Affected entities and demarcation issues
Entities that fall under the German BSI Act (BSIG), the German implementation of the NIS2 Directive (Directive (EU) 2022/2555), must register on the portal of the Federal Office for Information Security (BSI) by March 6, 2026. However, it is estimated that only around 5,000 to 6,000 entities registered by the deadline, which is significantly fewer than the number of entities expected to be affected. Many entities have encountered uncertainties and demarcation issues when assessing their level of involvement, which has led to delays. This is particularly the case in the health sector.
Despite the types of entities listed in Annexes 1 and 2 of the BSIG, uncertainty often arises in practice. This is primarily due to vague wording, a lack of definitions for key terms and numerous references to other European and national legal acts. In the health sector, entities often must consider several sets of regulations to determine whether they are subject to the BSIG.
Healthcare providers
Annex 1 No. 4 BSIG in the sector “Health” covers healthcare providers. The law refers to the Patient Mobility Directive (Directive 2011/24/EU). According to Article 3(g) of this Directive, a healthcare provider is any natural or legal person or any other entity legally providing healthcare […]. Healthcare means health services provided by health professionals to patients to assess, maintain or restore their state of health, including the prescription, dispensation and provision of medicinal products and medical devices (Art. 3(a)).
The term is broadly defined, covering much more than just hospitals and doctors’ offices. It is precisely this broad wording, together with the BSIG’s reference to the Patient Mobility Directive, that gives rise to questions of demarcation in practice. For example, this is the case with emergency services and care services.
Emergency services
In practice, there has recently been intense debate as to whether emergency services are considered healthcare providers. This was triggered by information from the BSI, which initially did not classify emergency services as such. The BSI has since revised this assessment and now classifies emergency services as healthcare providers within the meaning of the BSIG.
In view of the purpose of the BSIG and the broad definition of healthcare, the outcome may seem understandable. However, as Stefan Hessel explains, the legal basis for this remains unclear. The Court of Justice of the European Union (CJEU) already ruled in 2019 that emergency services and qualified patient transport are to be classified as hazard prevention and thus public security (CJEU, judgment of June 27, 2019 – C‑465/17). However, Art. 2(7) of the NIS2 Directive contains an explicit exemption from the scope of application for activities in the field of public security. Against this background, it remains to be explained why the BSI now classifies emergency services as part of the health sector and thus includes them in the scope of the BSIG.
Care services
When it comes to care services, it is important to distinguish between short-term and long-term care. Long-term care is excluded from the scope of the BSIG. The Patient Mobility Directive contains a corresponding exemption for services that assist individuals in carrying out routine, everyday tasks. The explanatory memorandum to the BSIG also states that long-term care facilities are not considered to be healthcare providers under the law.
Some quarters have debated this exception dogmatically, as the NIS2 Directive itself contains no exception for long-term care and makes no reference to the exception in the Patient Mobility Directive. However, the European Commission’s current proposal to amend the NIS2 Directive, which explicitly excludes long-term care, supports this interpretation.
In practice, this raises the question of how to distinguish between long-term and short-term care. This is determined on a functional basis: long-term care primarily involves assisting with daily activities, whereas the medical treatment falls under the category of health services. There is no binding time threshold for the term “long-term care” under EU law. However, in practice, it may be appropriate to refer to Sections 14(1) and 2(1) of the Eleventh Book of the German Social Code (SGB XI) and the Ninth Book of the German Social Code (SGB IX) (six months).
Manufacturers of medical devices and IVD
In the sector “Manufacturing”, particularly among manufacturers of medical devices and in vitro diagnostic medical devices (IVD) (Annex 2 No. 5 BSIG), questions of demarcation arise in practice. This particularly applies to companies that do not manufacture products themselves but instead have them manufactured and then repackage and distribute them under their own name.
Neither the BSIG nor the NIS2 Directive contains its own definition of “manufacturer”. Like the Directive, the BSIG refers to the Medical Devices Regulation (MDR) and the In Vitro Diagnostic Medical Devices Regulation (IVDR). According to these product laws, a manufacturer is defined as a natural or legal person who manufactures or fully refurbishes a device or has a device designed, manufactured or fully refurbished, and markets that device under its name or trademark. The focus is therefore on market responsibility for the product rather than on the operational production process itself. This definition is consistent with the principles of product (safety) law.
However, the NIS2 regulation aims to ensure the cybersecurity of critical entities. Therefore, the criticality of the entity and its operational processes is particularly important. Additionally, NIS2 refers to various European regulations that employ different definitions of “manufacturer”. For instance, the REACH Regulation and the NACE classification system are linked to the manufacturing process itself. Therefore, the literature (including Hessel/Schneider, MMR 2025, 243) emphasizes that the European legislator did not intend to use an inconsistent definition of “manufacturer”. Instead, a definition of “manufacturer” related to cybersecurity should be used. According to this definition, the manufacturer under NIS2 as well as the BSIG is the party that carries out the operational manufacturing process.
Conclusion
The impact assessment under NIS2 / BSIG remains complex, particularly in the health sector. Vague terminology, numerous references to other EU regulations and conflicting regulatory objectives mean that it is often impossible to classify individual institutions at first glance.
In practice, this means that entities should not solely base their level of involvement on formal categories, but also on their specific activities and functional role in the health sector. Differentiated classification is especially important in borderline areas. The classification is complex and the implementation process is challenging and time critical. If you have any questions or require assistance with implementing NIS2, please do not hesitate to contact us.
Check now if your company is affected by NIS2 with our free NIS2 Quick-Check.
back