Who is in scope for NIS2?
An organisation is in scope if it counts as a particularly important or important entity under § 28 of the BSI Act (BSIG). The BSIG as amended by the NIS-2-Umsetzungsgesetz provides no notice of determination: the classification takes effect by operation of law, and every organisation makes it itself. If the registration duty is not met, the BSI can carry out the registration itself under § 33(3) BSIG, in agreement with the competent supervisory authorities. Where facts suggest a missed registration, it can demand documents and information under § 33(4) BSIG.
Record the assessment in writing even when the answer is no. The note shows that you considered the question and how.
Step 1: does your activity fall under Annex 1 or Annex 2?
What counts is the actual activity, not the industry label in the commercial register. The binding catalogues are Annexes 1 and 2 of the BSIG, each with seven sectors.
| Annex | Sectors |
|---|---|
| Annex 1 "sectors of particularly important and important entities" | energy; transport; finance; health; water; digital infrastructure; space |
| Annex 2 "sectors of important entities" | transport; waste management; manufacture, production and trade of chemical substances; production, processing and distribution of food; manufacturing; providers of digital services; research |
The headings are the statute's own. "Sectors of high criticality" and "other critical sectors" are the headings of Annexes I and II of Directive (EU) 2022/2555, not of the BSIG. Classification turns on column D of the annexes, the types of entity. Read the statute rather than a summary.
Step 2: do you meet the size thresholds?
The thresholds are in § 28(1) and (2) BSIG.
| Category | Sector | Size |
|---|---|---|
| Particularly important entity | Annex 1 | at least 250 employees, or annual turnover above EUR 50 million and annual balance sheet total above EUR 43 million |
| Important entity | Annexes 1 and 2 | at least 50 employees, or annual turnover and annual balance sheet total each above EUR 10 million |
Headcount alone is enough in each case, whereas turnover and balance sheet total must both be exceeded. A large company in an Annex 2 sector is an important entity: Annex 2 never leads to the upper category, but it does not take a company out of scope either.
Step 3: does a rule apply regardless of size?
Covered regardless of size are operators of critical installations (§ 28(1) no. 1 BSIG) and qualified trust service providers, top-level domain name registries and DNS service providers (§ 28(1) no. 2 BSIG). All other trust service providers are important entities regardless of size (§ 28(2) no. 1 BSIG).
Telecommunications has its own thresholds. Providers of publicly available telecommunications services and operators of public telecommunications networks are particularly important entities from 50 employees or above EUR 10 million in turnover and balance sheet total (§ 28(1) no. 3). Below that they are important entities (§ 28(2) no. 2).
§ 28 BSIG did not take over the directive's other size-independent cases. Article 2(2)(b) of Directive (EU) 2022/2555 covers, for example, the sole provider of a service essential for critical societal or economic activities; points (c) to (e) add further cases. Anyone who bases or rules out being in scope on such a position is arguing from the directive, not from the German statute.
Several activities and groups
A single qualifying activity can bring an organisation into scope. Under § 28(3) BSIG, however, you may disregard business activities that are negligible in view of the entity's overall business when assigning a type of entity. Give your reasons in the assessment note.
§ 28(4) BSIG applies Recommendation 2003/361/EC to headcount, turnover and balance sheet total, excluding Article 3(4) of its Annex. Partner and affiliated companies are therefore added in by default, so a small group company can exceed the thresholds. Under sentence 2 they are not added where the company is independent of them as to the nature and operation of its information technology systems, components and processes. Whether that holds is a question about your IT architecture, and you must answer it with evidence.
Two examples and an assessment note
Fictional example; the figures are invented for illustration. A software company with 180 employees, EUR 32 million turnover and a EUR 21 million balance sheet total sells licences for an industry application. What decides the case is whether it installs, operates or maintains that software for customers, on site or remotely. If it does, it meets the wording of the managed service provider definition in § 2 no. 26 BSIG, a type of entity in Annex 1 (no. 6.1.10).
| Assessment step | Result |
|---|---|
| Type of entity | managed service provider, Annex 1 no. 6.1.10, because of remote maintenance at customers |
| Particularly important? | no: 180 employees is below 250, turnover of EUR 32 million is not above EUR 50 million |
| Important? | yes: 180 employees, so at least 50 |
| Consequence | important entity; registration within three months under § 33(1) BSIG |
Without installation, operation or maintenance at customers there is no type of entity, and the company is out of scope. If headcount rises to 250, it becomes a particularly important entity. The fine ceiling for a breach of § 30(1) sentence 1 BSIG then rises from EUR 7 million to EUR 10 million (§ 65(2) no. 2 and (5) sentence 1 no. 1 BSIG).
A food wholesaler with 400 employees falls under Annex 2 no. 4.1.1. Despite its size it is an important entity, not a particularly important one.
The assessment note, dated and approved by management, records:
- the activities examined and how they map to the types of entity in Annexes 1 and 2, including those ruled out (in the example: maintenance at customers, yes or no);
- the activities judged negligible under § 28(3) BSIG, with reasons;
- headcount, turnover and balance sheet total for the relevant financial year;
- group attribution under § 28(4) BSIG and, where the company claims independence, the IT evidence;
- the result and the trigger for the next review, such as a new service offering, an acquisition or a crossed threshold.
What being in scope triggers
An entity in scope registers, reports significant security incidents on time, and implements and documents the risk management measures under § 30 BSIG, which the NIS2 guide describes in detail.
Registration under § 33(1) BSIG is due at the latest three months after an entity first or again counts as a particularly important or important entity. It goes through the registration facility set up jointly by the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK). The deadline attaches to counting as an entity; the BSI portal has been available since 6 January 2026. Changes to the details must be reported under § 33(5) BSIG without delay, at the latest within two weeks of becoming aware of them.
Registration is a separate duty backed by a fine. Failing to submit the details, or submitting them late, can cost up to EUR 500,000 (§ 65(2) no. 6 and (5) sentence 1 no. 5 BSIG). Critical installations are registered separately with the BBK under § 33(2) BSIG in conjunction with § 8 KRITISDachG, also at the latest three months after an installation counts as critical. Under § 66 BSIG, this applies only once the ordinance under § 4(3) and § 5(1) KRITISDachG is in force.
In scope and still exempt
Being in scope and the extent of the duties are not the same. § 28(5) to (7) BSIG exempt entire groups of addressees from central duties:
| Addressee | What does not apply | Provision |
|---|---|---|
| Operators of public telecommunications networks and providers of public telecommunications services; operators of energy networks, energy installations and digital energy services subject to §§ 5c to 5e of the Energy Industry Act (EnWG) | §§ 30, 31, 32, 35, 36, 38, 39, 61 and 62 BSIG | § 28(5) |
| Financial entities under Article 2(2) of Regulation (EU) 2022/2554 (DORA), undertakings brought in by § 1a(2) and (2a) of the Banking Act (KWG) or § 293(5) of the Insurance Supervision Act (VAG), certain telematics entities | §§ 30, 31, 32, 35, 36, 38 and 39 BSIG | § 28(6) |
| Operators of critical installations, insofar as they operate an installation for an undertaking under paragraph 6 no. 1 | § 32 BSIG | § 28(7) |
The paragraph 5 exemption does not apply where such an entity also operates further critical installations or falls under a type of entity in Annex 1 or 2 through further activities. Registration under § 33 BSIG appears in none of the three exemptions.
NIS2 requirements in Rizzqo
NIS2 is supported in Rizzqo. Once you know you are in scope, the NIS2 requirements are attached to the systems behind the covered activity, such as remote maintenance systems. The right person answers each one, and open points stay visible until they are met.