- NIS-2 has a broad extra-territorial reach, and many organizations providing digital or infrastructure services into the EU may be in scope without having assessed their position.
- Non-EU organizations (including US-based businesses) may therefore be unaware that they are in scope
