NIS2 in Germany: Are You an Essential or Important Entity Under the BSIG?

The German NIS2 law and who enforces it

Germany transposes the EU NIS2 Directive through the BSI Act (BSIG). The competent supervisory and enforcement authority for the NIS2 obligations is the Federal Office for Information Security (BSI) (§ 59). The BSI also acts as the national contact point and the central reporting and information point for regulated organisations (§ 40 Abs. 1).

The key question for any business is a simple one: does the BSIG apply to me at all? German law answers this by placing organisations into two statutory categories:

• besonders wichtige Einrichtung (essential entity)
• wichtige Einrichtung (important entity)

The rules for this classification are set out in § 28 BSIG. If you fall into either category, obligations such as risk-management measures (§ 30), incident reporting (§ 32) and registration with the BSI (§ 33) apply to you. This article walks you through the § 28 tests so you can self-identify.

Important: the sectors and entity types that matter are defined in Anlage 1 (Annex 1) and Anlage 2 (Annex 2) of the BSIG. The specific list of sectors named in those annexes is [TÄPSUSTAB PARTNER-JURIST] — but the size and category logic below is directly usable for a first self-assessment.

Essential entities (besonders wichtige Einrichtung)

Under § 28 Abs. 1 BSIG, the following count as a besonders wichtige Einrichtung (essential entity):

1. Operators of critical installations (Betreiber kritischer Anlagen); 2. Qualified trust service providers, top level domain name registries or DNS service providers; 3. Providers of publicly available telecommunications services or operators of public telecommunications networks that:

• employ at least 50 staff, or
• have an annual turnover and annual balance sheet total each exceeding EUR 10 million;

4. Other natural or legal persons offering goods or services for payment that belong to one of the entity types set out in Anlage 1, and that:

• employ at least 250 staff, or
• have an annual turnover exceeding EUR 50 million and an annual balance sheet total exceeding EUR 43 million.

Entities of the federal administration are excluded from this category, unless they are at the same time operators of critical installations.

How to read this: categories 1–3 are size-independent triggers based on what you do. Category 4 is the classic "large enterprise in a listed sector" test — the equivalent of the directive's Annex I sectors combined with large-enterprise thresholds.

Important entities (wichtige Einrichtung)

Under § 28 Abs. 2 BSIG, the following count as a wichtige Einrichtung (important entity):

1. Trust service providers; 2. Providers of publicly available telecommunications services or operators of public telecommunications networks that:

• employ fewer than 50 staff, and
• have an annual turnover or annual balance sheet total of EUR 10 million or less;

3. Other natural or legal persons offering goods or services for payment that belong to one of the entity types set out in Anlage 1 or Anlage 2, and that:

• employ at least 50 staff, or
• have an annual turnover and annual balance sheet total each exceeding EUR 10 million.

Besonders wichtige Einrichtungen and entities of the federal administration are excluded from this category.

In practice, the wichtige Einrichtung category captures medium-sized organisations in the listed sectors that do not reach the higher "essential" thresholds. Note that category 3 references both Anlage 1 and Anlage 2, so a wider set of sectors can fall into the important-entity band.

A helpful rule of thumb for category-4/3 businesses:

These thresholds only bite once your activity matches a listed Anlage 1 / Anlage 2 entity type.

How to count staff, turnover and balance sheet

The thresholds are meaningless without a consistent counting method. § 28 Abs. 4 BSIG specifies that, when determining staff numbers, annual turnover and annual balance sheet total, the Commission Recommendation (2003/361/EG) applies (with the exception of Article 3 paragraph 4 of its Annex).

One important nuance: data of partner or linked enterprises within the meaning of Recommendation 2003/361/EG need not be added where the enterprise, taking account of the legal, economic and factual circumstances relating to the nature and operation of its IT systems, components and processes, is independent of its partner or linked enterprises (§ 28 Abs. 4 Satz 2).

A further practical point from § 28 Abs. 3 BSIG: when assigning your organisation to an entity type under Anlage 1 or 2, business activities that are negligible in relation to your overall business can be disregarded. In other words, a tiny incidental activity in a listed sector does not automatically pull an otherwise out-of-scope company into scope.

Be aware of sector-specific carve-outs too. For example, certain provisions do not apply to financial entities already covered by Regulation (EU) 2022/2554 (DORA) as set out in § 28 Abs. 6, and there are special rules for telecommunications and energy operators in § 28 Abs. 5.

Why classification matters: obligations and penalties

Once you are classified, concrete duties follow:

• Risk-management measures — both essential and important entities must take appropriate and proportionate technical and organisational measures (§ 30). The measures must cover at least the areas listed in § 30 Abs. 2 (e.g. incident handling, business continuity, supply chain security, cryptography, multi-factor authentication).
• Management accountability — the management bodies must implement and oversee these measures and undergo regular training (§ 38).
• Incident reporting — significant incidents must be reported to the joint reporting point of the BSI and the Federal Office of Civil Protection and Disaster Assistance, with an early warning within 24 hours, a notification within 72 hours, and a final report within one month (§ 32).
• Registration — you must register with the BSI within three months of first (or again) qualifying as an entity (§ 33).

The classification also determines your maximum fine exposure under § 65:

Getting your classification right is therefore the foundation of NIS2 compliance in Germany. Our free scoping and gap tool helps you run the § 28 test against your headcount, turnover and activities — and shows where your current controls stand.