NIS2 Research Organisations: Which Clients Are In Scope, and Which Universities Are Not

A biotech spin-off with 80 staff, a contract research lab and a university institute share one thing: all three call themselves "research". Under NIS2, only one of them is certain to be in scope.

If you advise research-heavy clients, the question is not "do they do research?". It is "are they a research organisation as the Directive defines it, and has their member state extended the rules to anyone else?" The answer changes country by country.

What NIS2 means by a research organisation

Annex II of NIS2 lists research organisations as a sector. Entities in Annex II sectors are classed as important entities, which means supervision is reactive (after evidence or an incident) rather than proactive.

The definition sits in Article 6(41). A research organisation is an entity whose primary goal is to conduct applied research or experimental development, with a view to exploiting the results for commercial purposes. The definition expressly excludes educational institutions.

Three tests follow from that wording:

• Applied research or experimental development is the primary goal, not a side activity.
• The results are meant to be exploited commercially.
• The entity is not an educational institution.

A private R&D lab selling findings to industry passes all three. A university faculty with a few industry contracts does not, because the institution as a whole is educational.

The size rule still applies

Article 2(1) applies the EU size-cap rule. Medium-sized enterprises and above are covered, which in practice means at least 50 staff, or turnover and balance sheet above €10 million.

A 12-person research start-up is therefore out of scope unless the member state applies a size-independent rule. This is the first filter to run on every research client, and it removes more of them than most consultants expect.

Universities: out by default, in by national choice

Article 2(5) lets member states choose to extend NIS2 to education institutions, in particular where they carry out critical research activities. It is an option, not an obligation.

That produces a patchwork. Two universities with identical research programmes can face different obligations on either side of a border. Never assume an answer from the Directive alone. Check the national law.

Country by country: what we could verify

Germany. The NIS2UmsuCG has been in force since 6 December 2025, with the BSI as competent authority. Research organisations fall under the important-entity category (§ 28 BSIG). Secondary sources report that Germany did not make a general extension to universities, though individual Länder rules may apply.

Netherlands. The Cyberbeveiligingswet (Stb. 2026, 187) is in force since 15 August 2026. It covers research for commercial purposes and also addresses education institutions. Which category an institution lands in depends on its sector ministry, so confirm the designation in writing.

Italy. D.Lgs. 138/2024 goes further than the Directive. Research organisations sit in Annex II, while "enti e istituzioni di ricerca" appear in Annex III and "istituti di istruzione che svolgono attività di ricerca" in Annex IV. ACN is the competent authority and sector authority for the Annex III research bodies. The ministry for university and research (MUR) is the sector authority for the other two.

Poland. The amended KSC Act took effect on 2 April 2026 and lists scientific research as an important sector. Registration runs through the Minister of Digital Affairs. Whether a given university counts as a public entity under the Act needs a case-by-case check.

France. The transposition bill is still not law. The deadline was 17 October 2024, and National Assembly examination was postponed again in October 2026. Until it passes, there is no French research-organisation rule to point at.

Spain. The Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad is still a draft, and the Commission has taken Spain to the Court of Justice. The older Real Decreto-ley 12/2018 continues to apply.

What important-entity status means in practice

Important entities carry the same Article 21 risk-management duties as essential entities. They must also report significant incidents under Article 23 (early warning within 24 hours, notification within 72 hours, final report within one month).

The difference is supervision and penalties. Maximum administrative fines for important entities are €7 million or 1.4% of worldwide annual turnover, whichever is higher. Supervision is ex post.

For a research client, the exposed areas are predictable: research data and IP, access control for external collaborators, and lab or instrument networks that nobody classed as IT. See the Article 21 ten measures guide for the full list.

How to scope a research client in four questions

1. Is research the primary goal of the entity? If it is an educational institution first, stop and check national extension rules.
2. Is the research applied, with commercial exploitation intended? If not, the Article 6(41) definition likely fails.
3. Does the entity clear the size threshold? Under 50 staff and under €10 million turnover usually means out of scope.
4. Does the national law add anything? Italy, the Netherlands and Poland all do something beyond a plain copy of Annex II.

Document the answers and the date. If the client's regulator later disagrees, a dated scoping note shows good faith. For multi-country groups, Article 26 jurisdiction rules decide which regulator you face.

The takeaway

Do not scope on the word "research". Scope on Article 6(41), the size rule and the national statute, in that order.

A fast way to turn that into evidence is to run a readiness assessment per client and keep the result on file. Start a quick scan at NIS2Certify to see where a research client's compliance posture stands against Article 21.

This article is general information, not legal advice. Verify scope against the national law and your client's regulator.