NIS2 Entity Scope & Obligations

Note (dated 2026-08-04): a chain composes independent computations performed in an analytical order. No step's output is carried into the next step by the execution model; each step computes from its own declared inputs. This is true of every chain on this site, including chains whose per-step copy below reads as a data handoff.

Classify an entity as Essential or Important under NIS2 Directive 2022/2555 Annex I and II using sector codes, size thresholds, and automatic carve-outs (art-141) → check all ten Article 21(2)(a)–(j) cybersecurity risk-management measures for presence and maturity with a 0–100 compliance score and grade A–F (art-142) → calculate maximum penalty exposure under Article 34 with mitigating-factor adjustment — board-ready PDF with execution_hash (art-143). Active October 2024; first enforcement wave 2026.

OpenChainGraph · 3 Steps compliance mandate NIS2 Directive 2022/2555 Annex I / II · Art. 21 · Art. 34 W3C VC §13.11 Hash-Anchored §4 chain_depth:3 · Zero PII

Chain Stages · 3 Steps

1ROOT · D0node

NIS2 Entity Scope Classifier (Essential / Important / Out-of-Scope) art-141

Entity classification and applicable penalty caps feed the Art. 21 gap checker

MCP Call · classify_nis2_entity

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "classify_nis2_entity",
    "arguments": {
      "sector_code": "energy",
      "employee_count": 500,
      "annual_turnover_eur": 80000000,
      "is_dns_provider": false,
      "is_qualified_trust_service_provider": false,
      "is_public_electronic_comms_network": false
    }
  },
  "id": 1
}

↓

2MIDDLE · D1node

NIS2 Article 21 Gap Checker (Ten Cybersecurity Risk-Management Measures) art-142

Art. 21 compliance score and critical gaps feed the penalty exposure calculator

MCP Call · check_nis2_art21_measures

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "check_nis2_art21_measures",
    "arguments": {
      "measures": [
        { "measure_id": "a", "implemented": true, "documented": true, "last_tested_date": "2025-12-01" },
        { "measure_id": "b", "implemented": true, "documented": true, "last_tested_date": "2025-12-01" },
        { "measure_id": "c", "implemented": false, "documented": true, "last_tested_date": "" },
        { "measure_id": "d", "implemented": false, "documented": false, "last_tested_date": "" },
        { "measure_id": "e", "implemented": true, "documented": true, "last_tested_date": "2025-11-15" },
        { "measure_id": "f", "implemented": false, "documented": true, "last_tested_date": "" },
        { "measure_id": "g", "implemented": true, "documented": true, "last_tested_date": "2025-10-01" },
        { "measure_id": "h", "implemented": false, "documented": false, "last_tested_date": "" },
        { "measure_id": "i", "implemented": true, "documented": true, "last_tested_date": "2025-12-01" },
        { "measure_id": "j", "implemented": true, "documented": true, "last_tested_date": "2025-09-01" }
      ]
    }
  },
  "id": 2
}

↓

3TERMINAL · D2node

NIS2 Penalty Exposure Calculator (Art. 34) art-143

Maximum penalty exposure and mitigated estimate — board-ready export with execution_hash — final stage

MCP Call · calculate_nis2_penalty_exposure

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "calculate_nis2_penalty_exposure",
    "arguments": {
      "entity_classification": "essential",
      "global_annual_turnover_eur": 80000000,
      "infringement_types": ["art21_measures_absent"],
      "mitigating_factors": ["first_offence"]
    }
  },
  "id": 3
}

Question: This mid-size energy operator assumes NIS2 does not reach it. Does the classifier rate it essential or only important? Run the AINumbers MCP tool `run_chain` with {"chain":"nis2-entity-scope-and-obligations"} and read `art-141-nis2-entity-scope-classifier.entity_classification`. Re-run with `inputs` for `art-141-nis2-entity-scope-classifier`, reusing the values that result echoed, with `sector_code` set to "postal". Compare the same field. Verify: call `verify_execution_hash` (https://mcp.ainumbers.co/mcp) with `claimed_hash` set to `composite_execution_hash` and the full `composite_artifact`. Ledger, for a human re-check: https://ledger.ainumbers.co/ PII rule: send synthetic or anonymised inputs only. The MCP server runs these kernels and logs no payloads. Chain page: https://ainumbers.co/chaingraph/chains/nis2-entity-scope-and-obligations.html

NIS2 Entity Scope & Obligations

Ask your agent