Breaking News: BSI Changes Its Classification of Intra-Group MSPs

During the legislative process, the Federal Office for Information Security (BSI) had already taken the view that a subsidiary providing IT services to its group qualifies as a managed service provider (MSP) under NIS2. The same applied where the parent company provided IT services for the whole group. In practice, many groups therefore fell within the scope of NIS2 even though they operated in industries outside the NIS2 sectors.

The BSI has now changed this assessment. In its latest FAQs, it takes the view that such IT activities may be treated as negligible if they stay below certain thresholds. This is of considerable practical importance, as it changes the classification of numerous groups.

The Previous Position: Group IT Is Generally an MSP

The sector FAQ "Digital Infrastructure" (No. 2) has stated for some time:

"Yes, subsidiaries in which the central IT operations of a group of undertakings are organised are likely, as a rule, to be regarded as managed service providers (MSP) or managed security service providers (MSSP)."

New: The Interpretative Guidance on Section 28(3) BSIG

In the general NIS2 FAQ (section "Scope", No. 1), the BSI now explains in detail what "negligible" means. This expressly includes affiliated undertakings.

• General criteria: Relevant indicators include the number of employees in the business area concerned, the turnover generated there and the balance sheet total. If the activity is mentioned in the articles of association, the statutes or a comparable constitutional document, this points against negligibility. The decisive factor is the overall picture in relation to the entity's business activities as a whole.

• Individual undertakings: Activities that serve exclusively internal purposes are negligible. As an example, the BSI expressly refers to "internal IT, including managed IT", provided it is not offered on the market and is provided internally only.

• Affiliated undertakings: Activities are negligible if

  • the entity offers them exclusively within the group, and
  • they account for fewer than 50 employees and for less than 10% of both annual turnover and the annual balance sheet total, or
  • in the case of undertakings with more than 500 employees, they account for less than 10% of the employees and for less than 10% of both annual turnover and the annual balance sheet total.

As an example, the BSI expressly refers to "group IT, including managed group IT", provided these thresholds are not exceeded.

What Does This Mean?

In the view of the competent supervisory authority, IT services provided within a group are therefore negligible, and so do not constitute an MSP, if they stay below these thresholds. This will be the case for many groups of companies. However, the problem of Germany's particular approach (deutscher Sonderweg) and the possible incompatibility of this provision with EU law remains.

Opinions may differ on the reasoning, but the result is correct. Many groups centralise their IT services, either in the parent company or in an IT subsidiary. Under the previous administrative practice, this brought groups within the scope of NIS2 even when they came from industries that were not meant to be regulated, such as construction and real estate, animal feed, agriculture and forestry, fisheries, the liberal professions and consultancy. The BSI has now corrected this mistaken view, which is a welcome outcome. It remains to be seen how long this position will last and whether the courts will agree with the BSI. Further changes to the legal position, or further clarification of it, cannot be ruled out.