Germany

Introduction: NIS2 Directive & the German context

Germany already had one of the EU's more developed cybersecurity regimes before NIS2, built on the IT-Sicherheitsgesetz and the KRITIS rules for critical infrastructure. Those covered roughly 4,500 entities.

The NIS2-Umsetzungsgesetz (NIS2UmsuCG) changed the scale rather than the philosophy. Its Article 1 replaced the BSI-Gesetz of 2009 with a new BSIG, and the number of organisations under BSI supervision rose to about 29,500. Most of them had never dealt with the BSI before.

The obligations are already live. There was no general transition period: registration, risk management and incident reporting all applied from the day the law took effect.

What you must do in Germany

Six duties, each with its own statutory hook and its own penalty if missed. The deadlines are counted from the moment you first qualify as an in-scope entity, not from a single national date.

1. Determine your own status. Germany uses self-identification: no authority writes to tell you that you are in scope. You are either a besonders wichtige Einrichtung (essential entity) or a wichtige Einrichtung (important entity) under § 28 BSIG, or neither.
2. Register with the BSI within three months of first qualifying (§ 33(1)). For entities already in scope when the law took effect, that deadline was 6 March 2026 and has passed. See Registering with the BSI.
3. Implement the ten risk-management measures in § 30(2), proportionate to your risk exposure, size and the cost of implementation — and document that you have done so. The documentation duty is written into § 30(1) as a separate obligation.
4. Be able to report an incident within 24 hours. The chain runs 24 hours, 72 hours, then a final report one month later. See Incident reporting.
5. Get your management trained, and keep them involved. Under § 38 the Geschäftsleitung must implement and supervise the measures personally, and attend training regularly. This is not delegable to the IT department.
6. Keep your registration current. Changes to the data you filed must reach the BSI within two weeks (§ 33(5)).

NIS2 Directive implementation in Germany

Germany transposed the NIS2 Directive through the NIS2-Umsetzungsgesetz (NIS2UmsuCG). The Bundestag passed it on 13 November 2025 and the Bundesrat approved it on 21 November 2025. It was published in the Federal Law Gazette as BGBl. 2025 I Nr. 301 on 5 December 2025 and, under its Article 30, entered into force the following day, 6 December 2025.

The distinction matters because both dates circulate. 5 December is the date of publication; 6 December is the date the obligations began. Germany transposed almost fourteen months after the EU deadline of 17 October 2024.

Article 1 of the NIS2UmsuCG is a complete replacement of the BSI-Gesetz, so the operative rules are cited as sections of the BSIG rather than of the NIS2UmsuCG itself. The BSIG has since been amended three times: by the KRITIS-Dachgesetz of 11 March 2026, and by two further acts of 21 and 23 July 2026.

NIS2 Germany: compliance requirements

Germany follows the two-tier NIS2 structure, but names it in its own terms and sets its own thresholds. An besonders wichtige Einrichtung is an essential entity; a wichtige Einrichtung is an important entity. Which one you are decides how the BSI supervises you and how large a fine you face.

Competent authorities & CSIRT

Germany centralises far more than most member states. The BSI is the supervisor, the national CSIRT and the single point of contact, and it also runs the registration and reporting infrastructure jointly with the BBK.

Registering with the BSI

Registration is the single most commonly missed duty in Germany, and the route to it is not obvious: it runs through the tax administration's identity system before it ever reaches the BSI.

What you have to supply (§ 33(1) BSIG)

• Entity name, including legal form and, where applicable, the Handelsregister number.
• Address and current contact details, including email address and telephone numbers.
• Public IP address ranges. This one regularly surprises organisations — it is a statutory requirement, not an optional field.
• The relevant sector, and where applicable sub-sector, from Annex 1 or Annex 2.
• Every EU member state in which you provide the services that put you in scope.
• The federal and state supervisory authorities competent for those activities.

Two further points. If you do not register, § 33(3) lets the BSI register you itself, in agreement with the competent supervisory authority. And a distinct track exists under § 34 for DNS providers, TLD registries, cloud and data-centre providers, CDNs, managed service and managed security service providers, online marketplaces, search engines and social network platforms: they file a different data set, also within three months, which the BSI forwards to ENISA.

How many have actually registered

The BSI publishes running totals. At 2 April 2026, its last published figures:

Against roughly 29,500 entities expected in scope, that is about half. The gap is the single clearest indicator of where German enforcement attention is likely to go first.

Incident reporting: the 24 / 72 / one-month chain

§ 32 BSIG sets a three-stage chain for any erheblicher Sicherheitsvorfall (significant security incident). Reports go to the reporting office run jointly by the BSI and the BBK, through the same portal used for registration.

Operators of kritische Anlagen supply more: under § 32(3) they must also state the type of installation and critical service affected, and the effect on that service. The BSI acknowledges receipt within 24 hours where possible, and can offer technical support and advice on remediation (§ 36).

One nuance worth knowing: § 32(1) provides that the reporting duty applies at the earliest from the point the reporting channel exists. Voluntary reports are also possible through the portal.

NIS2 timeline & key dates (Germany)

Sector-specific notes for Germany

• Energy: operators of energy networks, installations and digital energy services governed by §§ 5c–5e EnWG are carved out of the core BSIG duties under § 28(5), because that regime already covers them. The carve-out ends if they operate other kritische Anlagen. 2,070 registrations.
• Health: the largest registered sector by some distance, at 3,004 registrations.
• Digital infrastructure: 2,044 registrations. DNS providers, TLD registries and qualified trust service providers are essential entities regardless of size.
• Finance: entities already covered by DORA are exempt from §§ 30, 31, 32, 35, 36, 38 and 39 under § 28(6). 740 registrations.
• Manufacturing: the largest Annex 2 sector, at 3,509 registrations — a population that had essentially no prior contact with the BSI.
• Food: 1,568 registrations. Waste management: 793. Chemicals: 663. Water: 678. Transport: 599 across both annexes.
• Telecoms: like energy, carved out of the core duties by § 28(5), with the same condition attached.

How Germany differs from the NIS2 baseline

Germany's transposition is close to the Directive in structure but makes several choices that materially change what compliance looks like on the ground.

1. Two statutes, not one. NIS2 became the BSIG; the CER Directive on physical resilience became the separate KRITIS-Dachgesetz, in force since 17 March 2026. KRITIS operators sit under both. Registration of kritische Anlagen is meant to move to § 8 KRITIS-Dachgesetz, but that switch is not yet live: § 66 BSIG suspends it until an implementing ordinance is issued.
2. Percentage fines apply only above €500 million turnover. The familiar "€10 million or 2% of turnover, whichever is higher" is not how German law works. See Penalties.
3. Management liability runs to the company, not to the regulator. Under § 38(2) the Geschäftsleitung is liable to its own entity for culpably caused damage, under the company-law rules for its legal form. The BSIG liability is only subsidiary, applying where company law has no equivalent rule.
4. Group thresholds are unusually generous. § 28(4) applies the EU SME definition but excludes Article 3(4) of its Annex, and disapplies the normal aggregation of partner and linked company data where the entity is genuinely independent in how its IT systems are built and run. A subsidiary of a large group can therefore fall outside scope where it would be captured elsewhere.
5. Registration runs through the tax identity system. The ELSTER organisation certificate and Mein Unternehmenskonto are prerequisites. No other member state routes NIS2 registration this way.
6. Civil protection is a joint owner. Registration and incident reporting are operated jointly with the BBK, reflecting Germany's treatment of cyber and physical resilience as one problem.

German terms you will meet

The portal, correspondence and the statute itself are German-only. The BSI publishes no English-language NIS2 guidance, so these are the strings you will actually encounter.

Penalties under NIS2UmsuCG

§ 65 BSIG does not set one maximum. It sets six tiers, and which one applies depends on which duty you breached — not on how serious the consequences were.

• Coercive penalties are separate. Where the BSI enforces an order by Zwangsgeld, § 63 raises the ceiling to €100,000, above the standard administrative-enforcement limit.
• Management liability is to the entity. § 38(2) makes the Geschäftsleitung liable to its own organisation for culpably caused damage, under the company-law rules applicable to its legal form — not to a personal fine from the BSI. The BSIG rule applies only where company law provides none.
• No double punishment with the GDPR. § 65(11) bars a BSIG fine for conduct already fined by a data-protection authority under Article 58(2)(i) GDPR.

How to prepare for NIS2 in Germany

1. Run the BSI's own Betroffenheitsprüfung first. It is free, anonymous and follows the statute's decision tree. It is explicitly non-binding and does not replace your own self-identification, but it is the fastest way to a defensible first answer.
2. Check the thresholds properly, including the group question. § 28(4) may keep an independent subsidiary out of scope where the usual EU aggregation rules would pull it in.
3. Register, even if you are late. The deadline has passed, but the exposure for not registering (€500,000) does not decrease with time, and the BSI can register you itself.
4. Get the ELSTER certificate moving early. It is issued by the tax administration, not the BSI, and it gates everything else.
5. Build the 24-hour reporting path before you need it. Decide now who can file, and how they reach the portal outside office hours.
6. Put management training on the calendar. § 38(3) requires it regularly, and it is one of the few duties the BSI can check against a document.
7. Document as you go. § 30(1) makes documentation a duty in its own right, separately punishable from the measures themselves.
8. Map the overlaps. If DORA or the EnWG rules already cover you, § 28(5) and (6) may remove most of the BSIG duties — but only for those activities.

If you operate in more than one EU country

NIS2 is a directive, so each member state has its own act, its own regulator and its own portal. Germany is covered by the BSIG; the same group operating in Poland answers to a different statute with different deadlines.

• German establishment is the test. The BSI's position is that what matters is whether the undertaking is established in Germany or has appointed a representative there — not whether the relevant services are delivered in Germany. A company can be in scope in Germany for services provided elsewhere.
• Registration asks where else you operate. § 33(1) requires a list of every member state in which you provide the services that bring you into scope, and the authorities competent for them.
• Digital providers follow their main establishment. For cloud, data centre, CDN, managed service and managed security service providers, marketplaces, search engines and social networks, § 60 assigns jurisdiction to the member state of the main EU establishment. Registered once under § 34, that data is forwarded to ENISA and shared across the EU.
• Thresholds and penalties do not travel. The €500 million turnover threshold for percentage fines is a German choice. Others apply the percentage from the first euro.

For the position in the other member states we cover, see the NIS2 country guides.

Official links & resources

FAQ: NIS2 in Germany

Sources & verification

Every date, figure and section reference on this page was read from the enacted statute text or from the BSI's own pages, and checked on 2 August 2026. Third-party NIS2 trackers contradict each other and are not used as sources.

• BSIG, consolidated text — entry into force (Art. 30 NIS2UmsuCG, BGBl. 2025 I Nr. 301), scope and thresholds (§ 28), measures and documentation (§ 30), reporting (§ 32), registration (§§ 33–34), management duties and liability (§ 38), KRITIS evidence (§ 39), supervision (§§ 61–62), fines (§ 65) and the transitional rule (§ 66).
• BSI — NIS-2 in Zahlen — the registration and incident-report figures as at 2 April 2026.
• BSI NIS-2 FAQ — the source for the absence of a general transition period, the legislative dates, the definition of Kenntniserlangung, and the position on certification.
• BSI press release of 13 November 2025 — the source for roughly 29,500 entities in scope, against about 4,500 under the previous law.
• KRITIS-Dachgesetz — BGBl. 2026 I Nr. 66, in force 17 March 2026.