NIS2 Affectedness Check

How the check decides: the NIS2 decision tree

The check maps the classification under §28 BSIG in three steps. One input takes precedence: operators of a critical facility are essential entities regardless of sector and size (§28(1) no. 1 BSIG).

1. 1

   Sector: does your activity fall under Annex 1 or 2 BSIG?

   Annex 1 covers, among others, energy, transport, finance, health, water, digital infrastructure (including managed services) and space. Annex 2 covers, among others, postal and courier services, waste, chemicals, food, manufacturing (e.g. machinery, vehicles, electronics, medical devices), digital providers and research. If no entity type applies, you are probably not directly in scope. Negligible secondary activities are disregarded (§28(3) BSIG).

2. 2

   Size: do you reach the medium-sized threshold?

   The threshold is at least 50 employees, or an annual turnover and balance-sheet total of more than €10M each. Below that, your company is probably not directly in scope, except for the special cases below.

3. 3

   Entity type: essential or important?

   Essential entities are companies in an Annex 1 sector with at least 250 employees, or an annual turnover above €50M and a balance-sheet total above €43M. All other companies that meet steps 1 and 2 are important entities. Annex 2 sectors always lead to important-entity status unless a critical facility is operated.

The check only asks for annual turnover and uses it as a proxy for both financial figures. If your balance-sheet total is below the relevant threshold, the result may be stricter than the legal position. The obligations of essential and important entities are substantively the same; they differ in supervision (proactive vs. reactive) and fine ranges (up to €10M or 2% vs. up to €7M or 1.4% of annual turnover).

Frequently asked questions on the NIS2 affectedness check

What does the NIS2 affectedness check ask for?

Three inputs: your sector under Annexes 1 and 2 BSIG, your size class by employees and annual turnover, and whether you operate a critical facility (KRITIS). The result appears instantly and classifies your company as an essential entity, an important entity or probably not directly in scope.

Which thresholds apply for NIS2 scope?

Important entity: at least 50 employees, or an annual turnover and balance-sheet total of more than €10M each. Essential entity (Annex 1 sectors only): at least 250 employees, or an annual turnover above €50M and a balance-sheet total above €43M (§28 BSIG). Employees are counted in annual work units under the European Commission SME recommendation, so part-time staff count proportionally.

Do employees and turnover of group companies count?

In principle, yes. §28(4) BSIG refers to the European Commission SME recommendation (2003/361/EC), under which data of partner and linked enterprises is added. It is not added if your company is legally, economically and factually independent of the group with regard to its IT systems, components and processes. The check does not ask about this separately; clarify this exception case by case.

Is the result of the check legally binding?

No. The check provides initial orientation based on sector, size class and KRITIS status. It does not ask for the balance-sheet total and uses turnover as a proxy. Special cases such as trust services or telecommunications providers have their own options in the sector field. It does not replace legal advice; the official BSI affectedness check or a case-by-case legal assessment is authoritative.

Is the check free, and is my input stored?

The check is free and requires no sign-up. It runs entirely in your browser: no inputs are transmitted to a server and no identifying data is requested.

What do I have to do if the check says I am in scope?

Four sets of obligations: registration with the BSI (§33 BSIG; the deadline has passed, register without delay), implementation of the 10 minimum risk-management measures (§30 BSIG), three-stage reporting of significant incidents (§32 BSIG), and management approval, oversight and training duties (§38 BSIG).