You carry out the assessment yourself, as the BSI does not tell you the result. This guide takes you through sectors, thresholds and group questions, with examples from industry.
Three questions to the answer
- Activity. Does one of your activities match a type of entity in Annex 1 or 2 BSIG?
- Size. Do you reach the thresholds, and do group figures count?
- Special case. Does a size-independent rule or a special regime apply?
Record the answers with their source. The classification is the basis for all further steps and for any questions.
Which sectors are covered
| Annex | Sectors |
|---|---|
| Annex 1 BSIG | Energy, transport, finance, health, water, digital infrastructure, space |
| Annex 2 BSIG | Postal and courier services, waste management, chemicals, food, manufacturing, digital service providers, research |
What decides is the type of entity within the sector, not your own industry label. What counts is what you actually do.
Industry: what belongs to Annex 2
For industry, Annex 2 BSIG is usually the way in. Many types of entity are described through NACE divisions. According to the BSI, NACE Rev. 2 as of 2008 applies.
- Electronics (division 26): manufacture of computer, electronic and optical products.
- Electrical (division 27): manufacture of electrical equipment.
- Mechanical engineering (division 28): including manufacturers that do not operate critical infrastructure themselves.
- Vehicles (divisions 29 and 30): motor vehicles and parts, and other transport equipment.
- Medical technology: manufacturers of medical devices and in vitro diagnostics.
- Chemicals: manufacturers and importers in category 20 that must register under the REACH Regulation.
- Food: companies in wholesale and in industrial production and processing.
The size thresholds
| Classification | Employees | or turnover and balance sheet total |
|---|---|---|
| Essential (Annex 1 only) | from 250 | over EUR 50 million turnover and over EUR 43 million balance sheet total |
| Important (Annex 1 and 2) | from 50 | over EUR 10 million each |
Companies from Annex 2 are important entities at most, even if they are very large. This holds unless they also fall under a case of § 28(1) BSIG, for example as the operator of a critical facility.
How to count correctly
§ 28(4) BSIG refers to the SME Recommendation 2003/361/EC, except for Art. 3(4) of its annex. This means:
- Annual work units: You do not count heads. Part-time and seasonal work count proportionally.
- Apprentices: They do not count, and neither does maternity or parental leave.
- Both financial figures: Turnover and balance sheet total must both be exceeded. The employee figure is the alternative.
- Latest accounts: The data of the latest accounts apply, with turnover excluding VAT.
- Two years: According to the BSI, only exceeding the threshold in two consecutive financial years makes you an entity. This does not apply to newly founded companies.
Cases regardless of size
- Operators of critical facilities: always essential. As long as the ordinance under the KRITIS Umbrella Act is not in force, the previous definition of critical facilities continues to apply (§ 66 BSIG), in practice the BSI-KritisV.
- Qualified trust service providers, top-level domain name registries and DNS service providers: always essential.
- Other trust service providers: always important.
- Public telecommunications: essential from 50 employees or over EUR 10 million turnover and balance sheet total, important below that.
Corporate groups
Groups raise the most questions. These points follow from § 28(4) BSIG and the BSI's FAQ:
- Each entity on its own: Applicability is checked per entity. The parent does not automatically become subject to the duties just because a subsidiary is covered.
- Group figures: Linked enterprises generally count in full, including outside the EU, and partner enterprises proportionally.
- Independent IT: The figures are not added if the company is independent as regards its IT. According to the explanatory memorandum, what matters is whether it can decide on procurement, operation and configuration on its own responsibility.
- IT run by the parent: If the parent operates the systems entirely, this independence is regularly denied. With a contracted service provider it is regularly affirmed.
- Shared IT: If parent and subsidiary meet the requirements, both are covered, unless § 28(4) sentence 2 BSIG applies.
- Group IT company: If it provides operational services with administrative access to systems of other group companies, the BSI classifies it as a managed service provider.
Negligible activities
Business activities that are negligible in relation to the activity as a whole can be disregarded (§ 28(3) BSIG). The BSI reads this narrowly: for a single company these are activities that serve internal purposes only, such as a photovoltaic system for its own use. What you offer on the market is not negligible.
Special regimes
Individual duties can be replaced by other rules. Registration under § 33 BSIG is not named in these exceptions.
- Finance: §§ 30, 31, 32, 35, 36, 38 and 39 BSIG do not apply to financial entities under DORA (§ 28(6) BSIG).
- Telecommunications and energy: § 28(5) BSIG exempts operators of public telecommunications networks and certain energy operators from core duties, with exceptions for further activities.
- Telematics infrastructure: § 28(6) BSIG also applies to the Gesellschaft für Telematik and certain services.
Suppliers that are not covered themselves
If you do not fall under § 28 BSIG, the duties do not apply to you directly. Your customers must, however, consider the security of their supply chain (§ 30(2) no. 4 BSIG). According to the BSI, suppliers that are not covered can therefore be affected indirectly, for example through contracts and evidence.
Examples from industry
All examples are invented and simplified.
| Company | Check | Result |
|---|---|---|
| Machine builder, 180 employees, independent | Division 28, Annex 2, threshold of 50 reached | Important entity |
| Plastics processor, 300 employees | Division 22, no type of entity in the annexes | Not covered, indirectly affected as a supplier |
| Subsidiary of a switchgear maker, 40 employees, IT run entirely by the parent | Division 27, group figures count | Important entity, depending on group size |
| Water supplier, 260 employees | Annex 1, threshold of 250 reached | Essential entity |
Checklist
- All activities and companies listed.
- NACE code and type of entity checked per activity.
- Annual work units, turnover and balance sheet total recorded with their source.
- Linked and partner enterprises checked.
- Independence of the IT checked and justified.
- Critical facilities and special regimes checked.
- Classification documented per company.
- Annual review and triggers such as acquisitions defined.
Checking applicability with Complass
A spreadsheet holds the result, but not the reasoning, the history and the consequences. In Complass they stay together:
- First assessment: The free applicability check takes a few minutes without sign-up and also asks about your corporate group.
- Applicability check in the portal: The result names the rule, reasoning, legal reference with a link to the statute text, and deadlines. With "Don't know" it reads "Assessment pending".
- Per company: You choose the legal entity, and the result sets its NIS2 classification. The portal does not add partner and linked enterprises automatically, but it points them out.
- Traceable: A new check becomes a new record and the history stays visible. The result is available as a PDF.
- What follows: The cockpit shows the duties for the classification, and the check proposes matching projects.
Frequently asked questions
From how many employees does NIS2 apply?
Generally from 50 employees in a covered sector. Alternatively, more than EUR 10 million in both turnover and balance sheet total is enough. For some types of entity, size plays no part.
Does the BSI tell us whether we are affected?
No. Each entity checks for itself. The BSI offers a NIS-2 applicability assessment for this but does not advise on individual cases. Have borderline cases reviewed legally.
We have companies in other EU countries. What applies there?
The BSI is responsible for entities established in Germany (§ 59 BSIG). Companies in other Member States fall under the national transposition law there. For certain digital types of entity, the main establishment decides (§ 60 BSIG).
What changes if we grow?
If you become an entity for the first time or again, the registration duty under § 33 BSIG begins. So check your classification every year and on acquisitions.
In a demo we show you how to get from classification straight into implementation.
Request a demo Try it for 14 days
Read more
- Free applicability check
- Guide "Implementing NIS2: the step-by-step guide"
- Guide "Registering with the BSI step by step"
- Whitepaper "NIS2 for companies in every sector: directly in scope or via your customers"
- Whitepaper "Your customer's security questionnaire: NIS2 for suppliers and service providers"
- NIS2 and the BSIG in Complass: applicability, duties and implementation
Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The current wording of the BSIG is authoritative.