Essential Entity (NIS2)
Highly regulated undertakings under Annex I NIS2 / § 28 BSIG
TL;DR
An essential entity under Art. 3 of the NIS2 Directive or § 28 BSIG is a large enterprise (≥250 employees or ≥EUR 50 million annual turnover) in one of the 11 sectors of high criticality under Annex I (energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration, space). Such entities are subject to stricter obligations and sanctions.
What is an essential entity (NIS2)?
Two classes under NIS2 (transposed in Germany in § 28 BSIG):
| Category (EU / DE) | Size | Sectors | Maximum sanctions |
|---|---|---|---|
| Essential (EU) = particularly important (§ 28(1) BSIG) | ≥250 employees / ≥EUR 50 million | 11 Annex I sectors | EUR 10 million / 2% of turnover |
| Important (§ 28(2) BSIG) | 50-249 employees / EUR 10-50 million | 18 sectors (Annex I + II) | EUR 7 million / 1.4% of turnover |
The BSIG recognises only these two classes: 'particularly important entities' (§ 28(1) BSIG) and 'important entities' (§ 28(2) BSIG). The 'particularly important entity' is the German equivalent of the EU 'essential entity' — not a separate third category. Operators of critical installations (KRITIS) are, under § 28(1) no. 1 BSIG, a subset of the particularly important entities, not a rank of their own.
Certain sectors qualify as essential irrespective of size: the .de TLD, DNS providers, trust service providers, public administration with critical functions.
Legal position: Germany and Austria
Germany (BSIG 2025): The competent authority is the Federal Office for Information Security (BSI). The BSIG distinguishes particularly important entities (§ 28(1) BSIG — the German equivalent of the EU 'essential entity') from important entities (§ 28(2) BSIG). Particularly important entities face fines of up to EUR 10 million or 2% of worldwide annual turnover (§ 65 BSIG).
Austria (NISG 2026, BGBl. I Nr. 94/2025): Austria uses the EU term essential entities (§ 24(1) NISG 2026) alongside important entities (§ 24(2)). The decisive size threshold is that of a 'large enterprise': at least 250 employees, or an annual turnover above EUR 50 million and an annual balance sheet total above EUR 43 million (§ 25(2) NISG 2026). The competent authority is the Cybersecurity Authority (Cybersicherheitsbehörde, Austria), a subordinate authority of the Federal Minister of the Interior. Fines of up to EUR 10 million or 2% of worldwide annual turnover (§ 45(2) NISG 2026).
Example from practice
Typical essential entities:
- Municipal utilities (energy + water)
- University hospital (health, ≥250 employees)
- Large banks and cooperative banks (banking, ≥250 employees)
- Large logistics group (transport, ≥250 employees)
- Cloud provider (digital infrastructure)