Sector directory: which entity types NIS2 covers in Germany

This directory maps business activities to the entity types of the German BSI Act (BSIG, as amended on 22 October 2026), which transposes the NIS2 Directive (EU) 2022/2555. It does not replace a classification: whether an organisation is actually in scope, and in which category, also depends on size, group affiliation and exemptions. That check, with a completed classification record, is on the page on NIS2 applicability. German law uses two categories: essential entities (in Germany: besonders wichtige Einrichtungen) and important entities (wichtige Einrichtungen).

How do you read Annexes 1 and 2?

Each row of the annexes names a sector, sometimes a subsector, and the entity type. The entity type is what you test against. Some entity types refer to German sector legislation (for example “operators of gas distribution networks under Section 3 no. 8 of the Energy Industry Act”), others to a division of the NACE Rev. 2 classification. Which version of the classification applies and which code from your statistical returns to use is explained in the applicability check.

For the category: Annex 1 entity types are essential or important depending on size, Annex 2 entity types are at most important. Trust service providers, telecommunications providers, DNS service providers and TLD name registries follow their own rules, some of them independent of size, although they are listed in Annex 1.

Annex 1: sectors of essential and important entities

The table summarises the entity types close to the statutory wording, numbered as in the annex. Only the German statutory text is binding; the English terms are our own rendering.

Annex 2: sectors of important entities

Borderline cases by sector

Energy: activity-based, registration remains

Organisations that operate energy supply networks, energy installations or digital energy services under the German Energy Industry Act (EnWG) and are subject to its Sections 5c to 5e are exempt from most BSIG obligations under Section 28(5) BSIG; registration under Section 33 remains. The exemption only reaches as far as the activity: obligations apply to further critical facilities and further Annex 1 or 2 activities. If operating the energy installation is only a secondary activity, the exemption does not apply at all (Section 28(5) sentence 4). Which sections exactly are disapplied is set out in the applicability check.

A municipal utility is therefore never exempt across the board: its electricity and gas networks may fall under the exemption, a drinking water supply or waste water operation in the same company does not. According to the BSI (Federal Office for Information Security), operators of energy supply networks under Section 5d(4) EnWG that are neither essential nor important entities also register. For energy suppliers and municipal utilities it pays to map each line of business separately; OT and EnWG implementation as a service is described on our energy and critical infrastructure page.

Telecommunications

Telecommunications network operators and service providers have their own size rules in Section 28 and special rules under the German Telecommunications Act (TKG), which we explain on the page German security obligations for telecom providers.

Finance: DORA takes precedence

For financial entities under Article 2(2) of the DORA Regulation (EU) 2022/2554, Sections 30, 31, 32, 35, 36, 38 and 39 BSIG do not apply (Section 28(6) no. 1). According to the BSI, they still have to register; that is the core of the NIS2 and DORA boundary. Details: DORA and NIS2.

Health and medical devices

The German telematics agency (gematik) and operators of certain telematics infrastructure services are exempt from the same sections as DORA entities (Section 28(6) no. 2). For medical devices, the line runs between the annexes: manufacturers of medical devices considered critical during a public health emergency are in Annex 1, all other manufacturers of medical devices and in vitro diagnostics in Annex 2. Hospitals, medical care centres and laboratories are assigned via the entity types of the health sector in Annex 1.

Digital infrastructure and digital providers

For DNS service providers, TLD name registries, cloud computing and data centre services, content delivery networks, managed service providers, managed security service providers, online marketplaces, online search engines, social networking platforms and trust service providers, Implementing Regulation (EU) 2024/2690 takes precedence over the measures in Section 30(2) (Section 30(3)). A similar but not identical group has to register additionally under Section 34; that list includes domain name registration service providers but not trust service providers.

Under Section 2 no. 26 BSIG, a managed service provider is a provider of services for the installation, management, operation or maintenance of ICT products, networks, infrastructure or applications, on the customer’s premises or remotely. Traditional IT system houses can therefore be covered. In the BSI’s reading, an in-house group IT that only serves its own group can be negligible. Managed service providers are also subject to Implementing Regulation (EU) 2024/2690. When an IT service provider counts as an MSP is covered on the page on IT service providers and MSPs; digital providers are covered on the page on digital services. Which NIS2 obligations remain despite a C5 audit report is answered by C5 and NIS2 on c5-readiness.de (in German).

Space: ground infrastructure only

Only operators of ground-based infrastructure that supports space-based services and is owned by Member States or private parties are covered; providers of public electronic communications networks are excluded. The annex does not list providers of space-based services as such. Background is in our article NIS2 in the space sector.

Water, waste, food, chemicals

• Water and waste water: undertakings for which supplying water or treating waste water is only a non-essential part of their activity are not covered.
• Waste: only undertakings whose principal economic activity is waste management are covered. A manufacturer disposing of its own waste is not.
• Food: the entity type names wholesale distribution and industrial production and processing. It does not name retail or catering.
• Chemicals: covered are manufacturers and importers under REACH operating in NACE category 20 that are subject to registration under Article 6 REACH.

Research

Research organisations are listed in Annex 2. Under Section 2 no. 12 BSIG, educational institutions do not count as research organisations.

Public administration: not a sector of its own

Public administration is not a sector in the annexes. Three separate routes apply:

• Federal administration: Section 29 BSIG governs it separately. Federal authorities follow the rules for essential entities, without Sections 38, 40 (3), 61 and 65; the Federal Foreign Office, the Federal Ministry of Defence, the Federal Intelligence Service and the Federal Office for the Protection of the Constitution are additionally exempt from Sections 30, 33 and 35, among others.
• State and local administration: the federal states regulate the cyber security of state and municipal administrations. For questions, the BSI refers to the competent supervisory authority of the respective state administration.
• Municipal companies: when municipally owned operations fall under the BSIG despite state law, and when Section 28(8) exempts municipal administrative service providers, is explained in the applicability check.

Example: mapping a company with several activities

Fictitious example, not a client. A food wholesaler supplies restaurants and canteens. On its premises it runs a rooftop solar system for its own consumption and eight charging points that visitors can use for a fee. An external provider manages its IT. This is how the wholesaler maps its activities:

The example shows why a secondary activity can change the category: through wholesale alone, the company would be at most important. With an Annex 1 activity added, “essential” becomes possible if it is large enough. Size, group and category are checked in a second step on the page on NIS2 applicability. This mapping is our own assessment and does not replace a legal review.

Three typical mapping errors