NIS2 in Germany: National Law, Status, Authority and Registration

The BSIG 2025, Article 1 of that act, sets two entity categories, a three-month registration duty and the 24-hour, 72-hour and one-month reporting clock.

German companies are bound by the BSIG, not by the Directive itself: Directive (EU) 2022/2555 is addressed to the Member States (Article 46) and had to be transposed by 17 October 2024 (Article 41(1)). The NIS2 Directive sets the minimum; Germany's rules differ on fines, categories and the public sector.

The five key figures for NIS2 in Germany are listed below.

• Entry into force: 6 December 2025 (Article 30 of the act), see the NIS2 timeline
• Authority: Bundesamt für Sicherheit in der Informationstechnik (BSI) in Bonn
• Registrations: 20,373 on 30 September 2026 (BSI, "NIS-2 in Zahlen")
• Reporting: 24 hours, 72 hours, and a final report one month after the notification (§ 32(1) BSIG)
• Fine caps: EUR 10,000,000 for particularly important and EUR 7,000,000 for important entities, or 2 % and 1.4 % of worldwide turnover only above EUR 500 million total turnover (§ 65(5) to (7) BSIG)

Has Germany Transposed NIS2? Status as of 23 October 2026

Yes: Germany transposed NIS2 with an act of 2 December 2025 that entered into force on 6 December 2025, about 14 months after the EU deadline of 17 October 2024, and the BSIG 2025 applies with no general transition period. Table 1 lists Germany's NIS2 key dates, as of 23 October 2026, from the Federal Law Gazette, the BSI and the European Commission.

The NIS2 Implementation Act (BGBl. 2025 I Nr. 301): Title, Dates and Structure

The German NIS2 implementation act is the Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung (Act implementing the NIS 2 Directive and regulating essential principles of information security management in the federal administration), published in BGBl. 2025 I Nr. 301. "NIS2UmsuCG" is the practice name, short for NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz; it is not the title in the Federal Law Gazette.

The government bill is Drucksache 21/1501; the Bundestag adopted the act on 13 November 2025 and the Bundesrat approved it on 21 November 2025. It was signed on 2 December 2025, promulgated on 5 December 2025, and entered into force the next day, 6 December 2025 (Article 30). Article 1 of the act is the BSI Act 2025 (BSIG 2025), which replaces the BSIG of 14 August 2009 (BGBl. I S. 2821). The old § 8a, the KRITIS evidence duty, is now § 39 BSIG.

How the German Act Has Been Amended since December 2025

The BSIG 2025 has been amended three times in 2026, and the version in force on 23 October 2026 is the one last amended by the act of 23 July 2026. The three amending provisions are listed below.

• Article 4 of the KRITIS-Dachgesetz (Critical Infrastructure Umbrella Act) of 11 March 2026, BGBl. 2026 I Nr. 66
• Article 9 of the act of 21 July 2026, BGBl. 2026 I Nr. 221, in effect since 29 July 2026
• Article 8(1) of the act of 23 July 2026, BGBl. 2026 I Nr. 226, which amends an entry in Anlage 1 (No. 1.2.1)

EU Infringement Procedure against Germany

The Commission sent Germany a letter of formal notice on 28 November 2024 and a reasoned opinion on 7 May 2025 (Article 258 TFEU). Germany was one of 23 Member States that received a letter that day (INF/24/5988). On 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to notify measures transposing NIS2, with a request for a lump sum and daily penalties (IP/26/1499). Germany was not among them. As of 23 October 2026, the procedure against Germany has not reached the Court.

Who Is in Scope in Germany? The Two Entity Categories and Their Thresholds

The BSIG sorts entities into besonders wichtige Einrichtungen (particularly important entities, the Directive's essential entities) and wichtige Einrichtungen (important entities) by the sector lists in Anlage 1 and Anlage 2 and by size, and the BSI expected about 29,500 of them on 5 December 2025, against about 4,500 under the old BSIG. The test follows the EU logic of who NIS2 applies to: sector list first, then size, then the size-independent exceptions. Table 2 sets the two categories, their size-independent group and the federal administration beside their Directive equivalents.

Particularly Important Entities in Germany

An Anlage 1 entity type is a besonders wichtige Einrichtung if it has at least 250 employees, or an annual turnover above EUR 50 million and a balance sheet total above EUR 43 million (§ 28(1) No. 4 BSIG). Anlage 1 covers seven sectors: Energie, Transport und Verkehr, Finanzwesen, Gesundheit, Wasser, Digitale Infrastruktur and Weltraum (energy, transport, finance, health, water, digital infrastructure and space).

Size does not matter for four groups, which are always particularly important (§ 28(1) Nos. 1 to 2 BSIG): Betreiber kritischer Anlagen (operators of critical facilities), qualified trust service providers, top-level domain name registries and DNS service providers. Operators of critical facilities are identified by the thresholds of the BSI-KritisV of 2016, which continues to apply through § 66 BSIG until a new ordinance replaces it.

Important Entities in Germany and the Size Test

An Anlage 1 or Anlage 2 entity type is a wichtige Einrichtung if it has at least 50 employees, or an annual turnover and a balance sheet total each above EUR 10 million (§ 28(2) No. 3 BSIG). These are the same size thresholds as the EU size-cap rule for medium-sized enterprises, written into the statute. Anlage 2 adds seven sectors: Post- und Kurierdienste, Abfallbewirtschaftung, chemische Stoffe, Lebensmittel, verarbeitendes Gewerbe, Anbieter digitaler Dienste and Forschung (postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research). Business activities that are negligible in relation to the entity's overall business may be disregarded when assigning an entity type (§ 28(3) BSIG). Partner or linked enterprise data are not added where the entity's IT systems, components and processes are independent of them (§ 28(4) sentence 2 BSIG).

Federal Administration, Energy and DORA Carve-Outs

Federal bodies are covered as particularly important entities, but without §§ 38, 40(3), 61 and 65 (§ 29(2) BSIG). The federal administration under § 29(1) BSIG means federal authorities, public-law IT service providers of the federal administration and other federal bodies the BSI designates by order, excluding social-security institutions and the Deutsche Bundesbank. Because § 65 does not apply, federal bodies cannot be fined; instead they must prove compliance to the BSI at the latest five years after entry into force, and regularly after that (§ 43(1) BSIG).

Regional and municipal administration stays outside: the Länder regulate their own administrations under Land law (§ 2 No. 2 lit. b BSIG), and municipal IT service providers that serve administrations under comparable Land law are excluded (§ 28(8) BSIG). Anlage 1 therefore has no public administration sector; federal bodies enter through § 29 alone.

Two sector carve-outs follow in § 28(5) and (6) BSIG, and Table 3 lists the sections each one switches off. Financial entities under DORA, Regulation (EU) 2022/2554, are released from the BSIG measures and reporting sections by § 28(6) No. 1, the German side of the overlaps between NIS2 and DORA. DORA entities, gematik and telematics-infrastructure operators still register with the BSI under § 33 BSIG.

Which Authority Supervises NIS2 in Germany?

The Bundesamt für Sicherheit in der Informationstechnik (BSI, Federal Office for Information Security) in Bonn is Germany's competent authority (§ 59 BSIG), its single point of contact, called the nationale Verbindungsstelle, and central reporting point (§ 40 BSIG), and its CSIRT through CERT-Bund. NIS-2 questions go to the BSI Service-Center (service-center@bsi.bund.de, 0800 274 1000, free of charge from German networks).

The BSI is also centrally competent across the EU for the digital entity types of § 60 BSIG, the German transposition of Article 26 of the Directive, where their main establishment is in Germany (§ 60(1) BSIG). The Federal Ministry of the Interior (BMI) issues the ordinances, decides exemptions for national security, defence and law enforcement under § 37 BSIG (entities have no application route) and can prohibit critical components under § 41 BSIG. The Federal Network Agency (BNetzA) covers the energy and telecoms operators carved out by § 28(5), and BaFin covers the DORA financial entities of § 28(6). The Federal Office of Civil Protection and Disaster Assistance (BBK) runs the joint reporting point with the BSI and is the single point of contact under the KRITIS-Dachgesetz (§ 3(1) KRITISDachG).

Every Member State assigns these roles under Articles 8 and 10 of the Directive. Germany's allocation is one national version of the competent authority, single point of contact and CSIRT model.

Registration in Germany: Deadline Rule, Fine and Registered Entities

Particularly important and important entities must register with the BSI at the latest three months after they first qualify (§ 33(1) BSIG), report changes within two weeks (§ 33(5)), and face a fine of up to EUR 500,000 if they do not (§ 65(2) Nos. 6 and 8, (5) No. 5). The BSI may register an entity itself if the entity does not register (§ 33(3) BSIG). Registration does not start the duties: the measures and reporting obligations have applied since 6 December 2025.

The BSI opened the BSI-Portal for NIS-2 registration on 6 January 2026 (BSI press release of 6 January 2026). Registration takes two steps: an organisation account in Mein Unternehmenskonto (company account), then registration in the BSI-Portal at portal.bsi.bund.de.

By 30 September 2026, 20,373 registrations had reached the BSI, 232 of them from EU branches. Manufacturing, health and energy lead the sector counts in Table 4. The portal steps, the data to submit and the company account are set out under NIS2 registration with the BSI.

Table 4 shows the BSI figures ("NIS-2 in Zahlen") of 30 September 2026; an entity can register in more than one sector, so sector rows do not add up to the total.

The BSI plans its next update of these figures for 31 January 2027.

Incident Reporting in Germany: Deadlines and the Joint Reporting Point

Germany keeps the Directive's three deadlines: an early report within 24 hours, an incident notification within 72 hours and a final report one month after the notification, sent to the joint reporting point of the BSI and the BBK (§ 32(1) BSIG). The BSIG uses its own names for each report: frühe Erstmeldung (early report), Meldung (incident notification), Zwischenmeldung (interim report, on BSI request), Abschlussmeldung (final report) and Fortschrittsmeldung (progress report) where the incident is still ongoing. Table 5 sets the BSIG reports beside Article 23(4) of the Directive.

Operators of critical facilities add the affected facility, the critical service and the impact to their reports (§ 32(3) BSIG). The BSI confirms receipt within 24 hours where possible (§ 36(1) BSIG) and can order an entity to inform its service recipients (§ 35(1) BSIG). By 30 September 2026 the BSI had received 1,272 initial NIS-2 reports and 3,070 NIS-2 reports in total (BSI, "NIS-2 in Zahlen").

Only a significant incident starts the reporting clock, and § 2 No. 11 BSIG defines it along the lines of Article 23(3) of the Directive. For digital infrastructure and B2B ICT service management, the BSI applies the criteria of Implementing Regulation (EU) 2024/2690; in the other sectors an incident is usually significant if it meets at least one criterion of Article 3(1) of that Regulation, and always where a critical service fails or is impaired (BSI reporting guidance).

Fines, Management Duties and Supervision in Germany

Germany caps fines at EUR 10 million for particularly important and EUR 7 million for important entities, rising to 2 % or 1.4 % of worldwide turnover only above EUR 500 million total turnover, makes management bodies implement and oversee the security measures, and supervises particularly important entities ex ante and important entities ex post.

Fine Caps for German Entities

§ 65(5) BSIG caps fines for the core breaches at EUR 10,000,000 for particularly important and EUR 7,000,000 for important entities; only where total turnover exceeds EUR 500,000,000 does the cap rise to 2 % or 1.4 % of worldwide turnover (§ 65(6) and (7)). Article 34(4) and (5) of the Directive is built differently: Member States must provide a maximum of at least EUR 10,000,000 or 2 % of total worldwide annual turnover, whichever is higher, for essential entities, and at least EUR 7,000,000 or 1.4 %, whichever is higher, for important entities.

Lower tiers apply to the other breaches listed in Table 6, from EUR 5,000,000 down to EUR 100,000. The German model is one of the national variants compared under NIS2 fines. The BSI imposes the fines, except those on critical components, which the BMI imposes (§ 65(10)), and federal bodies cannot be fined (§ 29(2)).

Management Duties in Germany: Implementation, Oversight and Training

Geschäftsleitungen (management bodies) of particularly important and important entities must implement the § 30 measures and oversee their implementation (§ 38(1) BSIG). The BSIG verbs are umsetzen (implement) and überwachen (oversee), where Article 20(1) of the Directive speaks of approving and overseeing the Article 21 measures.

Members of the Geschäftsleitung must attend training regularly (regelmäßig, § 38(3) BSIG). The statute sets no interval; the legislative reasoning in Drucksache 21/1501 treats training offered at least every three years as regular. Article 20(2) of the Directive sets no training frequency either.

Liability runs towards the entity, under the company law of its legal form; the BSIG applies only where company law has no such rule (§ 38(2) BSIG). National rules are compared under management liability. As a last resort, the BSI can temporarily prohibit unreliable managers of particularly important entities from exercising management functions (§ 61(9) BSIG).

Supervision and Evidence Orders (§§ 61 to 63 BSIG)

The BSI supervises particularly important entities ex ante and may order audits, tests or certifications by independent bodies (§ 61(1) BSIG), while it checks important entities only where facts suggest non-compliance (§ 62). The audit orders cover § 30(1), § 31, § 32(1) to (3) and § 38(3) BSIG.

The BSI can order particularly important entities outside the KRITIS group to provide evidence at the earliest three years after entry into force, on 6 December 2028, and hospitals under § 108 SGB V at the earliest five years after, on 6 December 2030 (§ 61(3) BSIG). Operators of critical facilities keep their own three-year evidence cycle under § 39(1) BSIG. To enforce its orders, the BSI can impose a coercive fine (Zwangsgeld) of up to EUR 100,000 (§ 63 BSIG).

BSI Guidance and National Frameworks in Germany

The BSIG lists ten minimum measures in § 30(2) and leaves the method open: IT-Grundschutz is not mandatory, and the BSI publishes non-binding guidance for the entities that must implement the measures. The BSIG speaks of "technical and organisational" measures, where Article 21(1) of the Directive says "technical, operational and organisational".

The government bill estimates the compliance cost for business at EUR 2.3 billion a year plus EUR 2.2 billion one-off (Drucksache 21/1501). The per-entity figures behind these totals and the EU estimates are set out under what NIS2 compliance costs.

Six sources shape how German entities implement § 30 BSIG; they are listed below.

• Precedence of Implementing Regulation (EU) 2024/2690 for the digital entity types, such as DNS service providers, cloud and data centre providers and managed service providers (§ 30(3) BSIG)
• Branchenspezifische Sicherheitsstandards (B3S, sector-specific security standards), proposed by particularly important entities and their associations (§ 30(8) BSIG)
• The #nis2know roadmap in six phases, from analysis and policy statement to sustaining and continuous improvement
• The BSI NIS-2-Checkliste of 13 March 2026, comparable to this site's NIS2 checklist
• The NIS-2-Betroffenheitsprüfung, a non-binding BSI self-check of whether the BSIG applies
• The BSI one-pager on NIS-2 and ISO 27001 of 2 April 2026, read with the comparison of NIS2 and ISO/IEC 27001

The BSI one-pager states that an ISO/IEC 27001 certification does not automatically meet all BSIG requirements: fully implemented, it regularly covers a large part of the § 30 measures, but an ISMS scope can be drawn freely, whereas § 30 BSIG covers the whole regulated entity. Registration, reporting deadlines and the management and training duties are not original parts of ISO/IEC 27001.

The BSI information packages on measures add detail without adding duties. For multi-factor authentication they name at least two factors for the assurance levels "substanziell" and "hoch", and for cryptography they point to BSI Technical Guideline TR-02102 without mandating an algorithm.

Germany in the EU-Wide Comparison

Germany is one of the Member States that have transposed NIS2 as of 23 October 2026, and its rules are the detail behind one row of the EU-wide comparison. The NIS2 transposition tracker sets Germany beside all 27 Member States with act, authority and dated status. Germany stands out there for the EUR 500 million turnover line on fines.

Detail Pages on the German Rules

Three pages take the German rules further than this overview and two set them in context; the KRITIS-Dachgesetz is covered only on the KRITIS page. The five pages are listed below.

• The new BSIG after NIS2UmsuCG, section by section
• NIS2 registration with the BSI, portal steps and data
• KRITIS under NIS2 in Germany, critical facilities and thresholds
• NIS2 registration in the other Member States
• NIS2 in Austria, the neighbouring national law

Pending Changes at EU and National Level

As of 23 October 2026, the Commission's targeted NIS2 amendment proposal COM(2026) 13 of 20 January 2026 (procedure 2026/0012(COD)) is pending: the ITRE committee's draft report PE792.221 is dated 24 September 2026, and the European Parliament procedure is at "Awaiting committee decision". At national level, the ordinance under §§ 4(3) and 5(1) KRITIS-Dachgesetz that is to replace the BSI-KritisV is not in force.

The BSIG 2025 applies unchanged until then; the proposal and its procedure are tracked under NIS2 amendments.

What is the German NIS2 law called?

The German NIS2 law is the Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung, BGBl. 2025 I Nr. 301. Practitioners call it the NIS2UmsuCG. Its Article 1 is the BSIG 2025, which holds the duties for companies.

Is there a transition period for NIS2 in Germany?

No general transition period exists: the BSIG duties have applied since 6 December 2025 (BSI FAQ). The BSI can, however, order particularly important entities outside the KRITIS group to provide evidence only from 6 December 2028, and hospitals from 6 December 2030 (§ 61(3) BSIG).

Do DORA financial entities register with the BSI?

Yes, DORA financial entities register with the BSI under § 33 BSIG. § 28(6) No. 1 BSIG switches off only the sections on measures, reporting, information duties, management duties and KRITIS evidence (§§ 30, 31, 32, 35, 36, 38 and 39), not the registration duty.

Can the BSI fine managers personally?

No, the BSIG contains no administrative fine against individual managers; § 65 BSIG fines target the entity. Managers answer to the entity under company law (§ 38(2) BSIG), and the EU duties behind that rule are set out under management bodies. For particularly important entities, the BSI can impose a temporary management ban as a last resort (§ 61(9) BSIG).