Checklist: does NIS2 apply to a Swiss company?
For: Swiss companies with EU business
Updated: 2026-11
Whether NIS2 affects a Swiss company is clarified in seven steps: list EU entities, check their sectors and size, identify digital services in the EU, collect supply chain requirements from EU customers, map reporting duties, assign responsibility and document the result.
NIS2 does not apply in Switzerland directly but affects Swiss companies in three ways: through EU subsidiaries, through certain digital services in the EU and through the supply chain of covered customers.
This checklist helps with classification. National implementations differ by member state; in Germany the NIS2 implementation act has applied since 6 December 2025.
The checklist
- 01
List EU entities
List all subsidiaries and participations in the EU with seat, activity and size.
Done when: A list of all EU entities with employees, revenue and activity exists.
- 02
Check sector and size
For each EU entity, check whether it operates in a covered sector and meets the size thresholds.
Done when: For each entity it is recorded whether it is an important or essential entity, with reasoning.
- 03
Identify digital services
Check whether the company offers digital services such as cloud, data centres, managed services or online marketplaces in the EU.
Done when: It is clarified whether an EU representative must be appointed for such services.
- 04
Collect supply chain requirements
Compile security requirements of covered EU customers from contracts and supplier questionnaires.
Done when: Contractual requirements of the main EU customers are known and assessed.
- 05
Map reporting duties
Place NIS2 reporting duties alongside those under the ISA, FADP and, where relevant, the CRA.
Done when: An overview shows all reporting channels with deadlines and responsibilities.
- 06
Assign responsibility
Determine who in management is responsible for cybersecurity and approves the measures.
Done when: Responsibility is assigned in writing and management is informed.
- 07
Document the result
Record the classification with date and reasoning and repeat when the business changes.
Done when: The classification is documented with a date for the next review.
Common mistakes
- —Assuming NIS2 never affects Swiss companies.
- —Looking only at the parent company and overlooking EU subsidiaries.
- —Ignoring contractual requirements from customers who are themselves covered by NIS2.
- —Delegating management responsibility to IT.
What this checklist does not cover
- —The checklist does not replace legal review in the respective member state.
- —NIS2 implementation differs by country in details such as thresholds, registration and authorities.
- —Technical security measures are not covered by this checklist.
Parent service: Cyber readiness & IT security
FAQ
Does NIS2 apply to a Swiss AG without an EU entity?
Directly usually not, unless it provides certain digital services in the EU. Indirectly via customer contracts it often does.
Which NIS2 reporting deadlines apply?
An early warning within 24 hours, a notification within 72 hours and a final report within one month.
What about the Swiss reporting duty?
Since April 2025 the ISA reporting duty within 24 hours applies to critical infrastructure, independent of NIS2.
More checklists
Checklist: carrying out a data protection impact assessment
A data protection impact assessment is produced in seven steps: check whether a high risk exists, describe the planned processing, assess risks to data subjects, define measures, judge the residual risk, consult the FDPIC or the data protection adviser if a high residual risk remains, and retain and update the assessment.
Checklist: reviewing a privacy notice under the FADP and GDPR
A privacy notice is reviewed in seven steps: controller and contact, purposes of processing, data categories, recipients and processors, transfers abroad with safeguards, data subject rights and currency against the services actually used. Anyone also targeting people in the EU adds the additional GDPR information.
Checklist: implementing cookies and consent correctly
Cookies are implemented correctly in seven steps: inventory all cookies and trackers, separate necessary from optional, determine the rules for your audience, in Switzerland inform users and allow refusal, for EU visitors set optional cookies only after consent, enforce the choice technically and review regularly.