NIS2 for European SMBs: are you in scope, and which licence do you need?
Here you'll find a 2-minute self-check, three guides and a complete mapping of Article 21 to Microsoft 365.
NIS2 entered into force on 16 January 2023, and member states had until 17 October 2024 to transpose it into national law. Several missed that deadline, so the date your obligations actually started depends on your country. (Directive (EU) 2022/2555, Art. 41) In Denmark, for example, the law took effect on 1 July 2025 with a registration deadline of 1 October 2025. (Danish Agency for Societal Security) Fines can reach EUR 10M or 2% of global turnover for essential entities, and EUR 7M or 1.4% for important entities. (NIS2 Directive, Art. 34)
Last updated 19 September 2026
Interactive tool
Get the answer in 2 minutes
Answer 6 questions about your sector, size, supply chain, and current security. Get a concrete verdict on whether you're an essential entity, important entity, indirectly affected, or out of scope, plus a licence recommendation. We don't store any answers.
Start the NIS2 self-checkOur NIS2 guides
Three guides and a complete mapping of Article 21 to Microsoft 365. Read them in whatever order suits you.
Guide · 6 min read
Is your company in scope of NIS2? How to find out
Decision tree for European SMBs: sector, size, and supply chain exceptions. Find out whether you're essential, important, or out of scope.
Read guide
Comparison · 8 min read
Which Microsoft 365 licence meets NIS2? Decision matrix for SMBs
Concrete comparison of Business Basic, Standard, Premium, E3, and E5 against the NIS2 Article 21 requirements. Find out what each licence covers, and where you need to upgrade.
Read guide
Guide · 10 min read
NIS2 Article 21 explained, the 10 risk management requirements for SMBs
The 10 controls in NIS2 Article 21(2) translated into SMB language. With concrete examples of what you need to implement and document.
Read guide
Whitepaper · 24 pages
Get the full Article 21 → Microsoft 365 mapping
A 24-page whitepaper that maps each of the 10 Article 21 requirements to concrete Microsoft 365 features, licence tiers, configuration steps, and audit evidence. All 10 controls are open, no sign-up.
Read mapping
Other resources
Note: Guidance only, not legal advice. Always consult your own legal counsel and a certified Microsoft partner before making compliance decisions.