Germany's NIS2 rules: group IT, MSPs and negligible activities

A subsidiary operates IT for other group companies. It employs only a few people and serves the group exclusively. Does that exempt it from NIS2, or does it make it a managed service provider?

TL;DR: Do we need to assess our group IT under NIS2?

• Do you operate IT for other group companies with administrative access? MSP classification is then likely under the BSI FAQ. Actual regulation requires further assessment.
• Do you employ fewer than 50 people? That alone is not an exemption. Linked enterprises and the other conditions can also matter for classification.
• Are you relying on a negligible activity? Assess activity shares within the respective entity. Being a small IT subsidiary compared with the whole group is insufficient.
• Do you provide only user support without technical access and relevant problem-solving competence? The BSI distinguishes this from MSP services. Other entity categories still require separate assessment.

Your next step: Record each company's activity, technical access, recipients and figures. These provide the basis for a reasoned scope decision.

This article concerns German law, as checked on 12 October 2026. It uses the current German BSIG and the BSI's FAQs. Our interpretations and illustrative examples are identified explicitly; this is not a rule applying uniformly across EU member states.

Why group IT can qualify as an MSP

The BSI's sector-specific FAQ generally treats subsidiaries operating central IT for a group as MSPs or MSSPs. Serving only other group companies does not prevent that classification.

Question 17 in the general FAQ's scope section further explains the MSP case: operational IT services with administrative access to other group companies' systems are relevant.

The BSI distinguishes two situations:

• A company takes commercial responsibility for a customer portal while another company performs the entire technical operation. Without its own relevant technical services and access, commercial responsibility alone does not establish MSP status under this FAQ.
• User support without problem-solving competence or technical access at application or system level is also distinguished from MSP services.

For your inventory, describe who actually installs, administers, operates or maintains the systems. An “IT Services” company name or an internal group contract does not answer that question by itself.

What section 28(3) BSIG actually does

Section 28(3) BSIG allows negligible business activities to be disregarded when assigning an entity to an entity type. The reference point is the entity's overall business activity.

This concerns classification. It does not change the MSP definition or replace the separate assessment of size criteria and other conditions.

The percentages and scenarios are explained in the BSI's FAQ. They are not a numerical catalogue written into this subsection. Keep the legal provision and the authority's interpretation identifiable in your assessment record.

The BSI's criteria for linked enterprises

Question 1 in the general FAQ's scope section refers to services offered exclusively within linked enterprises and two quantitative variants:

Criterion	Variant A	Variant B
Employees in the activity	Fewer than 50	Fewer than 10% of the respective entity's employees; for companies with more than 500 employees
Share of annual turnover	Less than 10%	Less than 10%
Share of annual balance sheet total	Less than 10%	Less than 10%

Reading AND and OR carefully

Our editorial presentation reads exclusively internal group services as a shared condition, with the two quantitative variants as alternatives:

Group-only services AND (Variant A OR Variant B).

Within each variant, the employee criterion, turnover share and balance sheet share are assessed together. A small turnover share alone is insufficient under this presentation. A small employee count does not replace the two financial criteria either.

The BSI's numbered list is not a statutory mathematical formula. The parentheses above express our structured reading, rather than an additional verbatim BSI statement. Any uncertainty decisive for your particular situation should be clarified.

The boundaries are strict: fewer than 50 and less than 10%. Variant B refers to more than 500 employees. Exactly 50, 10% or 500 does not satisfy the corresponding strict boundary.

The crucial reference point: the respective entity

A common mistake is to treat an IT subsidiary's share of its entire group as the share of IT activity within that subsidiary's own business.

Our interpretation: when a legally separate company provides only IT services, that activity can represent its entire business. A small share of group turnover does not establish the activity percentages at entity level described in the FAQ.

Three simplified examples

These illustrate individual assessment points. They are not complete scope assessments or BSI case decisions.

Situation	What it demonstrates
A dedicated IT subsidiary employs 30 people and operates only group IT.	The number 30 is insufficient to establish an exemption. The activity's shares of this entity's turnover and balance sheet total also need assessment.
A diversified company serves only linked enterprises; the IT activity involves 20 employees, 5% of its turnover and 4% of its balance sheet total.	These figures fit Variant A of our presentation. Other entity types and conditions still need separate assessment.
A company with 800 employees assigns 60 to this activity, with 7% of turnover and 6% of its balance sheet total, serving only the group.	60 out of 800 is 7.5%. These figures fit Variant B, even though the activity involves more than 50 employees.

Being below general NIS2 size thresholds for an activity is therefore not the same as showing that the activity is negligible under the BSI's interpretation.

Do not confuse this with group size calculations

Section 28(4) BSIG addresses employee, turnover and balance sheet figures used for the size criteria. It generally invokes the European SME recommendation and includes an exception for enterprises independent under the circumstances specified in the subsection.

For the general entity categories, section 28(1), point 4 and section 28(2), point 3 also refer to services or goods provided to other persons for remuneration. This condition also belongs in the assessment.

The size calculation is a separate question from activity shares for negligibility. A small workforce employed directly by the subsidiary is not sufficient reason to disregard it without assessment.

According to the BSI FAQ, both parent and subsidiary can be covered when each fulfils the conditions. Organising implementation centrally does not remove the need to assess the respective companies.

A common owner without a parent–subsidiary structure?

Companies can be linked enterprises for size calculations without a parent–subsidiary structure. Under Article 3(3) of the Annex to the EU SME Recommendation, a link through a natural person requires both a relevant control relationship and activities at least partly on the same or directly upstream or downstream markets.

Anonymised example, our interpretation: An individual holds a majority of voting rights in several companies. Through shared sales operations, these companies offer related business software and IT services to the same customers. This supports a possible link on the same or adjacent markets. Shared customers alone do not establish it: the actual services and their market relationship matter. Each company included in the assessment must meet the conditions.

If one company also operates the others' IT with administrative access, its potential MSP status needs separate assessment. Shared IT also weighs against assuming IT independence under section 28(4) BSIG without further examination. This does not establish final NIS2 applicability: size criteria, remuneration, activity classification and possible exceptions still need assessment.

What to document now

A useful assessment needs traceable information:

1. Entity: which company or other entity is being assessed, and what activities does it perform?
2. Technical operation: which IT services does it actually provide, for whom and with which access rights?
3. Recipients: are services provided exclusively within linked enterprises or also on the market?
4. Reference figures: how were employees, turnover and balance sheet shares allocated to the activity? Which entity and period do the figures concern?
5. Overall picture: how significant is the activity? Is it stated in the company's constitutional documents? The BSI identifies this as a possible indication against negligibility.
6. Other classifications: is another activity relevant? The FAQ excludes application of subsection 3 for operators of critical installations and certain digital services, among others.
7. Decision and changes: which source version was used, who checked the assessment and when will changed activities or figures trigger a review?

Our recommendation is to connect this reasoning with the affected processes, providers and responsibilities. A “not in scope” tick without figures or reference points provides little help when questions arise later.

Bringing this into shared GRC work

Company classification and the practical protection of group IT belong together. Processes and dependencies can show which entities depend on the same services. Third-party risk management and risk management help connect responsibilities and follow-up actions.

The mid-market page explains how existing management systems can use a shared working foundation. The NIS2 overview provides a starting point for implementation.

Kopexa supports documentation and implementation. Legal classification depends on actual circumstances and applicable rules; a software result does not replace that assessment.

This article explains the published German rules and does not replace an assessment of an individual case.