Does NIS2 apply to your company? How to check it for each legal entity

A group with a holding company, a production company, a sales company in Austria and a small software subsidiary wants to know whether NIS2 applies to it. That cannot be answered for the group as a whole, because NIS2 does not look at groups. It looks at each legal entity, at what that entity does and at how big it is. Two companies in the same group can end up in different categories, and one of them can be out of scope entirely.

The check runs entity by entity, with the documents you need at each stage. It is based on the German BSI Act as amended by the NIS2 Implementation Act, which has applied since 6 December 2025. For the full picture of the duties that follow, see our guide on NIS2 in Germany.

Key takeaways

• Check every legal entity separately. The group is not the unit of assessment.
• Sector comes first. If an entity does not provide a service listed in Annex 1 or Annex 2 of the BSI Act, size does not matter.
• Size includes group data by default. Partner and linked companies count, unless the entity runs its IT independently of them.
• Some entities are in scope regardless of size, such as operators of critical facilities and DNS service providers.
• Registration with the BSI is due within three months of falling into scope.
• Write the result down. A documented check is what a customer, an auditor or the BSI will ask for.

Why one answer for the whole group does not work

Section 28 of the BSI Act describes “particularly important entities” and “important entities”. Both are defined by the type of service and by size. A holding company that only manages shares provides none of the listed services. A production company making machinery does. A software subsidiary might fall under managed ICT services if it runs systems for business customers, or under nothing at all if it sells licences only.

So the first output of the check is a simple table: one row per legal entity, with its activities, its size figures and the result. Everything else builds on that table.

The check in four questions

1. Does the entity work in a listed sector?

Annex 1 of the BSI Act covers sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management for business customers and space. Annex 2 covers other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing of medical devices, computers and electronics, electrical equipment, machinery and vehicles, digital providers such as online marketplaces, search engines and social networks, and research.

Read the sector descriptions closely. They often refer to specific activities or to EU classifications, and the details matter. A company that writes software for hospitals is not a hospital. A company that operates IT for hospitals as a managed service may well be in scope as a managed service provider.

Activities that are negligible compared to the entity’s overall business can be left out of the assessment. The law does not set a number for “negligible”, so record why you consider an activity minor, for example by its share of revenue and staff.

2. Is the entity in scope regardless of size?

A few types of entity are covered whatever their size. They include operators of critical facilities, qualified trust service providers, top-level domain registries and DNS service providers. Providers of public telecommunications networks and services also have their own rules. If one of these applies, the entity is in scope and the size test only decides the category where the law allows it.

3. Is the entity large enough?

For everyone else, the size thresholds decide. An entity is at least an important entity if it has 50 or more employees, or an annual turnover and an annual balance sheet total of more than 10 million euros each. It is large if it has 250 or more employees, or more than 50 million euros in turnover and more than 43 million euros in balance sheet total.

The figures are counted under the EU SME Recommendation 2003/361/EC. That means the data of linked companies (usually where one company controls the other) is added in full, and the data of partner companies (holdings between 25 and 50 percent) is added in proportion to the holding. A 40-person subsidiary of a large group therefore usually counts as large.

Germany added one important exception. Group data is not added if the entity is independent of its partner or linked companies with regard to the design and operation of its IT systems, components and processes, taking legal, economic and factual circumstances into account. In practice, an entity on the group’s shared ERP, directory service and network is hard to call independent. A subsidiary with its own IT, its own administrators and its own contracts may be. If you rely on this exception, document the reasoning in detail. It is the part of the check most likely to be questioned.

4. Which category?

Large entities in an Annex 1 sector are particularly important entities. Medium-sized entities in Annex 1 and medium-sized and large entities in Annex 2 are important entities. Operators of critical facilities are always particularly important. The category affects supervision and the level of fines. The security measures and the reporting duties are the same for both.

A worked example

Take the group from the start. The holding company provides no listed service and is out of scope. The production company builds machinery, an Annex 2 sector, and has 180 employees: an important entity. The Austrian sales company is checked under Austrian law, the NISG 2026, which has applied since 1 October 2026. The software subsidiary has 25 employees, sells licences and runs no systems for customers. It does not provide a listed service, so it is out of scope, even though it uses the group’s IT.

The result: one important entity in Germany, one entity to check in Austria and two entities out of scope, each with a short written justification.

What to document

• A list of all legal entities with their registered office and activities.
• Employee numbers, turnover and balance sheet for each, with the group data added where required.
• The sector mapping, with the exact entry in Annex 1 or 2, or the reason none applies.
• Any reliance on the IT independence exception or on the negligible activities rule, with evidence.
• The result per entity, the date of the check and who approved it.

Repeat the check when something changes: an acquisition, a new service, a new country or a size threshold crossed in the annual accounts. The duty to register runs from the day an entity falls into scope.

If the answer is yes

Register each entity in scope with the BSI within three months. Registration runs through the BSI portal and covers contact details, sector, size and the member states where you provide services. Then the work starts: the ten areas of security measures in Section 30, the staged incident reporting in Section 32 and the management duties in Section 38. If you already run ISO 27001 or hold a TISAX® label, much of the technical work exists. The gap is usually registration, the reporting deadlines and the management approval and training.

Where entity checks go wrong

• Checking the group instead of each entity. The result is either too wide or too narrow.
• Forgetting group data. Small subsidiaries of large groups are rarely small under NIS2.
• Claiming IT independence without evidence. A shared directory service is enough to make the claim weak.
• Reading the sector list by company name, not by activity. The question is what the entity does.
• Checking once. Scope changes with the business.

The BSI also offers an online questionnaire to help with the first assessment. It is a useful starting point. It does not replace a documented check for each entity that you can show to a customer or an auditor.