Knowledge · NIS2

Who is affected by NIS2 specifically?

NIS2 significantly expands the scope compared to NIS1. Instead of around 2,000 operators in Germany, an estimated 29,000 companies will be subject to the new obligations in the future — including many mid-sized companies in the manufacturing sector.

The directive distinguishes between two categories: essential entities (e.g., energy, water, transport, large manufacturers of certain products) and important entities (e.g., postal & courier, waste management, chemicals, food, manufacturing).

Whether you are affected depends on sector, number of employees and annual revenue.

Who is affected by NIS2: affected sectors and company sizes

— The size threshold: when does NIS2 apply? —

Micro-enterprises generally exempt

Medium-sized enterprises: from 50 employees OR €10M revenue

Large enterprises: from 250 employees OR €50M revenue

Supply chain: indirectly via customer requirements

Essential entities (sectors with high criticality)

Energy (electricity, gas, oil, district heating, hydrogen)
Transport (air, rail, water, road)
Banking and financial market infrastructures
Healthcare
Drinking water, wastewater
Digital infrastructure, ICT services, public administration
Space

Important entities (other critical sectors)

Postal and courier services
Waste management
Manufacture, production and distribution of chemicals
Production, processing and distribution of food
Manufacturing (medical devices, electronics, mechanical engineering, motor vehicles, other vehicles)
Digital service providers (online marketplaces, search engines, social networks)
Research

How to check if you are affected in 3 steps

Clarify sector: Does your business fall under one of the sectors above?
Check size: Do you meet the thresholds for medium or large enterprises?
Consider supply chain: Even those not directly affected are often contractually obliged by customers to comply with NIS2 levels.