Scope

Who falls into which category? Annex I vs II, size thresholds, edge cases.

What you need for BSI self-registration and how the portal works.

Group with branches in multiple member states — where to register, who supervises?

When the central IT department serves group subsidiaries — does that make it a managed service provider under NIS 2 Annex I?

Common misreading: 'we supply a NIS 2 entity, so we are in scope.' What Article 2 NIS 2 actually says.

If the parent is in scope, is the subsidiary automatically in scope too? No. But here is when scope does carry over.

Annex I sector 5: when a hospital, clinic or care centre falls under NIS 2. Thresholds, special rules, KRITIS overlap.

Energy, drinking water, waste water, telecommunications, often all under one Stadtwerk. Which Annex I sectors apply and when KRITIS kicks in.

Annex I sector 3 names credit institutions. But DORA overrides Articles 21 and 23 for financial entities. What stays under NIS 2.

Annex I sector 8 (digital infrastructure) covers public electronic communications networks and services. Some providers in scope regardless of size.

Article 2 NIS 2: sector (Annex I or II) plus size (SME threshold) plus regardless-of-size overrides plus special cases. The complete scope test.

Annex I sector 1: electricity, gas, heat, oil, hydrogen. When a producer, supplier or grid operator falls under NIS 2. Size test plus EnWG carve-out.

Annex I sector 6: who supplies or distributes drinking water. Size test, KRITIS threshold (22 million m³/year), Stadtwerk constellation.

Annex I sector 7: undertakings collecting, disposing of or treating urban, domestic or industrial waste water. Size test, KRITIS threshold (500,000 population equivalents).

Annex I sector 9 (ICT service management B2B): when an MSP falls under NIS 2, Article 6(40) definition, size test.

Annex I sector 8 (digital infrastructure): providers of cloud computing services. Art. 6(30) definition, size test, CIR applicability.

Annex I sector 8: providers of data centre services. Art. 6(31) definition, size test, KRITIS threshold (3.5 MW).

Annex I sector 5 (critical medical devices) or Annex II sector 5 (medical devices generally). MDR/IVDR overlap, size test.

Annex II sector 5 (manufacturing): machinery per NACE C28. Size test, OT/IT convergence, supplier obligations.

Article 26 NIS 2: main establishment in the EU, representative duty for third-country providers, ENISA registry. When a US company still falls under NIS 2.

Article 2(1) NIS 2 and Recommendation 2003/361/EC: microenterprises are exempt by default, but Article 2(2) regardless-of-size clauses pull many back in.

Annex I sector 10 plus Article 2(2)(i) plus Article 2(4)-(11) carve-outs: federal, state and municipal administration, national security, judiciary, parliaments, central banks.

Annex I sector 8 plus Article 2(2)(b): trust service providers (eIDAS) are in scope regardless of size. Even a 5-person provider is in.

The duty to assess sits with the entity. Art. 27 NIS 2 + §33 BSIG. The three-month clock starts when the conditions are met, not when a letter arrives.