NIS2 Article 26: Jurisdiction and territoriality

What this article means in practice

Written by Engage Compliance. The text above is the article itself, reproduced from its official source and unchanged. Everything in this section is ours, and last read against the current text on 2026-09-07.

Article 26 decides which Member State has jurisdiction over you, and paragraph 3 is where the representative comes in: a digital-infrastructure or digital-provider entity not established in the Union but offering services in it designates a representative there, and that designation is what fixes its jurisdiction. Without one, any Member State where you provide services can act against you.

Who it binds

• Only the entities listed in Article 26(1)(b): DNS service providers, TLD name registries, domain name registration services, cloud computing providers, data centre providers, content delivery networks, managed service providers, managed security service providers, online marketplaces, online search engines and social networking platforms.
• It does not reach the rest of the Directive's scope. Most NIS2 entities fall under the jurisdiction of the Member State where they are established (Article 26(1)), and the representative duty in Article 26(3) is written only for the point (b) list.
• Providers of public electronic communications networks or services fall under the jurisdiction of each Member State where they provide services (Article 26(1)(a)), with no representative mechanism.
• This is a Directive, so what binds you is your Member State's transposing law rather than this text directly.

What it makes somebody do

• You, the entity. Designate a representative in the Union, established in one of the Member States where the services are offered (Article 26(3)).
• You, the entity. Work out your main establishment first, because Article 26(2) decides it by where cybersecurity risk-management decisions are predominantly taken, then by where cybersecurity operations are carried out, then by headcount. Only if none of those lands in the Union does Article 26(3) engage.
• The representative. Be the point at which jurisdiction attaches. Article 26(3) makes the entity fall under the jurisdiction of the Member State where the representative is established.

What it does not say

• It does not move your liability. Article 26(4) says designating a representative is without prejudice to legal actions which could be initiated against the entity itself.
• Not appointing is worse than appointing, not neutral. Article 26(3) says that in the absence of a designated representative, any Member State in which the entity provides services may take legal action against it for infringement.
• It does not set the obligations. Article 26 is about who has jurisdiction; the cybersecurity risk-management measures are in Article 21 and the reporting duties in Article 23.
• The Article 26(2) main-establishment test is not about where you are incorporated. It turns on where cybersecurity decisions are taken, which for many groups is a different country from the registered office.
• The Article 26(1)(b) list is closed. An entity in NIS2 scope that is not on it does not get a representative route and is dealt with under Article 26(1) instead.

How it sits beside the other mandates

• Article 34 sets the administrative fines, and they are keyed to Articles 21 and 23 rather than to Article 26. So the sanction for not appointing is the broader exposure Article 26(3) creates across every market you serve, rather than a set figure attached to the appointment.
• Several entities on the Article 26(1)(b) list are also providers of intermediary services under the Digital Services Act, so a Digital Services Act Article 13 appointment and a NIS2 one commonly sit together and are separate.
• Because NIS2 is a Directive, two Member States can transpose the same provision differently, and the country in which the representative sits is therefore a decision about which national rules apply to you.