Who is affected by NIS2? Five steps.

The BSI Act lists the sectors in two annexes. What counts is what you offer for payment. Activities that are negligible relative to your overall business may be disregarded when assigning a sector (§28(3) BSIG).

• Annex 1: energy, transport, finance, health, water, digital infrastructure, space.
• Annex 2: postal and courier services, waste management, chemicals, food, manufacturing (including medical devices, electronics, machinery, vehicles), digital service providers, research.

• Important entity: sector from Annex 1 or 2 and at least 50 employees, or annual turnover and balance sheet total both above €10 million.
• Essential entity: sector from Annex 1 and at least 250 employees, or annual turnover above €50 million and balance sheet total above €43 million.

Figures follow the EU Commission SME recommendation. Data from partner and linked enterprises is generally added. Exception: your company is independent of them, judged mainly by how IT systems and processes are set up and operated (§28(4) BSIG). This exception is a case-by-case assessment and should be documented.

Some entities are in scope regardless of size. Essential entities include operators of critical facilities, qualified trust service providers, top-level domain registries and DNS service providers. Public telecom providers are essential from 50 employees or above €10 million turnover and balance sheet, smaller ones are important entities. Non-qualified trust service providers are important entities regardless of size.

Cloud computing providers, data centres, content delivery networks, managed service providers and managed security service providers are listed in Annex 1 under digital infrastructure. Online marketplaces, search engines and social networks are in Annex 2. For these entity types, Implementing Regulation (EU) 2024/2690 also applies directly, with concrete requirements on secure development, security testing, patch management and vulnerability handling.

Pure application SaaS is not automatically a cloud computing service in the sense of the annex. Whether your product qualifies depends on its design and is a case-by-case assessment. Our Self-Check says "possible" in this case, not "in scope".

Even if you are out of scope, NIS2 often reaches you through customers: entities in scope must manage the security of their direct suppliers and pass requirements down through contracts and questionnaires.

Record the result, even if it is "not in scope", with sector, figures, group view and date. Check again when you grow or change your offering.

If you are in scope: registration with the BSI, the risk management measures under §30 BSIG, reporting channels for significant incidents and the duties of management. Details are in our guides on registration and on NIS2 obligations.

• Since 06.12.2025: risk management measures, reporting duty and management duties, with no transition period.
• Registration: the deadline for everyone in scope since entry into force passed on 06.03.2026. Registering late is still the right move.
• From 06.12.2028: the BSI may request evidence from essential entities without cause (§61(3) BSIG). For hospitals, 06.12.2030 is foreseen.
• No fine proceedings have been publicly documented to date. Pressure currently comes mostly from customer contracts, supplier questionnaires, insurers and the personal responsibility of management.