Step 1 · Set the scope
NIS2 scope check and registration Whether and how NIS2 applies to you.
Before planning measures, establish whether you are an essential entity, an important entity or not in scope. Obligations, supervision and the range of fines depend on it.
What it is about
Classification follows Section 28 BSIG: the sector according to Annexes 1 and 2, size measured by employees, annual turnover and balance sheet total, and special cases covered regardless of size. Entities in scope register with the BSI under Section 33 BSIG. The assessment is your own responsibility; the BSI offers an online check for it.
- SectorEnergy
- Employees480
- Annual turnover€95m
- NIS2selected
- ISO 27001selected
- AI Actselected
- CRAnot selected
Sample values
How to go about it
- 01
Map your activities to the sectors and entity types of Annexes 1 and 2.
- 02
Determine your size, counting partner and linked enterprises correctly.
- 03
Record the result in writing and justify it.
- 04
Register with the BSI and keep the details current.
Common mistakes
- Only the main business is considered and side activities are overlooked.
- Linked enterprises are missing from the size calculation.
- The result is not justified anywhere.
What an auditor wants to see
- Documented scope check with justification
- BSI registration confirmation
- Current contact details for reachability
How UniqSuite helps
In UniqSuite you record sector, size, employees and turnover – the details you need for the classification – and choose the frameworks you work on. Both go into the scope report.
References
- Section 28 BSIG: essential and important entities
- Section 33 BSIG: registration
- BSIG Annexes 1 and 2: sectors and entity types
Frequently asked questions
What if we missed the registration?
Register without delay. The obligations have applied regardless since 6 December 2025.
Is the classification final?
No. If your activities or size change, the classification can change too. Review it regularly.
From what size is a company in scope?
As an important entity in a sector of Annex 1 or 2, generally from 50 employees, or with annual turnover and balance sheet total each above €10 million. Annex 1 entities with at least 250 employees, or turnover above €50 million and a balance sheet total above €43 million, are essential entities (Section 28 BSIG).
What is the deadline for registration?
No later than three months after you first, or again, qualify as an essential or important entity (Section 33(1) BSIG).
What fines apply?
For breaches of, for example, the risk management or reporting obligations: up to €10 million for essential entities and up to €7 million for important entities. With total turnover above €500 million, up to 2% or 1.4% of total turnover respectively (Section 65 BSIG).
See what this looks like in UniqSuite.
In half an hour we walk you through it with your own questions.