NIS2 in healthcare: who is in scope, from the clinic to medical technology
In scope are healthcare providers such as hospitals and practices, pharmaceutical companies and medical device manufacturers, once they have at least 50 employees or an annual turnover and a balance sheet total of more than EUR 10 million each (§ 28 BSIG). Health is listed in Annex 1 of the BSIG, medical technology in Annex 2. Companies in scope register with the BSI, take security measures and report significant incidents.
Who in healthcare is in scope
These types of entity are named in the BSIG. A company is in scope if it is also large enough.
§ 28 BSIG · Annexes 1 and 2
| Who | Where in the BSIG |
|---|---|
| Hospitals, practices, pharmacies and others providing healthcare | Annex 1 no. 4.1.1 |
| EU reference laboratories | Annex 1 no. 4.1.2 |
| Companies doing research and development on medicinal products | Annex 1 no. 4.1.3 |
| Manufacturers of pharmaceutical products | Annex 1 no. 4.1.4 |
| Manufacturers of medical devices considered critical during a public health emergency | Annex 1 no. 4.1.5 |
| All other manufacturers of medical devices and in vitro diagnostic medical devices | Annex 2 no. 5.1.1 |
Such a company is an important entity from 50 employees, or with an annual turnover and a balance sheet total of more than EUR 10 million each.
Only companies listed in Annex 1 can be essential entities: from 250 employees, or with more than EUR 50 million turnover and more than EUR 43 million balance sheet total, or as operators of a critical facility.
Medical technology: Annex 1 or Annex 2
Manufacturers of medical devices under the MDR and of in vitro diagnostic medical devices under the IVDR are listed in Annex 2. They are important entities from 50 employees, even if they are very large.
If a product is on the list of critical medical devices for public health emergencies under Art. 22 of Regulation (EU) 2022/123, the manufacturer falls under Annex 1. From 250 employees it is then an essential entity.
NIS2 concerns the manufacturer's IT: development, production, sales, administration. The security of the products themselves is governed by the MDR and IVDR.
Annex 1 no. 4.1.5 · Annex 2 no. 5.1.1 BSIG
What is particular about healthcare
Many networked medical devices cannot be updated by the operator. Record in the list of your assets which devices this applies to and how you protect them, for example in a separate network segment.
Health data is a special category of personal data (Art. 9 GDPR). An incident can therefore trigger one report to the BSI and another to the data protection authority.
For approved hospitals, the BSI can order evidence from 6 December 2030 at the earliest, two years later than for other essential entities.
Certain BSIG duties do not apply to gematik and operators of telematics infrastructure services, as far as the services named there are concerned.
§ 28(6) no. 2 · § 61(3) BSIG · Art. 9 and 33 GDPR
What this means for a company with 50 to 150 employees
A specialist clinic, a large medical care centre or a medical technology manufacturer of this size is usually an important entity.
A practice with fewer than 50 employees is not in scope, unless its turnover and balance sheet total are both above EUR 10 million. Linked enterprises count too.
How thorough each measure has to be depends on risk, size and cost.
§ 28(2) and (4) · § 30(1), second sentence, BSIG
An example
A made-up company: a manufacturer of laboratory diagnostic devices (in vitro diagnostics) with 120 employees.
In vitro diagnostic medical devices are listed in Annex 2 of the BSIG. With 120 employees, the company is an important entity.
It registers with the BSI, using the ELSTER organisation certificate it already uses for tax.
It writes down what it works with: development, production, quality management with the documentation under the IVDR, ERP, email and the suppliers of components and IT.
The measures follow from that, for example tested backups for the documentation and a second factor for remote access.
The managing director attends training and approves the documents.
How the walkthrough does this
In the walkthrough at nisd2.eu, the work starts with the list of what your company works with.
One step asks about processes, software, devices, rooms and networks, and who supplies them. That produces the list of your assets.
One step records your registration with the BSI.
Your answers produce your incident response plan. It also says when you additionally report to the data protection authority.
At the end, management approves the documents in the app, signed in with its own account.
Common questions
Is medical technology in scope of NIS2?
Yes. Manufacturers of medical devices and in vitro diagnostic medical devices are listed in Annex 2 of the BSIG, manufacturers of critical medical devices in Annex 1. They are in scope from 50 employees or with more than EUR 10 million each in turnover and balance sheet total.
Does NIS2 apply to medical practices?
To practices that are large enough: from 50 employees or with more than EUR 10 million each in turnover and balance sheet total. Smaller practices are not in scope.
Does NIS2 apply to care homes?
Annex 1 refers to Directive 2011/24/EU. That directive does not apply to long-term care services (Art. 1(3)(a)). Whether a care home or care service is in scope should therefore be checked case by case.
From when can the BSI inspect a hospital?
The BSI can order evidence from approved hospitals from 6 December 2030 at the earliest (§ 61(3) BSIG). The other duties have applied since 6 December 2025.
Sources
- BSI Act (BSIG) §§ 28, 30, 61, Annexes 1 and 2, gesetze-im-internet.de/bsig_2025
- Directive 2011/24/EU, Art. 1(3) and Art. 3, EUR-Lex
- Regulation (EU) 2022/123, Art. 22; Regulations (EU) 2017/745 (MDR) and 2017/746 (IVDR), EUR-Lex
- Regulation (EU) 2016/679 (GDPR), Art. 9 and 33
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Risk Management
Write down what your company has
A list of the processes, software and devices you work with.
Incident Handling
Plan what happens in an incident
Who decides, whom you call, how you reach each other.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
