Check NIS2 applicability and document your classification

This page explains the classification under Section 28 of the German BSI Act (BSIG, as amended on 22 October 2026), which transposes the scope rules of the NIS2 Directive, and how to record the result. German law distinguishes essential entities (in Germany: besonders wichtige Einrichtungen) and important entities (wichtige Einrichtungen). What follows after classification is covered on the page on NIS2 requirements.

Who decides whether an organisation is in scope?

The organisation itself. The BSI neither confirms nor denies applicability and does not assess individual cases. It offers a legally non-binding NIS‑2 applicability check (in German). There is no procedure to apply for an exemption. If doubts remain after the check, the BSI recommends external legal advice.

The BSI is competent for organisations established in Germany or with a representative designated here. The new BSIG, introduced by the NIS2 Implementation Act, has applied since 6 December 2025 without a general transition period. According to the BSI, it covers around 29,500 companies and federal administration bodies. In-scope organisations have had their obligations since that date, whether or not they have registered yet.

Step 1: is there a size-independent case?

Whether an organisation operates a critical facility is still determined under the BSI Critical Infrastructure Ordinance (BSI-Kritisverordnung). Under Section 66 BSIG, the new definitions linked to the German KRITIS umbrella act only apply once its implementing ordinance is in force.

Step 2: does an activity fall under Annex 1 or 2?

Only organisations that offer goods or services to others for payment and can be assigned to an entity type in Annex 1 or Annex 2 can be in scope. Go through every business activity, including secondary ones. Some entity types refer to sector legislation, others to a division of the NACE Rev. 2 classification, which at division level matches the German WZ 2008 code used in statistical returns; the BSI confirms that NACE Rev. 2.1 does not apply here.

The annex limits the possible category. Annex 1 entity types (such as energy, health and digital infrastructure) can be essential or important. Annex 2 entity types (such as machinery, food, chemicals and waste management) are at most important, even for large enterprises.

Negligible activities: Section 28(3) allows activities that are negligible in relation to the organisation’s overall business to be disregarded. The BSI reads this as activities purely for internal purposes, such as rooftop solar for own consumption (even if surplus power is fed into the grid) or the organisation’s own IT, even if managed externally. An activity offered on the market is not negligible in this reading. For linked enterprises the BSI applies thresholds, for example fewer than 50 employees and less than 10% of turnover and balance sheet total for an activity offered only within the group.

Step 3: how large is the organisation, including linked enterprises?

• Basis: Commission Recommendation 2003/361/EC (except Article 3(4) of its annex), generally using the latest approved annual accounts.
• Employees are counted in annual work units: part-time staff pro rata, apprentices not at all.
• Two years: according to the BSI, the threshold must be exceeded in two consecutive financial years, except for newly founded companies.
• Whole enterprise: figures refer to the entire enterprise, not to a single site.

Group affiliation

Figures of partner and linked enterprises are added, including those outside Germany and the EU. The exception: if the organisation is independent of them regarding the design and operation of its IT, only its own figures count (Section 28(4) sentence 2). According to the explanatory memorandum quoted by the BSI, a subsidiary whose IT is run entirely by the parent, without any say of its own, is not independent. A subsidiary that has its IT run by a contracted service provider usually does have decisive influence.

Group figures only feed the calculation. The entity that actually carries out the listed activity is in scope; the parent is not in scope merely because a subsidiary is, and vice versa. If parent and subsidiary both carry out a listed activity and together reach the thresholds, the BSI considers both to be in scope.

Step 4: does an exemption apply?

• Section 28(5): public telecoms providers and energy network, energy installation and digital energy service operators subject to Sections 5c to 5e of the Energy Industry Act are exempt from Sections 30, 31, 32, 35, 36, 38, 39, 61 and 62, but registration under Section 33 remains. The exemption does not cover further critical facilities or further Annex 1 or 2 activities, and it does not apply at all if operating the energy installation is only a secondary activity.
• Section 28(6): financial entities under DORA and the German telematics infrastructure are exempt from Sections 30, 31, 32, 35, 36, 38 and 39. DORA entities still register with the BSI.
• Section 28(7): operators of critical facilities are exempt from the reporting obligation (Section 32) insofar as they operate a facility for DORA financial entities.
• Section 28(8): legally dependent units of regional or local authorities and legal persons owned exclusively by such authorities (not the Federation) fall outside the act if they were set up to provide services for public administrations and comparable state law regulates them with reference to this provision. Both conditions must be met.
• Section 29: federal administration bodies follow their own rules.

What does the category mean?

The core obligations are the same for both categories: risk management (Section 30), reporting of significant incidents (Section 32), registration (Section 33) and management body duties (Section 38). Supervision and fines differ:

Maximum fines also differ by category, but above all by offence; the amounts per obligation are listed on the page on NIS2 requirements. Registration is due no later than three months after an organisation first qualifies as essential or important. For those already in scope on 6 December 2025, this period ended on 6 March 2026 by our calculation.

Which borderline cases come up in classification?

• Above the threshold for the first time: an organisation that grows in one year is, in the BSI’s view, only in scope once the second consecutive financial year is above the threshold. The obligations apply from then on, and registration is due three months later (our reading of Section 33(1)).
• Mixed activities: a machinery manufacturer with a small energy or IT business offered on the market can fall under Annex 1 through that secondary activity and become essential if it is large enough. Check secondary activities one by one against the reading of Section 28(3).
• Group IT companies: an IT subsidiary that serves only its own group can be negligible under the BSI thresholds. If it also offers services outside the group, it can fall under Annex 1 as an IT service provider or managed service provider; the sector directory lists these entity types.
• Organisations based abroad: what makes the BSI competent is an establishment in Germany or a representative designated here; for some digital entity types, the main establishment in the EU is decisive (Section 60). How this works for international groups is explained on the page on NIS2 in Germany for international companies.

Example: classification record of a group subsidiary

Fictitious example, not a client. A manufacturer of gearbox assemblies has 42 employees in annual work units, €8.1 million turnover and €6.4 million balance sheet total. It belongs to a group with a holding company and a sister company in Austria. The holding runs all IT (ERP, user directory, email). A rooftop solar system covers own consumption.

The record shows why group affiliation decides the result here: without it, the company would be out of scope. Had it organised its IT itself, for example through its own service provider contract, independence under Section 28(4) sentence 2 would have had to be checked and reasoned.

Three typical gaps

Gaps and remedies are our own assessment. Classification in an individual case remains a legal question; where in doubt, have it reviewed by a lawyer.

What comes after classification

If the result is “essential” or “important”, the next steps are registration in the BSI portal, an overview of the obligations and the measures under Section 30 BSIG. Our NIS2 gap analysis shows where your organisation stands. If the result is “out of scope”, customers may still pass NIS2 requirements on to you; the page for suppliers covers this.