Purpose
The NIS2 Implementation Act (in force since 06.12.2025) has recast the BSIG and expanded the addressee group from around 2,100 to about 29,000 entities. Who is affected results from the interplay of sector (Annex I/II to the BSIG), size thresholds and entity category. Unlike previously, there is no individual determination by the authority anymore — the entity must classify itself and register. This skill carries out the affectedness assessment and the registration.
Inputs
- Activity / sector of the entity (energy, health, transport, digital services, mechanical engineering, etc.)
- Number of employees, annual turnover, annual balance sheet total
- KRITIS status (operator of critical installations?)
- Qualified trust service provider / DNS / TLD / cloud / data centre?
- Group structure (affiliated companies for threshold calculation)
Sub-agent architecture
Three conceptual roles. A sector agent assigns the activity to the entity types from Annex I and Annex II to the BSIG. A threshold agent reviews the size thresholds (employees, turnover, balance sheet total) and the special cases in which the threshold does not apply. A registration agent determines the entity category under Section 28 BSIG and the correct registration path (Section 33 or Section 34 BSIG) including the deadline. The final classification is the responsibility of the entity itself.
Process
1. Sector assignment (Annex I / II BSIG)
- Annex I (high criticality): among others energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, space.
- Annex II (other critical sectors): among others postal/courier, waste, chemicals, food, manufacturing (incl. mechanical engineering), digital services, research.
2. Size thresholds (Section 28 BSIG)
| Category | Threshold |
|---|---|
| Particularly important entity | KRITIS operator, qualified trust service provider or Annex I type with ≥ 250 employees or > 50 million € turnover and > 43 million € balance sheet total |
| Important entity | Annex I/II type with ≥ 50 employees or > 10 million € turnover and > 10 million € balance sheet total |
- For certain types (DNS, TLD, qualified trust services, KRITIS), the size thresholds do not apply — applicability regardless of size.
- Terminology: The NIS2 Directive speaks in Art. 3 of essential and important entities; the BSIG implements this as particularly important and important entities .
3. Self-classification instead of an administrative decision
- There is no official declaratory decision; the entity bears the burden of demonstrating its self-classification.
4. Registration obligation (Sections 33/34 BSIG)
- Section 33 BSIG: general registration obligation with the BSI — within three months of fulfilling the criteria.
- Section 34 BSIG: special registration obligation for certain types (e.g. DNS service providers, TLD registries, cloud/data centre services, CDN), in some cases with additional information.
- BSI registration portal; obligation to update in the event of changes.
5. Follow-up obligations
- Applicability immediately triggers risk management (Section 30 BSIG), reporting obligations (Section 32 BSIG) and management obligations (Section 38 BSIG).
Risks / typical mistakes
- Size thresholds calculated incorrectly — affiliated companies and the removal of the threshold for special types (DNS, KRITIS) are often overlooked.
- Registration obligation missed — the three-month deadline under Section 33 BSIG runs automatically, without any request from the authorities.
- Self-classification omitted — there is no administrative decision; anyone waiting for mail from the BSI is already in default.
- Supply chainsapplicability misjudged — suppliers in Annex II sectors (e.g. mechanical engineering) may also be covered.
Sources
Statutes
- Section 28 BSIG (new version) — particularly important and important entities
- Section 33 BSIG (new version) — registration obligation
- Section 34 BSIG (new version) — special registration obligation
- Directive (EU) 2022/2555 (NIS2) — Art. 3 NIS2 Directive, Annex I / Annex II
Secondary literature
- Eckhardt, NIS2, 1st ed. 2024
- OpenKRITIS, "NIS2 Implementation Act in Germany"
Output format
NIS2-ANWENDUNGSBEREICH — <Einrichtung> — <Datum>
I. Sektor-Zuordnung (Anhang I / II) [Typ / Sektor]
II. Größenschwellen (§ 28 BSIG)
Beschäftigte / Umsatz / Bilanz <Werte> Schwelle erreicht? [Ja/Nein]
Sondertyp ohne Schwelle? [Ja/Nein]
III. Einrichtungskategorie [besonders wichtig / wichtig / nicht betroffen]
IV. Registrierungspflicht [§ 33 BSIG / § 34 BSIG] Frist: <Datum + 3 Monate>
V. Folgepflichten [§ 30 / § 32 / § 38 BSIG aktiviert]
Selbsteinstufung dokumentiert: <Begründung>
Nächster Schritt: <…>