Am I Affected by NIS2? How to Check

Your company is affected by NIS2 if it operates in a sector listed in Annex 1 or 2 of the BSIG and has at least 50 employees or an annual turnover and an annual balance sheet total of more than EUR 10 million each. These sectors include energy, transport, health, water, digital infrastructure, food and manufacturing, among others. Regardless of size, operators of critical facilities, trust service providers, TLD registries and DNS service providers are covered (§28 para. 1 and 2 BSIG). In Germany this applies to around 29,500 entities; the obligations have applied since December 2025 without a transition period. Whether your company is in scope can be checked with the free NIS2 affectedness check in under a minute, without registration. What comes next is described on the page getting started with NIS2.

Who Is Affected by NIS2?

The NIS2UmsuCG defines in §28 BSIG which companies qualify as "essential" or "important" entities. The determining factors are the sector (Annex 1 and 2 of the BSIG) and company size. Compared to the previous IT Security Act, the number of regulated entities rises from approximately 4,500 to 29,500, an increase of over 550 percent.

Why Does Germany Have Its Own National Law?

The NIS2 Directive (2022/2555) requires all member states to enact national transposition laws. In Germany, the result is the NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (NIS2UmsuCG). It was passed by the Bundestag on 13 November 2025 and entered into force on 6 December 2025 (BGBl. I Nr. 301).

The law provides no transitional period. All obligations have applied immediately since it took effect.

Which Legal Provision Determines Whether a Company Is Affected?

The central provision is §28 BSIG. It defines which entities are classified as "essential" (paragraph 1) and which as "important" (paragraph 2). The classification depends on two criteria:

• Sector affiliation: The company must operate in one of the 14 sectors listed in Annex 1 or Annex 2 of the BSIG.
• Company size: The EU thresholds for medium-sized enterprises apply: at least 50 employees or annual revenue and an annual balance sheet total each exceeding 10 million euros.

Many SMEs underestimate whether they are affected because they only look at headcount. A company with 30 employees already falls under NIS2 if its annual revenue and annual balance sheet total both exceed 10 million euros.

How Big Is the Leap Compared to the Previous IT Security Act?

Under the previous IT Security Act 2.0, approximately 4,500 entities were regulated, predominantly operators of critical infrastructure. The NIS2UmsuCG now covers roughly 29,500 entities. This increase of over 550 percent primarily affects mid-sized companies that were previously not subject to any cybersecurity regulation.

The BSI registration deadline expired on 6 March 2026. Companies that have not yet registered already risk fines. The NIS2 Guide from NIS2Compass walks you through the entire implementation process step by step, from the applicability assessment to BSI registration. The phases of self-implementation are described in the guide Implementing NIS2 without a consultant.

Which Sectors Are Affected by NIS2?

The BSIG covers 14 sectors in two annexes. Annex 1 lists 7 sectors, including energy, health and digital infrastructure. Annex 2 lists 7 further sectors such as manufacturing, postal and courier services, and food production. The EU directive uses a finer breakdown and arrives at 18 sectors. Public administration, a separate sector there, is not part of the BSIG annexes: federal administration entities are covered by §29 BSIG.

Within these sectors, the BSIG distinguishes 67 types of entities (53 in Annex 1, 14 in Annex 2). What counts is which goods or services your company actually provides. For manufacturing and chemicals, the law refers to divisions of the NACE classification, for example division 28 for mechanical engineering.

Which Sectors Have High Criticality?

Annex 1 of the BSIG defines 7 sectors whose entities qualify as essential or important depending on size:

• Energy — electricity, district heating and cooling, fuel and heating oil supply, gas supply including hydrogen
• Transport — air transport, rail transport, shipping, road transport
• Finance — banking (credit institutions) and financial market infrastructures (trading venues, central counterparties)
• Health — healthcare providers such as hospitals, EU reference laboratories, pharmaceutical research and manufacturing, manufacturers of critical medical devices
• Water — drinking water supply and wastewater disposal
• Digital infrastructure — including internet exchange points, DNS services, TLD registries, cloud and data centre services, CDNs, trust services, telecommunications, and managed service providers and managed security service providers
• Space — operators of ground-based infrastructure

Which Other Critical Sectors Exist?

Annex 2 of the BSIG covers 7 additional sectors:

• Postal and courier services — providers of postal services, including courier services
• Waste management — companies whose main economic activity is waste management
• Chemicals — manufacture, import and trade of chemical substances
• Food — food businesses in wholesale and in industrial production and processing
• Manufacturing — 6 branches: medical devices and in-vitro diagnostics, computer and electronic products, electrical equipment, mechanical engineering, motor vehicles, other transport equipment
• Digital service providers — online marketplaces, online search engines, social networks
• Research — research organisations

What Applies When You Operate in Multiple Business Areas?

Many companies operate across multiple areas. Any business activity in a regulated sector counts, even if it is not your core business: the NIS2 obligations may still apply. Only activities that are negligible in relation to the company's overall business are disregarded under §28 para. 3 BSIG. A mechanical engineering company with its own logistics division, for example, could potentially fall under two sectors simultaneously.

A complete sector classification requires a thorough analysis of your business activities. The Knowledge Hub from NIS2Compass provides detailed explanations of each sector and its subsectors. Whether you are affected as a supplier is covered on the page NIS2 in the supply chain.

At What Size Does NIS2 Apply to My Company?

NIS2 generally applies from 50 employees or annual revenue and an annual balance sheet total each exceeding EUR 10 million. This size-cap rule is based on EU Recommendation 2003/361/EC. For certain types of entities, the thresholds do not apply: they fall under the regulation regardless of size.

What Thresholds Does §28 BSIG Define?

The NIS2-Umsetzungsgesetz distinguishes two categories with different thresholds. The classification determines the scope of obligations and the level of potential fines.

Essential entities (§28 para. 1 no. 4 BSIG): Companies in Annex 1 sectors with 250 or more employees or with annual revenue exceeding EUR 50 million and an annual balance sheet total exceeding EUR 43 million.

Important entities (§28 para. 2 no. 3 BSIG): Companies in Annex 1 and Annex 2 sectors with 50 or more employees or with annual revenue exceeding EUR 10 million and an annual balance sheet total exceeding EUR 10 million.

Why Is the OR-Linkage So Critical?

Many companies only check their employee count. Yet it is enough if annual revenue and annual balance sheet total both exceed 10 million euros. A company with 30 employees, EUR 15 million in revenue and a EUR 12 million balance sheet total falls under NIS2.

The reverse also holds: from 50 employees, NIS2 applies even with low revenue. Employee counts are calculated based on full-time equivalents. Part-time staff count proportionally.

Are Affiliated Companies Counted?

Yes. Under §28 para. 4 BSIG, partner and affiliated companies must be included in the calculation. If your company belongs to a corporate group, employee count, revenue and balance sheet total are assessed at group level. A standalone small subsidiary can exceed the thresholds as a result.

According to the legislative proposal (BT-Drs. 20/13184), the legislator estimates average compliance costs of EUR 86,900 per affected entity. What these costs specifically cover is analysed in the article NIS2 Consultant or DIY? A Cost Comparison.

What Does the Applicability Assessment Look Like in Practice?

A mid-sized mechanical engineering company employs 80 staff with EUR 18 million in annual revenue and a EUR 12 million balance sheet total. The company belongs to the "manufacturing sector/manufacture of goods" sector, an Annex 2 sector under the NIS2-Umsetzungsgesetz.

The assessment shows: with 80 employees, the company exceeds the threshold of 50 staff. It qualifies as an important entity under §28 para. 2 no. 3 BSIG. Even if the headcount were just below 50, the revenue and balance sheet total would exceed the financial thresholds.

In many SMEs the IT manager bears sole responsibility for cybersecurity, and there is no dedicated information security officer. For this situation, the NIS2 Guide from NIS2Compass provides a structured implementation path from initial assessment to BSI registration. How self-implementation works is shown in the guide to implementing NIS2 without a consultant.

Essential vs. Important: What Is the Difference?

The NIS2UmsuCG distinguishes between "essential" and "important" entities. Essential entities are subject to stricter supervision (proactive audits by the BSI) and higher penalty limits (up to EUR 10 million instead of EUR 7 million).

Who Qualifies as an Essential Entity?

The law clearly defines in §28 BSIG which organisations are classified as "essential." The category includes several groups:

• KRITIS operators — always essential, regardless of company size
• Qualified trust service providers, TLD registries and DNS service providers — also size-independent
• Telecommunications providers with 50 or more employees — telecommunications is highly critical infrastructure
• Annex 1 entities with 250 or more employees, or over EUR 50 million in revenue and over EUR 43 million in balance sheet total — the standard large enterprise threshold

Who Qualifies as an Important Entity?

Important entities form the broader category. This includes Annex 1 and Annex 2 entities with 50 or more employees, non-qualified trust service providers, and telecommunications providers with fewer than 50 employees. The threshold is significantly lower; many mid-sized companies fall into this group.

Where Do the Practical Differences Lie?

The risk management obligations under §30 BSIG apply identically to both categories. Executive liability under §38 BSIG also applies equally to both. The differences concern supervision and sanctions:

• Supervisory regime: Essential entities are subject to proactive audits by the BSI (§61 BSIG). Important entities are only supervised reactively, meaning after an incident or when there is a concrete suspicion (§62 BSIG).
• Penalty framework: For essential entities, §65 BSIG allows fines of up to EUR 10 million or 2% of global annual revenue. For important entities, the limit is EUR 7 million or 1.4% of revenue. The NIS2 fine calculator translates these caps into a rough estimate for your own company.

KRITIS operators have a special status: they are always classified as essential and must fulfil additional requirements under §31 and §39 BSIG. Which penalties apply in detail is explained in the article NIS2 Fines: What Penalties Can You Expect?.

What Exceptions and Special Cases Exist?

Not all companies in regulated sectors are automatically affected, and some fall under the law even below the size thresholds. The NIS2UmsuCG includes size-independent applicability, exemption decrees and sector-specific special rules.

Which Companies Are Affected Regardless of Size?

Certain entities fall under the NIS2UmsuCG regardless of employee count and revenue. According to §28 para. 1 BSIG, these include KRITIS operators, qualified trust service providers, TLD registries and DNS service providers. They are always classified as essential entities, subject to the strictest obligations.

Additionally, there is the ancillary activity rule under §28 para. 3 BSIG: if a company provides only a minor portion of its services in a regulated sector, the classification may not apply. However, the threshold is narrowly defined and requires careful examination.

What Special Rules Apply to Certain Sectors?

Three industries are subject to partially different regulations:

• Telecommunications providers: §28 para. 5 BSIG refers to the Telekommunikationsgesetz (TKG), which provides its own security obligations.
• Financial companies: §28 para. 6 BSIG clarifies that the DORA regulation (EU 2022/2554) takes precedence. Banks and insurers fulfil NIS2 obligations primarily through DORA.
• Energy sector: The Energiewirtschaftsgesetz (EnWG) contains its own IT security requirements that partially take precedence.

Additionally, the Federal Ministry of the Interior can issue an exemption decree under §37 BSIG, for instance when national security or defence is concerned. In practice, this occurs rarely.

How Is an IT Service Provider Classified?

A mid-sized managed service provider (MSP) employs 60 staff with EUR 8 million in revenue and a EUR 6 million balance sheet total. Although the financial figures fall below the thresholds, the employee count of 50 or more is sufficient for classification as an important entity. The headcount threshold stands as an alternative to the financial criteria. Reaching 50 employees makes a company affected regardless of revenue and balance sheet total.

MSPs are explicitly listed as a separate entity type in Annex 1 of the BSIG (sector 6: digital infrastructure). This means dual applicability: directly through the company's own NIS2 obligations and indirectly through the supply chain requirements of its clients.

Sector classification is the most common stumbling block in the applicability assessment. The Pre-Check from NIS2Compass helps you systematically clarify your classification in a few minutes rather than weeks of internal research. What it covers is explained on the page getting started with NIS2 and the Pre-Check.

How Do I Check My NIS2 Applicability Step by Step?

The applicability assessment follows a clear decision tree: first check for special status (KRITIS, telecommunications, trust services), then determine sector affiliation, then compare against size thresholds. The BSI provides an online tool for this purpose. The NIS2Compass affectedness check asks for sector, size and KRITIS status and returns an instant initial assessment. NIS2Compass' Pre-Check goes one step further and also identifies the specific actions required. How the Pre-Check and the implementation path fit together is shown in the NIS2 getting-started use case.

Is There a Special Status That Overrides the Size Thresholds?

Some entities fall under the NIS2-Umsetzungsgesetz regardless of their size. These include KRITIS operators, trust service providers, TLD registration authorities, DNS service providers and telecommunications providers. Check first whether your company belongs to one of these categories. If so, applicability is already established.

Which Sector Does My Company Operate In?

§28 BSIG defines the affected sectors in two annexes. Annex 1 lists sectors of high criticality (energy, transport, finance, health, water, digital infrastructure, space). Annex 2 covers other critical sectors (postal services, waste, chemicals, food, manufacturing, digital services, research). Assign your main activity to one of these sectors.

Does My Company Exceed the Size Thresholds?

You qualify as an important entity from 50 employees or if annual revenue and annual balance sheet total each exceed 10 million euros. The headcount alone is sufficient; the two financial figures only count together. Essential entity status starts at 250 employees, or at over EUR 50 million in revenue and over EUR 43 million in balance sheet total.

What Obligations Arise from the Category?

In the final step, you identify your specific obligations: §33 BSIG (BSI registration), §32 BSIG (reporting obligations for security incidents), §30 BSIG (risk management measures) and §38 BSIG (executive liability). The BSI registration portal was launched on 6 January 2026, and the 3-month deadline expired on 6 March 2026. The NIS2 Guide from NIS2Compass walks you through all obligations across 8 structured chapters; the phases of self-implementation are described in the guide Implementing NIS2 without a consultant. A free first step is the NIS2 Checklist (Excel, free) to track the ten minimum measures in a structured way.

What Are the Next Steps If I Am Affected?

Affected companies must register with the BSI, implement 10 risk management measures under §30 BSIG, establish reporting processes and involve executive management. NIS2Compass supports this process across 8 chapters with ready-made templates and a structured NIS2 Implementation Guide. How to approach the implementation yourself is described in the guide Implementing NIS2 without a consultant.

Is BSI Registration Still Possible?

The registration deadline under §33 BSIG expired on 6 March 2026; the obligation remains. Companies that have not yet registered should do so without delay. Non-compliance risks fines of up to EUR 500,000. Registration is completed via the BSI portal and requires information on contact details, sector and IT infrastructure.

What Measures Does Risk Management Require?

§30 BSIG defines 10 areas of measures, including risk analysis, incident response, business continuity, supply chain security, cryptography and access controls. These measures must correspond to the state of the art and be proportionate. NIS2Compass covers all 10 areas with concrete steps and over 20 ready-made templates. Which structure this requires is covered in the article Do I need an ISMS for NIS2?

How Do the Reporting Obligations Work?

§32 BSIG prescribes a three-stage reporting procedure. An initial report must be submitted to the BSI within 24 hours. An updated report with a preliminary assessment follows within 72 hours. A final report must be submitted within one month at the latest. Without an established reporting process, you risk not only fines but also delayed responses to actual incidents.

Why Does NIS2 Also Affect Executive Management Personally?

Executive liability under §38 BSIG cannot be delegated. Managing directors and board members must approve the risk management measures, oversee their implementation, and regularly attend training. In the event of a breach of duty, they are personally liable. This topic requires early involvement. The article on NIS2 and ISMS shows which gaps existing management systems typically have.

Frequently Asked Questions

Does NIS2 Also Apply to Companies with Fewer Than 50 Employees?

Generally not: the size-cap rule applies from 50 employees, or from annual revenue and annual balance sheet total each exceeding EUR 10 million. However, the legislator has defined exceptions: qualified trust service providers, TLD registries, DNS service providers and KRITIS operators fall under the NIS2UmsuCG regardless of their size. Additionally, indirect applicability through supply chain requirements can arise when regulated clients demand security certifications.

Do I Have to Register with the BSI?

Yes. Essential and important entities are required to register with the BSI (§33 BSIG). The deadline expired on 6 March 2026. Late registration remains mandatory. The BSI portal has been live since 6 January 2026. Failure to register risks fines of up to EUR 500,000. The NIS2 Guide from NIS2Compass walks you through the registration process step by step; the remaining implementation steps are described in the guide for SMEs without a consultant.

What Is the Difference Between NIS2 and the IT Security Act?

The NIS2UmsuCG replaces the IT Security Act 2.0. The most significant change: the scope of affected companies grows from approximately 4,500 to roughly 29,500 entities. The law now covers 14 sectors in two annexes. The size thresholds drop considerably. New is the personal liability of executive management for breaches of duty. Existing KRITIS operators remain regulated as a subset.

Are Affiliated Companies Included in the Size Assessment?

Generally yes. Under §28 para. 4 BSIG in conjunction with EU Recommendation 2003/361/EC, employee count, revenue and balance sheet total of affiliated companies are aggregated. An exception applies when the IT systems are demonstrably operated independently of one another. The Pre-Check from NIS2Compass helps with an initial assessment of your applicability; more on this on the page getting started with NIS2.

Can I Apply for an Exemption Decree?

§37 BSIG allows the BMI to grant exemptions in three cases: national security, defence or law enforcement. The prerequisite is that equivalent security requirements already apply. For typical SMEs in the private sector, this route is not relevant. Instead, a structured implementation of the NIS2 requirements is recommended. The NIS2 Guide from NIS2Compass provides a clear implementation path for exactly this purpose, and the guide to implementing NIS2 without a consultant describes the individual phases.

Further answers on sector classification, thresholds and special cases are available in the official BSI FAQ on NIS-2 (German only).