NIS2 in Germany: what the Implementation Act requires since December 2025

A machine builder with 180 employees receives a supplier questionnaire from a large customer. Question 14: “Are you subject to NIS2? If so, please confirm your registration with the competent authority.” The IT lead forwards it to the managing director, who forwards it back with one line: “Are we?”

In Germany, that question has had a binding answer since 6 December 2025, when the NIS2 Implementation Act (NIS2UmsuCG) came into force. It rewrote the BSI Act and widened the circle of regulated companies from a few thousand operators of critical infrastructure to around 29,500 companies, according to official estimates. There was no transition period.

Key takeaways

• The law has applied since 6 December 2025, without a transition period. Companies in scope on that day had to register with the BSI by 6 March 2026.
• Scope depends on sector and size. As a rule of thumb: from 50 employees, or more than 10 million euros in turnover and balance sheet, in one of the listed sectors.
• Ten areas of security measures are required, from risk analysis and backups to supply chain security and multi-factor authentication.
• Significant incidents must be reported to the BSI within 24 hours, 72 hours and one month.
• Management is personally responsible for implementing and overseeing the measures, and must be trained regularly.
• ISO 27001 or TISAX® give you a head start, but not full coverage. Registration, reporting deadlines and management duties are new.

What the NIS2 Implementation Act is

NIS2 is an EU directive, Directive (EU) 2022/2555. Directives do not apply directly; each member state has to turn them into national law. Germany did this with the NIS2 Implementation and Cybersecurity Strengthening Act, published in the Federal Law Gazette on 5 December 2025 and in force the next day. Most of the obligations for companies now sit in the new BSI Act (BSIG), which is why you will see references like “Section 30 BSIG” rather than article numbers from the directive.

Are you in scope?

Section 28 BSIG combines two tests: does your company work in one of the sectors listed in Annex 1 or Annex 2 of the law, and is it large enough?

Particularly important entities are large companies in an Annex 1 sector, such as energy, transport, banking, health, digital infrastructure or managed ICT services: 250 or more employees, or more than 50 million euros in turnover and more than 43 million euros in balance sheet total.

Important entities are medium-sized companies in Annex 1 sectors, and medium-sized and large companies in Annex 2 sectors, such as postal services, waste management, chemicals, food, manufacturing of machinery, vehicles and electronics, and digital providers like online marketplaces and search engines: 50 or more employees, or more than 10 million euros in both turnover and balance sheet.

Some entities are in scope regardless of size, including operators of critical facilities, qualified trust service providers, top-level domain registries and DNS service providers.

Two details catch many companies out. First, size is counted under the EU SME Recommendation, so the figures of partner and linked companies are added: a 40-person subsidiary of a large group usually does not count as small. Germany makes one exception. Group data is not added if the company is independent of its partner or linked companies in the design and operation of its IT systems, components and processes. Second, activities that are negligible compared to your overall business can be disregarded. Our guide on checking NIS2 applicability per entity goes through both rules in detail. Our machine builder is in an Annex 2 sector with more than 50 employees. It is an important entity.

Register with the BSI

Companies in scope must register with the BSI within three months of falling under the law. For everyone in scope on 6 December 2025, the deadline was 6 March 2026. Registration runs through the BSI portal and covers contact details, sector, size and the member states in which you provide services. Changes have to be reported within two weeks. If a company does not register, the BSI can register it itself.

If you are reading this and realise you are in scope, register now. A late registration is a far smaller problem than none.

The ten areas of security measures

Section 30 BSIG requires appropriate, proportionate technical and organisational measures, based on an all-hazards approach. They have to cover at least these ten areas:

1. Risk analysis and information security policies
2. Incident handling
3. Business continuity, including backup management, disaster recovery and crisis management
4. Supply chain security, including the relationship with direct suppliers and service providers
5. Security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosure
6. Policies and procedures to assess the effectiveness of the measures
7. Basic cyber hygiene and security training
8. Cryptography and encryption
9. Human resources security, access control and asset management
10. Multi-factor authentication, secured voice, video and text communication, and secured emergency communication

You also have to document the measures. “We do this” is not enough; you need to be able to show it.

Reporting significant incidents

A security incident is significant if it has caused or can cause severe operational disruption or financial loss, or if it affects other people through considerable material or immaterial damage. Significant incidents are reported to the joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK), in up to four stages.

The early warning within 24 hours says whether you suspect an unlawful or malicious act and whether the incident could have cross-border effects. The notification within 72 hours adds an initial assessment of severity and impact and, where available, indicators of compromise. The BSI can ask for an interim report. The final report is due one month after the notification and covers the root cause, the measures taken and any cross-border impact.

The clock starts when you become aware of the incident, not when the analysis is finished. Whoever is on call on a Saturday has to know that, and has to have access to the reporting channel.

What management has to do

Section 38 BSIG makes the management body responsible for implementing the security measures and overseeing their implementation. The task can be delegated; the responsibility cannot. Managing directors who breach these duties can be held liable to the company. Members of management also have to take part in training regularly, so that they can identify risks and assess risk management practices.

In practice, this means a documented decision by management on the measures, regular reporting on their status, and proof of training. A board update twice a year with a clear status per area is a good minimum.

Supervision and fines

The BSI supervises compliance and can request evidence, order audits and issue instructions. Particularly important entities are supervised more actively; important entities mainly after an indication of a problem. Fines go up to 10 million euros for particularly important entities and up to 7 million euros for important entities. For large groups, the maximum is 2 percent or 1.4 percent of worldwide annual turnover, whichever is higher.

The head start from ISO 27001 and TISAX®

If you already run an ISMS under ISO 27001 or hold a TISAX® label, most of the technical measures exist. Access control, backups, encryption, vulnerability handling and supplier security are all in Annex A. What is usually missing is the NIS2-specific layer: registration, the 24-hour reporting step in the incident process, the management approval and training, and a mapping that shows which control covers which measure. Our guide on multi-framework control mapping walks through exactly this case.

A note for Austria

Austria implemented NIS2 with the Network and Information Systems Security Act 2026 (NISG 2026), published on 23 December 2025. It has applied since 1 October 2026. The size thresholds are the same, entities have three months to register, and the new Federal Office for Cybersecurity is the competent authority. Reporting follows the same 24-hour, 72-hour and one-month pattern. The Austrian Economic Chamber expects around 4,000 companies and organisations to be affected. Fines reach 10 million euros or 2 percent of worldwide turnover for essential entities and 7 million euros or 1.4 percent for important ones.

What to do now

1. Check scope for every legal entity, including group companies, using sector and size.
2. Register with the BSI if you have not already, and name who keeps the data current.
3. Run a gap analysis against the ten areas, starting from the controls you already have.
4. Add the reporting deadlines to your incident process, with a named decision-maker and deputy, and test it.
5. Get a management decision on the measures and schedule the training.
6. Review your critical suppliers and their contracts.
7. Document everything, so you can answer the BSI and the next customer questionnaire with evidence.