Care delivery is Annex I, device makers mostly Annex II.

Most likely yes. Annex 1 of the German BSIG (NIS-2 Annex I) covers healthcare facilities as a sector of high criticality. From 50 employees, or when turnover and balance sheet total each exceed 10 million euros, the usual classification is important entity; essential entity follows from 250 employees, or annual turnover above 50 million euros and a balance sheet total above 43 million euros. From 30,000 inpatient cases per year, the German KRITIS regulation adds up. The legally binding evaluation remains a matter for counsel.

Hospital IT security has been regulated in German social law since 2022, first in § 75c SGB V and, since the 2024 Digital Act, in § 391 SGB V. In principle it covers all hospitals; KRITIS hospitals are exempt to the extent they already have to take measures under sections 30, 31 and 39 of the German BSIG (§ 391 Abs. 5 SGB V). Implementation can follow the B3S Krankenhaus, the sector-specific security standard. NIS-2 is a general law with minimum measures, the B3S is more concrete for the sector. In practice they largely overlap.

Legacy medical devices without patch capability are common. NIS-2 requires appropriate measures at the state of the art. Compensating controls (network segmentation, monitoring, restricted connectivity) are accepted. Documented risk acceptance instead of sweeping under the rug. On patient safety impact the MDR manufacturer must be notified.

Multiple escalation paths: staggered BSI report under § 32 BSIG (24-hour initial report, 72-hour report, final report), data-protection authority on data breach, hospital supervisor at state level, MDR manufacturer on device involvement. Plus patient-safety triage (ensure emergency care). A special rule covers the German telematics infrastructure (TI): § 28 Abs. 6 Nr. 2 BSIG exempts gematik, the German digital health agency, as a whole from core BSIG duties, operators of TI services for their approved services, and other operators only where they use the TI for confirmed applications. The platform supports with documented reporting paths inventory.

For a 250- to 500-bed hospital, typically 16 to 24 weeks to become audit-ready for NIS-2, depending on KRITIS status, IT modernisation level and number of sites. The platform licence is priced by modules and digitally connected people. The risk check gives you a specific indication.