NIS2 Scope Check
How the check decides
For companies established in Germany. Based on the BSIG as amended on 06.12.2025, checked on 2026-10-23. Your answers stay in your browser.
Sector and size decide, some roles regardless of size. The thresholds are in Section 28 BSIG, the sectors in Annex 1 and 2.
| If you ... | Result |
|---|---|
| operate a critical facility, are a DNS service provider, a TLD registry or a qualified trust service provider | Essential entity, regardless of size (Section 28 (1) No. 1 and 2) |
| run a public telecom network or a publicly available telecom service with at least 50 employees or turnover and balance sheet total above EUR 10 million each | Essential entity (Section 28 (1) No. 3), below that important entity (Section 28 (2) No. 2) |
| serve an Annex 1 sector and have at least 250 employees or turnover above EUR 50 million and a balance sheet total above EUR 43 million | Essential entity (Section 28 (1) No. 4) |
| serve an Annex 1 or 2 sector and have at least 50 employees or turnover and balance sheet total above EUR 10 million each | Important entity (Section 28 (2) No. 3). Annex 2 leads to important entity at most |
| are another trust service provider | At least important entity (Section 28 (2) No. 1) |
| are a federal administration body | Federal administration (Section 29) |
| serve no sector of the annexes or stay below the thresholds | Not covered |
Sources: § 28, § 30, § 32, § 33, § 38, § 65, Annex 1, Annex 2 BSIG.
Method and disclaimer
The logic follows Section 28 BSIG with the thresholds of the SME recommendation 2003/361/EC, the special roles under Section 28 (1) and (2), negligible activities under Section 28 (3) and the counting rules for groups under Section 28 (4). Questions that can no longer change the result are skipped. Every answer has “Not sure”; the check then shows every result still possible and what to clarify. 25 edge cases run as an automated test.
This check is a non-binding first assessment based on Section 28 of the German BSI Act (BSIG) and its Annexes 1 and 2 (as of 2026-10-23). It is not legal advice. You must determine yourself whether your company is in scope; the BSI will not notify you. Have edge cases such as group structures, ancillary activities or critical facilities reviewed by a lawyer. The official BSI check (German only) is at betroffenheitspruefung-nis-2.bsi.de. Your answers are processed only in your browser and are not sent to us. Legal terms are translated for convenience; the German text is authoritative.
Sources: § 28, § 30, § 32, § 33, § 38, § 65, Annex 1, Annex 2 BSIG.
