New thresholds under Germany’s cybersecurity law and their implications for international groups
Germany’s Federal Office for Information Security (BSI) has issued guidance on negligible business activities under the BSI Act (BSIG). The Act implements the EU’s NIS2 Directive, which sets cybersecurity and incident reporting requirements for regulated entities. The BSI’s FAQs introduce quantitative thresholds for group companies. International businesses with German operations should assess their relevance.
What thresholds does the BSI apply?
An international company with an establishment in Germany generally falls within the BSIG’s scope if it carries out a regulated activity and either has at least 50 employees or has an annual turnover and an annual balance sheet total each exceeding EUR 10 million, taking group data into account where required. For certain digital providers, including cloud and managed service providers, German supervision generally depends on their main EU establishment or EU representative being located in Germany.
Section 28(3) BSIG allows activities to be disregarded when determining whether an entity falls within a regulated category, if they are negligible relative to its overall business activities.
Within corporate groups, the BSI requires the activity to be supplied exclusively within the group. It must involve fewer than 50 employees and account for less than 10% of both the entity’s annual turnover and balance sheet total (total assets). For companies with more than 500 employees, an employee share below 10% may be used instead. Both financial limits still apply.
Intra-group IT as an example
The BSI expressly lists intra-group IT, including managed IT services, as an example. Yet these figures reveal little about an activity’s importance for cybersecurity. A small IT team may control access to numerous group companies’ systems and underpin their operations. Its limited share of turnover or assets does not establish that its cybersecurity role is negligible.
Is the approach consistent with EU law?
NIS2 sets a mandatory minimum level of cybersecurity protection. Article 5 permits EU Member States to impose higher standards. The Directive contains no general exclusion for negligible business activities. This raises serious questions about whether the German exception and the BSI’s thresholds comply with EU law.
What should international businesses do?
The FAQs state the BSI’s position but do not provide a binding exemption. Companies should assess each legal entity separately and document their activities, figures and reasoning. The thresholds for negligible activities must be distinguished from the rules on aggregating data from partner and linked enterprises when determining company size under Section 28(4) BSIG.
Businesses outside the EU may also face contractual security requirements from regulated German customers. Under Section 30(2), point 4 BSIG, those customers must address supply chain security, including their relationships with direct service providers. Suppliers may therefore face security requirements even if they are outside the Act’s direct scope.
Conclusion
BSI guidance offers a starting point, not a binding exemption. International businesses should document their assessment and review security requirements from German customers.
back