SECTORS

Does any of this apply to you?

NIS2 and CER define who they catch by sector and by size. DORA does it by financial activity, the CRA and RED by whether you put a product on the market. So the quickest way to find out what governs you is to start from what you do, not from the name of a regulation.

NIS2 · CER

Energy

Electricity, gas, heating, oil and hydrogen are essential entities under NIS2, and the same operators fall under CER for physical resilience.

Healthcare

Hospitals, laboratories and medical device makers are essential entities under NIS2, and they process the most sensitive category of personal data there is.

Finance and insurance

Banks, insurers, brokers, payment institutions and crypto-asset firms have been under DORA since January 2025 — board-level accountability, not a policy document.

Public administration

Central and regional government bodies are named in NIS2 and carried into Slovenian law by ZInfV-1, alongside the data protection duties every public body already has.

Digital infrastructure and IT providers

Cloud, data centres, DNS, TLD registries and managed service providers are named directly in NIS2 — and if you ship software, the CRA is coming for the product as well.

Manufacturing and products

Manufacturing is an important entity under NIS2, and anything you place on the EU market with a radio or a network port now carries RED and CRA duties of its own.

Your sector is not here

Scope turns on size and activity as much as on sector, and plenty of organisations are caught through a client rather than directly. Describe what you do and we will tell you which regimes apply, in writing.

Ask us