Do I Need a NIS2 Representative? Article 26(3)

The rule

NIS2 is Directive (EU) 2022/2555. Article 26(3) says that if an entity in the Article 26(1)(b) list "is not established in the Union, but offers services within the Union, it shall designate a representative in the Union". The representative has to be established in one of the Member States where you offer services, and you then fall under the jurisdiction of that Member State.

The duty is in Article 26(3). It is not Article 27, which is a different provision, though some providers cite it.

Who needs one

Your company needs a NIS2 representative when all of these are true:

It is not established in the EU. If your only European office is in Norway, Iceland or Liechtenstein, you still count as not established in the EU. Those countries are in the EEA but not the EU, and NIS2 only counts an establishment in the EU.
It offers services in the EU.
It is one of the providers in Article 26(1)(b): DNS service providers, TLD name registries, entities providing domain name registration services, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, and providers of online marketplaces, online search engines or social networking services platforms.
It meets the NIS2 size test. Broadly, NIS2 applies to medium-sized companies and larger: 50 staff or more, or turnover and balance sheet above the EU limits for a small company. DNS service providers, TLD name registries and entities providing domain name registration services are in scope whatever their size (Article 2(2) and Article 2(4)).

The test is what you do, not your sector label. A software company whose product is not on that list owes nothing. If the same company also runs a cloud platform, a managed service or a managed security service for customers in the EU, that part of the business is on the list, and the company needs a representative.

Who does not need one

Companies established in the EU. They fall under the Member State where they are established.
Non-EU companies outside the Article 26(1)(b) list. That covers energy, transport, health, water, manufacturing, food and postal businesses. They can be in scope for NIS2 and still owe no representative.
Providers of public electronic communications networks or services, and trust service providers. Both are in scope for NIS2, but neither is on the Article 26(1)(b) list, so Article 26(3) does not apply to them.
Companies below the size test, unless one of the cases in Article 2(2) or 2(3) catches them whatever their size, such as DNS, TLD registry or domain name registration services.

What happens if you do not appoint one

There is no specific fine for failing to designate. Article 26(3) says that without a representative, any Member State where you provide services may take legal action against you for infringing the Directive. The NIS2 fines in Article 34 are tied to the risk-management and incident-reporting duties in Articles 21 and 23, not to the designation, and each Member State also sets its own penalties under Article 36.

Appointing a representative also settles which single national authority you answer to: the one in the Member State where the representative is established.

NIS2 is a Directive, so the binding duty sits in each Member State's national law, and transposition has not moved at the same pace everywhere. Check the national law of the Member States where you offer services.

What it costs

The NIS2 representative appointment is €2,000 a year at the smallest band, for a company with 1 to 10 people, under €2m revenue, and under 5,000 people in the EU and UK whose data you hold. At the three larger bands it is €2,873, €6,655 and €13,055 a year. That is the price when paid yearly, with no setup fee, and quarterly and monthly payment cost about 5% and 15% more. Whichever of headcount, revenue or the number of people whose data you hold puts you highest sets the band.

Every band, and what the appointment includes, is on our NIS2 representative page, where you can appoint online with no sales call.

Check what you need

The same company can be caught by NIS2 and by the GDPR at once. Our free representative checker asks a few short questions and tells you whether you need an EU, UK or Swiss representative under the GDPR, the UK GDPR or the Swiss FADP, and what each would cost. Read it alongside the NIS2 test above.

Sources and references

Check which representatives you need

Book a free intro call Start representative sign-up

FAQ

Frequently asked questions

Which NIS2 article requires a representative?

Article 26(3) of Directive (EU) 2022/2555. A non-EU entity on the Article 26(1)(b) list that offers services in the EU has to designate a representative established in one of the Member States where it offers those services.

Does a SaaS company outside the EU need a NIS2 representative?

Only if part of what it offers in the EU is on the Article 26(1)(b) list, for example a cloud computing service, a managed service or a managed security service, and it meets the size test. A software business outside that list owes no NIS2 representative.

Does an office in Norway count as being established in the EU for NIS2?

No. Norway, Iceland and Liechtenstein are in the EEA but not the EU, and NIS2 only counts an establishment in the EU. A company whose only European office is in one of them still needs a representative if it is on the Article 26(1)(b) list.

Is there a fine for not appointing a NIS2 representative?

Not a specific one. Without a representative, any Member State where you provide services can take legal action against you. The Article 34 fines apply to the risk-management and incident-reporting duties, and each Member State sets its own penalties under Article 36.

Does the NIS2 representative decide which regulator we deal with?

Yes. Under Article 26(3) you fall under the jurisdiction of the Member State where your representative is established, so you deal with one national authority.