Complass – Navigate compliance Complass – Navigate compliance
Language EN
Deutsch English Français Italiano Español Nederlands Polski Português
Try for free

NIS2, CRA and more: is your company affected?

A first assessment of NIS2 (§ 28 BSIG), KRITIS, the Cyber Resilience Act, the Machinery Regulation, plus ISO 27001, IEC 62443 and TISAX as voluntary evidence. For all industries, with particular depth for industry and OT. No sign-up, a few minutes.

Company

All questions are voluntary; an unanswered question counts as “don’t know”. Assumed condition: activity for payment.

1. Where is your company established?

NIS2 transposes EU law nationally; this check assesses the German transposition (BSIG). The Cyber Resilience Act and the Machinery Regulation apply directly across the EU.

2. Industry

Only for orientation and the non-binding hints below; question 3 is what counts for the legal consequences.

Activity

3. Exact activity under NIS2 (Annex 1/2 BSIG)

Choose the activity that fits best. The groups correspond to the sectors of Annexes 1 and 2 BSIG.

What counts is what your company actually does, not the industry. Activities that are only a negligible part of your business are left out (§ 28 para. 3 BSIG). If none fits, choose “None of these”.

Size

This means your company as a legal entity, for example the limited company, with all sites together, not a single site. Whether the figures of a corporate group count as well is asked in the next step. The last annual financial statements apply.

4. Employees

Full-time staff count as 1, part-time and seasonal staff proportionally. Apprentices and staff on maternity or parental leave are not counted. Example: 40 full-time and 20 half-time staff make 50.

5. Annual turnover

Turnover excluding VAT according to the profit and loss account.

6. Balance sheet total

The total of the assets side of your balance sheet. You find it in the annual financial statements, or your tax adviser has it.

From 50 employees your company counts as a medium-sized enterprise. The same applies if turnover and balance sheet total are both above €10 million. If you are unsure, choose “Don’t know”; the result then shows what to check.

Corporate group

7. Corporate group

A group exists if another company holds at least 25 % of your company, for example a parent company, or your company holds at least 25 % of another. If your IT is independent of the group, only your own figures count (§ 28 para. 4 BSIG).

How shareholdings and shared IT count
  • More than 50 % or a controlling influence (linked enterprise): the figures count in full. This applies to the parent company, your subsidiaries and the sister companies under the same parent.
  • 25 to 50 % (partner enterprise): the figures count proportionally, according to the shareholding.
  • Below 25 %: does not count, you are independent. Shareholdings of venture capital firms, business angels or universities of up to 50 % may not count either.
  • Independent IT means separate legally, economically and in practice: own systems and networks, own IT operation or own service provider, own decisions on security.
  • Shared IT is, for example, a group data centre, a shared network or shared sign-in (Active Directory) or a central IT department of the parent company.

Example: the parent company holds 100 % of your company, but your IT runs completely separately. Then only your own figures count. You should be able to prove the independence. If in doubt, choose “IT shared”.

Only fill in if you chose “Part of a group, IT shared”. Then the group’s figures count: all linked companies together, including your own, with shareholdings between 25 and 50 % proportionally. If in doubt, ask your group accounting.

Employees of the group
Annual turnover of the group
Balance sheet total of the group

Special activities

8. Do you operate a critical facility (KRITIS)?

Critical facilities usually supply at least 500,000 people, for example large power plants, waterworks or hospitals above a certain number of cases. The thresholds are set out in the BSI KRITIS Ordinance. Operators usually know, because they are registered with the BSI.

9. Special cases (optional, multiple choice)

These activities fall under NIS2 regardless of size: electronic signatures, seals or time stamps (trust services), DNS services or a top-level domain, public telecommunications networks or services. For banks, insurers and other financial entities, DORA takes precedence.

Products and machinery

10. Products with digital elements

This means hardware and software that can be connected to a device or network, for example controllers, connected devices, apps or firmware. Whoever sells a product under their own name counts as the manufacturer, even if someone else built it.

11. Machinery

A machine is substantially modified if a conversion creates new hazards that the manufacturer had not foreseen. Whoever does this counts as the manufacturer. This also applies to machinery you build for your own operations.

Voluntary evidence

12. Customer requirements (optional, multiple choice)

Choose what customers require from you in contracts, requests or supplier audits. TISAX is mainly required by the automotive industry. Even if NIS2 or the CRA do not apply to you directly, affected customers often pass their obligations on to suppliers and service providers by contract.

13. Artificial intelligence

Even using AI tools such as ChatGPT or Copilot in the company brings obligations, for example on the AI literacy of staff. Whoever develops AI systems or distributes them under their own name has considerably more obligations.

What do these frameworks mean?

NIS2 (implemented in the German BSI Act) obliges operators in certain sectors above a minimum size to risk management, registration and reporting. More on NIS2

KRITIS (KRITIS Umbrella Act) concerns operators of critical facilities regardless of size and requires resilience measures. More on the KRITIS Umbrella Act

Cyber Resilience Act requires manufacturers, importers and distributors of products with digital elements to provide cybersecurity throughout the lifecycle, across the EU. More on the CRA

Machinery Regulation adds cybersecurity requirements for control systems to the CE marking of machinery, across the EU. More on the Machinery Regulation

ISO 27001, IEC 62443 and TISAX are not legal duties but evidence often required by customers or contracts. More on ISO 27001 · More on IEC 62443

A non-binding first assessment, not legal advice. The result is based solely on your answers and standardised rules; it replaces neither your own assessment nor self-identification towards the authorities. Rule file 2026.10.3, as of 2026-10-10.
Data protection: The GDPR applies to almost every company that processes personal data. It is not part of this check. With the GDPR module, you implement data protection demonstrably in Complass. More on the GDPR

Frequently asked questions about the applicability check

Is the result legally binding?

No. It is a non-binding first assessment based on your answers and standardised rules, not legal advice.

Are my answers stored?

No. The evaluation happens only in memory and is never stored or logged, unless you explicitly send the result along with a demo request.

Where do the thresholds come from?

From § 28 BSIG, the BSI Critical Infrastructures Ordinance, the Cyber Resilience Act and the Machinery Regulation; the citations are shown with every result.

What does “review open” mean?

Your answers do not yet allow a final conclusion; a missing answer never automatically leads to “not affected”.

My company is not established in Germany. Does the check still apply?

As EU regulations, the Cyber Resilience Act and the Machinery Regulation apply directly in all member states (Machinery Regulation from 20 January 2027). For NIS2, each member state transposes the directive nationally; this check only assesses the German transposition (BSIG) and shows “review open” for it.

What about the GDPR?

The GDPR applies to almost every company that processes personal data. It is not part of this check. With the GDPR module, you implement data protection demonstrably in Complass.

Does the AI Act apply to us?

Anyone using AI in the company must take measures to promote the AI literacy of its staff (Art. 4 AI Act, as amended since 27.07.2026). No particular level or certificate is required, but you should be able to document the measures. Further duties depend on the use case and are staged; please check the current state.

Can I save or print the result?

Yes, via your browser’s print function; there is no server-side PDF export.

What do I do with the result?

You will find first steps for each framework and, at the end, a matching package suggestion; a demo shows you Complass with your own example.

Try Complass with your own data

Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.

Try for free Request a demo