NIS2 in GermanyObligations, Deadlines and Liability under the new BSIG

Christian Horres

Expert in Business Continuity Management (BCM), risk management, and organisational resilience, particularly in the context of critical infrastructures. His focus is on Business Impact Analyses (BIA), risk analyses, and the development and enhancement of BCM and crisis management structures. Within the NOVELEDGE network, he supports organisations in the practical implementation of resilient structures, considering international standards such as ISO 22301, ISO 27001, and ISO 31000, as well as applicable regulations.

The deadline has passed. The NIS2 Implementation Act has been in force in Germany since 6 December 2025^[1]. The legal obligation to register with the BSI ended on 6 March 2026. The BSI suspended enforcement until 31 July 2026^[2] – this leniency ended in August 2026. Anyone not registered by today is in violation of regulations.

This article clarifies who is affected, what specific obligations apply, which deadlines are running, and what management must personally account for.

What applies since 6 December 2025

The European NIS2 Directive^[3] was transposed into national law in Germany through the NIS2 Implementation and Cybersecurity Strengthening Act. The core of the implementation is a completely revised BSI Act (BSIG^[4]). All paragraph references in this article relate to this version^[5].

The crucial difference from the previous KRITIS regulation^[6]: The scope is many times larger. Where previously a few hundred operators of critical facilities were regulated, it now concerns a five-digit number of institutions. Estimates from the specialist literature suggest around 30,000 affected companies in Germany.

Many of them are unaware of this. Unlike with KRITIS, there is no official notification confirming one’s affected status. You must assess yourself whether the law applies to you – and you are liable for the outcome.

Why there is no „NIS2 Act“

The Structure of the Implementation Act

NIS-2 is a directive of the European Union. A directive does not apply directly in the member states but obliges them to implement the objective in their own legislation. Germany has done this with the NIS-2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG).

Those looking for this law will not find it as a cohesive text. It is an article law, meaning an amendment law: It does not create a new individual regulation but amends existing laws in many places simultaneously. This is precisely why the question often arises in consultations, „where exactly are the NIS2 obligations located?“ They are distributed – and very unevenly distributed.

What This Practically Means

For most institutions, the BSIG is the only relevant text. Registration, reporting, risk management measures, evidence, management duties, and fines are all found there. Those who are not energy suppliers or telecommunications providers can safely ignore the other articles of the Implementation Act.

For regulated sectors, a second level is added. A network operator will find its obligations not only in the BSIG but also in the EnWG, a telecommunications provider in the TKG. These sectoral regulations are not a copy of the BSIG but transfer its logic to the already existing sectoral supervision. Practical consequence: two supervisory strands that need to be coordinated.

The editorial level is not a mere formality. Reference changes may sound harmless, but they are the most common reason for outdated internal documents. If your emergency or reporting documentation still refers to paragraphs of the old BSIG, you may be citing a regulation that no longer exists in that form. Therefore, aligning references in guidelines, contracts, and reporting processes is part of the implementation.

Are You Affected? The Examination According to § 28 BSIG

The impact is determined by two conditions, both of which must be met: Your company belongs to one of the listed sectors, and it meets certain size thresholds.

Step 1

Do You Belong to a Covered Sector?

The law distinguishes between two annexes. Annex 1 includes sectors with particularly high criticality:

• Energy – Electricity, district heating and cooling, fuel and heating oil, gas including hydrogen
• Transport and Traffic – Air, rail, maritime, road
• Finance – Banking and financial market infrastructures
• Health – Healthcare providers, reference laboratories, pharmaceutical production, manufacturers of critical medical devices
• Water – Drinking water supply and wastewater disposal
• Digital Infrastructure – Internet nodes, DNS services, cloud computing, data centres, content delivery networks, telecommunications
• Space – Operators of certain ground infrastructures

Annex 2 covers additional sectors whose facilities are considered important:

• Postal and Courier Services
• Waste Management
• Chemicals – Production, manufacturing and trade
• Food – Production, processing and distribution
• Manufacturing – Medical devices, data processing equipment, electrical equipment, mechanical engineering, motor vehicles, other vehicle construction
• Providers of Digital Services – Online marketplaces, search engines, social networks
• Research – Research institutions

The manufacturing industry in particular is often overlooked. An engineering company with 80 employees is not critical infrastructure in the traditional sense – but under the new BSIG, it is indeed an important facility.

Step 2

Do you meet the size thresholds?

You are considered a particularly important facility under § 28 paragraph 1 BSIG if any of these cases apply:

• You operate a critical facility as defined in § 2 number 22 BSIG
• You are a qualified trust service provider, TLD registry, or DNS service provider
• You are a telecommunications provider with at least 50 employees or more than 10 million euros in annual turnover and balance sheet total
• You belong to a sector listed in Annex 1 and employ at least 250 people or achieve more than 50 million euros in annual turnover with a simultaneous balance sheet total of more than 43 million euros

You are considered an important facility under § 28 paragraph 2 BSIG if you belong to a sector listed in Annex 1 or Annex 2 and employ at least 50 people or achieve more than 10 million euros in annual turnover and balance sheet total. All trust service providers also fall under this category.

The difference between the two categories does not concern the substantive obligations – these are largely identical – but rather the intensity of supervision and the level of fines.

The Registration Obligation under § 33 BSIG

Affected facilities must register with the BSI. Information to be provided includes, among others, name, legal form, contact details of an always accessible office, the IP address ranges used, sector and sub-sector, as well as the EU states where services are provided.

A violation of the registration obligation is an administrative offence and can be punished with a fine of up to 500,000 euros.

Changes to the registered information must be reported: scheduled annually, others immediately, at the latest within two weeks.

The Reporting Obligation under § 32 BSIG

24 hours, 72 hours, one month

Significant security incidents must be reported to the BSI through a three-stage process^[7]. An incident is considered significant if it has caused or can cause severe operational disruptions or financial losses, or if it has affected or can affect other individuals through significant material or immaterial damage.

Stage 1 – Early Warning within 24 Hours

Immediately, no later than 24 hours after becoming aware. Content: Classification of the incident, reason for reporting, situation assessment, preliminary description of the disruption and its impacts, suspected cause, suspicion of malicious actions, contact details.

Stage 2 – Report within 72 Hours

Confirmation and update of all details from the initial report, initial cause analysis, information on law enforcement and cooperation with authorities, countermeasures taken, severity, compromise indicators.

Stage 3 – Final Report within One Month

Detailed description of the incident including severity, information on the type of threat, measures taken and still ongoing, cross-border impacts.

The guiding principle is: Speed over completeness. The 24-hour report may be incomplete. It just must not be omitted.

This is precisely where it is determined whether an organisation is prepared. Twenty-four hours is short if it first needs to be clarified who is authorised to report, what data is available, and who fills out the form. Therefore, a well-rehearsed reporting chain belongs in the crisis organisation and not in improvisation.

Risk Management according to § 30 BSIG

Affected institutions must take appropriate, proportionate, and effective technical and organisational measures. The catalogue of measures is laid out in the law and includes, among other things, risk analysis and security concepts, management of security incidents, maintenance of operations with backup management and crisis management, supply chain security, access control, as well as cryptography and encryption.

The phrase „maintenance of operations“ is noteworthy. It demands exactly what Business Continuity Management delivers. And the question of which processes need to be operational again within what time cannot be reliably answered without a Business Impact Analysis. Thus, NIS2 is not purely an IT issue but directly impacts organisational resilience.

Management Liability – § 38 BSIG

This paragraph is most often underestimated in practice. It requires three things from the members of the management:

• They must approve the risk management measures
• They must monitor their implementation
• They must regularly participate in training to be able to assess risks and measures

If they violate these duties, the institution can assert claims for compensation. The responsibility is therefore non-delegable. They can delegate the implementation to IT – but not the approval, monitoring, and their own qualification.

The training obligation is not a formality. In the event of a dispute, it is the proof that the management was even capable of assessing the measures they approved.

Fines Framework

The higher amount is decisive in each case. For companies with high turnover, the percentage regularly applies.

What to Do Next

If you cannot confidently state the status of your implementation, follow this sequence:

• Determine and document impact. Sector according to Annex 1 or 2, number of employees, turnover, balance sheet total. The result should be documented in writing – even a justified no.
• Check registration. If not yet done: catch up immediately. The grace period has expired.
• Establish a reporting chain. Who identifies an incident, who classifies it, who reports it, who represents this person? Run through it once in a dry run.
• Review risk management against the catalogue of § 30. Identify gaps, prioritise, and schedule them.
• Strengthen business continuity. Without recovery times from a Business Impact Analysis, maintaining operations remains a declaration of intent.
• Train management and provide evidence. Participation, date, content.

Support from NOVELEDGE

For NIS2 implementation and management obligations, we offer training that addresses these exact points – from impact assessment to the reporting chain. An overview can be found in the Training section.

If you wish to deepen the connection between NIS2 and your organisational resilience, the articles on Risk Management and KRITIS-Dachgesetz are the appropriate continuation.

Status: September 2026. This article does not replace legal advice. Whether and to what extent the BSIG applies to your organisation must be examined on a case-by-case basis.

Sources

The information in this article is based on the following sources. Paid standards are not quoted verbatim; their contents are reproduced in essence.

1. Federal Government: Implementation of the NIS-2 Directive decided – Effective from 6 December 2025
2. Kleeberg: NIS-2 Registration: BSI grants extension until 31 July 2026
3. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS-2 Directive). Freely available at EUR-Lex. ↑
4. Act on the Federal Office for Information Security and on the Security of Information Technology Systems (BSIG). Freely available at gesetze-im-internet.de. ↑
5. BSIG as amended by the NIS2 Implementation Act, particularly §§ 28, 30, 32, 33, 38, 60, 65
6. Framework Act to Strengthen the Physical Resilience of Critical Facilities (KRITIS-Dachgesetz – KRITISDachG). Freely available at gesetze-im-internet.de.
7. BSI: NIS-2 Reporting Obligation – Reporting levels and deadlines