUR-Lex.
• Proposal for a Directive amending Directive (EU) 2022/2555, COM(2026) 13, 20 January 2026, EUR-Lex.
• European Commission, referral of Ireland, Spain, France and the Netherlands to the Court of Justice, 8 July 2026, Digital Strategy.
• European Commission, NIS2 transposition in EU countries, Digital Strategy.

Frequently asked questions