Essential entities and important entities

(1) The following are deemed essential entities: 1. operators of critical facilities, 2. qualified trust service providers, Top Level Domain Name Registries or DNS service providers, 3. providers of publicly available telecommunications services or operators of public telecommunications networks that a) employ at least 50 staff, or b) have an annual turnover and an annual balance-sheet total each exceeding EUR 10 million, 4. other natural or legal persons, or organisational units of a local authority without legal personality of their own, that offer goods or services for consideration to other natural or legal persons and that fall within one of the types of entity specified in Annex 1, and that a) employ at least 250 staff, or b) have an annual turnover exceeding EUR 50 million and, in addition, an annual balance-sheet total exceeding EUR 43 million. Federal administration entities are exempt from this, unless they are at the same time operators of critical facilities.
(2) The following are deemed important entities: 1. trust service providers, 2. providers of publicly available telecommunications services or operators of public telecommunications networks that a) employ fewer than 50 staff, and b) have an annual turnover or an annual balance-sheet total each of EUR 10 million or less, 3. other natural or legal persons, or organisational units of a local authority without legal personality of their own, that offer goods or services for consideration to other natural or legal persons and that fall within one of the types of entity specified in Annexes 1 and 2, and that a) employ at least 50 staff, or b) have an annual turnover and an annual balance-sheet total each exceeding EUR 10 million. Essential entities and federal administration entities are exempt from this.
(3) In assigning an entity to one of the types of entity under Annexes 1 and 2, business activities that are negligible having regard to the entity's overall business activity may be disregarded.
(4) In determining the number of staff, annual turnover and annual balance-sheet total under subsections (1) and (2), Commission Recommendation 2003/361/EC, with the exception of Article 3(4) of the Annex, must be applied, except for organisational units of a local authority without legal personality of their own. The data of partner or linked undertakings within the meaning of Commission Recommendation 2003/361/EC need not be added where the undertaking is, having regard to the legal, economic and factual circumstances and to the nature and operation of the information technology systems, components and processes, independent of its partner or linked undertakings.
(5) Sections 30, 31, 32, 35, 36, 38, 39, 61 and 62 do not apply to essential entities and important entities that 1. operate a public telecommunications network or provide publicly available telecommunications services, or 2. operate energy supply networks, energy installations or digital energy services under the Energy Industry Act and are subject to the provisions of sections 5c to 5e of the Energy Industry Act. The first sentence does not apply to the essential and important entities listed there insofar as, beyond the facilities named in the first sentence, nos. 1 and 2, they operate further critical facilities under section 2, no. 22 or, on account of further activities, fall within one of the types of entity specified in Annex 1 or 2. The second sentence applies to all information technology systems necessary for operating the further critical facilities. Where the operation of an energy installation under the first sentence, no. 2 constitutes, having regard to the overall business activity of an essential and important entity listed in the first sentence, an ancillary activity, this subsection does not apply.
(6) Sections 30, 31, 32, 35, 36, 38 and 39 do not apply to 1. financial undertakings under Article 2(2) of Regulation (EU) 2022/2554, and undertakings to which the requirements of Regulation (EU) 2022/2554 apply on the basis of section 1a(2) and (2a) of the Banking Act or section 293(5) of the Insurance Supervision Act, 2. the Gesellschaft für Telematik under section 306(1), third sentence of Book Five of the Social Code, operators of telematics infrastructure services with regard to the services approved under section 311(6) and section 325 of Book Five of the Social Code, and operators of services insofar as they use the telematics infrastructure for applications confirmed under section 327(2) to (5) of Book Five of the Social Code.
(7) Section 32 does not apply to operators of critical facilities insofar as they operate a facility for undertakings under subsection (6), no. 1.
(8) This Act does not apply to organisational units of local authorities without legal personality of their own, and to legal persons in which only local authorities, excluding the Federation, hold interests, where 1. they were established for the purpose of providing services for administrations on public mandate, and 2. they are regulated by comparable Land-law provisions referring to this subsection.