Important Entity (NIS2)
Mid-sized companies in 18 NIS2 sectors — obligations from 6 December 2025
TL;DR
An important entity under Art. 3 of the NIS2 Directive or § 28 BSIG is a medium-sized undertaking (50-249 employees, EUR 10-50 million annual turnover) in one of the 18 NIS2 sectors (Annex I + II) that does not qualify as an essential entity. Such entities are subject to the same risk management obligations under § 30 BSIG, but to lower sanctions.
What is an important entity (NIS2)?
The BSIG recognises only two classes (EU NIS2 terminology in brackets):
- Particularly important entity (EU: essential entity) — § 28(1) BSIG: among others, operators of critical installations (KRITIS, § 28(1) no. 1) as well as large undertakings (≥250 employees) in the sectors of high criticality — fine of up to EUR 10 million / 2%
- Important entity — § 28(2) BSIG: medium-sized undertakings (50-249 employees, or an annual turnover and an annual balance sheet total each above EUR 10 million) in the Annex 1 or Annex 2 sectors — fine of up to EUR 7 million / 1.4%
KRITIS operators are not a separate third tier but a subset of the particularly important entities (§ 28(1) no. 1 BSIG). Important entities must meet all the obligations of § 30 BSIG, but are supervised less strictly on a risk basis than particularly important entities.
Legal position: Germany and Austria
NIS2 is transposed in Germany and Austria by separate national legislation; terms, provisions and the competent authority differ.
Germany (BSIG 2025): The relevant provision is § 28 BSIG. Important entities (§ 28(2)) are entities of the types listed in Annex 1 or Annex 2 that employ at least 50 people or have an annual turnover and an annual balance sheet total each above EUR 10 million, provided they are not already a particularly important entity. The competent authority is the Federal Office for Information Security (BSI). The fine for important entities is up to EUR 7 million or 1.4% of worldwide annual turnover (§ 65 BSIG).
Austria (NISG 2026, BGBl. I Nr. 94/2025): The relevant provision is § 24(2) NISG 2026. Important entities are entities of the types listed in Annex 1 and Annex 2 that operate a large or medium-sized undertaking, as well as — irrespective of size — telecommunications and trust service providers, provided they are not already an essential entity. Under § 25(3) NISG 2026, a medium-sized undertaking exists from 50 employees onwards, or where annual turnover exceeds EUR 10 million and the annual balance sheet total exceeds EUR 10 million. The competent authority is the Cybersecurity Authority (Cybersicherheitsbehörde, Austria). The fine for important entities is up to EUR 7 million or 1.4% of worldwide annual turnover (§ 45(3) NISG 2026).
Example from practice
Typical important entities:
- Medium-sized mechanical engineering companies (50-249 employees, manufacturing sector)
- Regional banks / cooperative banks (banking)
- IT service providers (digital infrastructure sector)
- Regional logistics companies (transport)
- Mid-sized hospitals (health)