{
  "version": "2026-08-03",
  "licence": "CC BY 4.0",
  "note": "Regime metadata, primary sources and the question set behind the pk-sharma.com regulatory scope checker. Verdict logic is not included: it is code, not data. Every regime links its primary source so you can check the position yourself. NIS2 is a Directive, so the binding text is your Member State's transposing law.",
  "lastReviewed": "2026-08-03",
  "regimes": [
    {
      "id": "nis2",
      "name": "NIS2",
      "citation": "Directive (EU) 2022/2555",
      "summary": "The EU's baseline cybersecurity regime for essential and important entities.",
      "status": "In force since 16 January 2023 and applicable from 18 October 2024. It is a Directive, so the obligations that bind you come from your Member State's transposing law, which varies in thresholds, sector scoping and penalties.",
      "sources": [
        {
          "label": "Directive (EU) 2022/2555, Official Journal L 333, 27.12.2022",
          "url": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng"
        }
      ]
    },
    {
      "id": "dora",
      "name": "DORA",
      "citation": "Regulation (EU) 2022/2554",
      "summary": "Digital operational resilience for the EU financial sector, including direct oversight of critical IT providers.",
      "status": "In force since 16 January 2023 and applicable since 17 January 2025. Being a Regulation it is directly applicable, with no transposition step.",
      "sources": [
        {
          "label": "Regulation (EU) 2022/2554, Official Journal L 333, 27.12.2022",
          "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng"
        }
      ]
    },
    {
      "id": "uk-csr",
      "name": "UK Cyber Security and Resilience Bill",
      "citation": "Bill 4035, HL Bill 32",
      "summary": "The UK's update to the NIS Regulations 2018, adding data centres, managed service providers and designated critical suppliers.",
      "status": "NOT YET LAW. The Bill is in the House of Lords and has not received Royal Assent. Lords committee stage begins 1 September 2026, and the scope below may change there. The Bill contains no commencement date for its substantive provisions: they come into force on a day the Secretary of State appoints by regulations.",
      "sources": [
        {
          "label": "Cyber Security and Resilience (Network and Information Systems) Bill, UK Parliament",
          "url": "https://bills.parliament.uk/bills/4035"
        }
      ]
    }
  ],
  "questions": [
    {
      "id": "establishment",
      "kind": "single",
      "label": "Where is your organisation established?",
      "help": "Establishment is what anchors jurisdiction under NIS2 and DORA, so this determines most of what follows.",
      "unit": null,
      "conditional": false,
      "options": [
        {
          "value": "uk",
          "label": "United Kingdom only"
        },
        {
          "value": "eu",
          "label": "In one or more EU Member States"
        },
        {
          "value": "both",
          "label": "Both the UK and the EU"
        },
        {
          "value": "other",
          "label": "Neither, elsewhere"
        }
      ]
    },
    {
      "id": "eu-services",
      "kind": "boolean",
      "label": "Do you offer services into the EU?",
      "help": "Some digital service providers are caught even without an EU establishment, and must appoint an EU representative.",
      "unit": null,
      "conditional": true,
      "options": null
    },
    {
      "id": "uk-services",
      "kind": "boolean",
      "label": "Do you provide services in the United Kingdom?",
      "help": null,
      "unit": null,
      "conditional": true,
      "options": null
    },
    {
      "id": "sectors",
      "kind": "multi",
      "label": "Which of these describes what your organisation does?",
      "help": "Select every one that applies. Leave blank if none do.",
      "unit": null,
      "conditional": false,
      "options": [
        {
          "value": "energy",
          "label": "Energy"
        },
        {
          "value": "transport",
          "label": "Transport"
        },
        {
          "value": "banking",
          "label": "Banking"
        },
        {
          "value": "financial-market-infra",
          "label": "Financial market infrastructure"
        },
        {
          "value": "health",
          "label": "Health"
        },
        {
          "value": "drinking-water",
          "label": "Drinking water"
        },
        {
          "value": "waste-water",
          "label": "Waste water"
        },
        {
          "value": "digital-infrastructure",
          "label": "Digital infrastructure"
        },
        {
          "value": "ict-service-management",
          "label": "Managed IT or security services"
        },
        {
          "value": "public-administration",
          "label": "Public administration"
        },
        {
          "value": "space",
          "label": "Space"
        },
        {
          "value": "postal",
          "label": "Postal or courier"
        },
        {
          "value": "waste-management",
          "label": "Waste management"
        },
        {
          "value": "chemicals",
          "label": "Chemicals"
        },
        {
          "value": "food",
          "label": "Food production or distribution"
        },
        {
          "value": "manufacturing",
          "label": "Manufacturing"
        },
        {
          "value": "digital-providers",
          "label": "Online marketplace, search or social platform"
        },
        {
          "value": "research",
          "label": "Research organisation"
        },
        {
          "value": "none",
          "label": "None of these"
        }
      ]
    },
    {
      "id": "digital-services",
      "kind": "multi",
      "label": "Do you provide any of these specific services?",
      "help": "These carry rules of their own, several of which apply regardless of how small you are.",
      "unit": null,
      "conditional": false,
      "options": [
        {
          "value": "cloud",
          "label": "Cloud computing"
        },
        {
          "value": "data-centre",
          "label": "Data centre services"
        },
        {
          "value": "cdn",
          "label": "Content delivery network"
        },
        {
          "value": "msp",
          "label": "Managed IT services"
        },
        {
          "value": "mssp",
          "label": "Managed security services"
        },
        {
          "value": "dns",
          "label": "DNS services"
        },
        {
          "value": "tld-registry",
          "label": "Top-level domain registry"
        },
        {
          "value": "domain-registration",
          "label": "Domain name registration"
        },
        {
          "value": "online-platform",
          "label": "Online marketplace, search engine or social platform"
        },
        {
          "value": "public-ecomms",
          "label": "Public electronic communications network or service"
        },
        {
          "value": "trust-service",
          "label": "Trust services (not qualified)"
        },
        {
          "value": "qualified-trust-service",
          "label": "Qualified trust services"
        },
        {
          "value": "ixp",
          "label": "Internet exchange point"
        },
        {
          "value": "none-digital",
          "label": "None of these"
        }
      ]
    },
    {
      "id": "employees",
      "kind": "number",
      "label": "How many people does the organisation employ?",
      "help": "Count the whole enterprise, including linked and partner enterprises where a group relationship exists.",
      "unit": "employees",
      "conditional": false,
      "options": null
    },
    {
      "id": "turnover",
      "kind": "single",
      "label": "What is annual turnover?",
      "help": null,
      "unit": null,
      "conditional": false,
      "options": [
        {
          "value": "le10",
          "label": "EUR 10 million or less"
        },
        {
          "value": "10to50",
          "label": "Above EUR 10m, up to EUR 50m"
        },
        {
          "value": "gt50",
          "label": "Above EUR 50 million"
        }
      ]
    },
    {
      "id": "balance-sheet",
      "kind": "single",
      "label": "And the annual balance sheet total?",
      "help": "Asked because the upper thresholds are cumulative: you exceed them only when turnover and balance sheet are both above their limits.",
      "unit": null,
      "conditional": true,
      "options": [
        {
          "value": "le43",
          "label": "EUR 43 million or less"
        },
        {
          "value": "gt43",
          "label": "Above EUR 43 million"
        }
      ]
    },
    {
      "id": "financial-entity",
      "kind": "single",
      "label": "Are you an authorised financial entity?",
      "help": "DORA binds entities authorised in the EU, such as credit institutions, investment firms, insurers, payment and e-money institutions, crypto-asset service providers and pension institutions.",
      "unit": null,
      "conditional": false,
      "options": [
        {
          "value": "authorised-eu",
          "label": "Yes, authorised in the EU"
        },
        {
          "value": "authorised-uk-only",
          "label": "Authorised in the UK only"
        },
        {
          "value": "ict-provider-to-finance",
          "label": "No, but we supply IT services to financial firms"
        },
        {
          "value": "no",
          "label": "No"
        }
      ]
    },
    {
      "id": "uk-datacentre-load",
      "kind": "single",
      "label": "What is the rated IT load of your UK data centre capacity?",
      "help": null,
      "unit": null,
      "conditional": true,
      "options": [
        {
          "value": "lt1",
          "label": "Under 1 MW"
        },
        {
          "value": "1to10",
          "label": "1 MW to under 10 MW"
        },
        {
          "value": "ge10",
          "label": "10 MW or more"
        }
      ]
    },
    {
      "id": "uk-datacentre-basis",
      "kind": "single",
      "label": "Is that data centre capacity commercial, or solely for your own organisation?",
      "help": "The UK Bill sets a 1 MW threshold for services provided commercially and 10 MW where the facility exists solely to serve its owner.",
      "unit": null,
      "conditional": true,
      "options": [
        {
          "value": "commercial",
          "label": "Commercial or colocation"
        },
        {
          "value": "enterprise",
          "label": "Solely our own use"
        }
      ]
    }
  ]
}