NIS2 fines: what § 65 BSIG provides for
§ 65 BSIG sets maximum amounts. Breaching the security measures or the reporting duty can bring a fine of up to EUR 10 million (essential entity) or EUR 7 million (important entity). For a missed registration the limit is EUR 500,000. These are upper limits, not fixed amounts. The BSI is the authority that decides.
Which breach has which upper limit
The main cases from § 65 BSIG. The first amount applies to essential, the second to important entities. Where there is only one amount, it applies to both.
| Breach | Maximum |
|---|---|
| Security measures not taken, not taken properly or not in time§ 65(2) no. 2 | EUR 10m / EUR 7m |
| Implementation of the measures not documented§ 65(2) no. 3 | EUR 10m / EUR 7m |
| Significant incident not reported, reported wrongly or late, final report missed§ 65(2) nos. 4 and 5 | EUR 10m / EUR 7m |
| BSI order to inform customers about an incident not followed§ 65(2) no. 1(d) | EUR 10m / EUR 7m |
| Not registered or registered late, details not submitted§ 65(2) no. 6 | EUR 500,000 |
| Certain BSI orders not followed, such as presenting evidence§ 65(2) no. 1(c) | EUR 500,000 |
| Access, documents or information refused during a BSI inspection§ 65(2) no. 17 | EUR 100,000 |
The maximum amounts are in § 65(5) BSIG.
When a percentage of turnover applies
For very large companies the fine can be higher: up to 2 percent (essential) or 1.4 percent (important entity) of worldwide total turnover. This only applies if that turnover is above EUR 500 million.
What counts is the turnover of the undertaking the entity belongs to, in the financial year before the decision. It may be estimated.
The EU directive provides for the higher of the fixed amount and the percentage (Art. 34(4) and (5) NIS 2). The German law ties the percentage to the EUR 500 million turnover threshold.
§ 65(6) to (8) BSIG
Who decides, and how
Fines under § 65 BSIG are imposed by the BSI. They are administrative offences; the procedure follows the Administrative Offences Act.
The amounts are upper limits. How high a fine is in an individual case depends, under the directive, on factors such as the seriousness and duration of the breach, previous breaches, the damage, intent or negligence and cooperation with the authority.
If a data protection authority has already fined the same conduct under the GDPR, the BSI may not impose another fine.
As of our last check in August 2026, the BSI had not published any fine under the new BSIG.
§ 65(10) and (11) BSIG · Art. 32(7), Art. 34(3) NIS 2
And management?
Separately from fines, § 38 BSIG sets out management's duties: implement the measures, oversee their implementation, attend training regularly. If management culpably breaches them, it is liable to its own company for the damage under company law.
For essential entities, the supervisory authority can, as a last resort, temporarily prohibit management from carrying out its role if orders from the BSI are not followed despite a deadline (§ 61(9) BSIG).
Director liability under § 38 BSIGWhat this means for a company with 50 to 150 employees
With 50 to 249 employees, a company is usually an important entity. At this size it is only essential if, in an Annex 1 sector, it has more than EUR 50 million turnover and more than EUR 43 million balance sheet total, or if it operates a critical facility (§ 28 BSIG).
For an important entity, the upper limit for measures and reporting is therefore EUR 7 million. A percentage of turnover only comes into play from EUR 500 million turnover.
The duties with the highest limits are the ones that are due anyway: take the measures, document them, report significant incidents.
An example
A made-up company: a machine tool manufacturer with 140 employees and EUR 28 million turnover.
Machinery manufacturing is listed in Annex 2 of the BSIG. With 140 employees, the company is an important entity.
The fixed upper limits apply: up to EUR 7 million for measures and reporting, up to EUR 500,000 for registration. A percentage of turnover does not come into play.
As an important entity, the BSI only inspects it if facts suggest that it is not complying with § 30, § 32 or § 38(3) BSIG (§ 62 BSIG).
The company is registered, has documented its measures and knows who reports an incident. That covers the duties the law attaches the highest amounts to.
How the walkthrough does this
The walkthrough at nisd2.eu guides you through the duties that § 65 BSIG attaches the highest amounts to.
Each of the ten areas in § 30(2) BSIG becomes at least one step that you fill in.
What you decide is then in writing: as a document from your answers, or as a list where a list is enough.
One step shows the three reporting deadlines and asks whether you can sign in to the BSI's portal and report.
One step records your registration with the BSI.
At the end, management approves the documents in the app, signed in with its own account.
Common questions
Have any NIS2 fines been imposed in Germany yet?
As of our last check in August 2026, the BSI had not published any fine under the new BSIG. The maximum amounts have applied since 6 December 2025.
Is the fine always EUR 10 million?
No. EUR 10 million is the upper limit for essential entities for breaches of the measures and the reporting duty. The amount in an individual case depends on factors such as the seriousness, duration and consequences of the breach.
Does the percentage of turnover apply to SMEs?
Only if the total turnover of the undertaking the entity belongs to is above EUR 500 million (§ 65(6) and (7) BSIG). Otherwise the fixed maximum amounts apply.
Who imposes NIS2 fines in Germany?
The BSI (§ 65(10) BSIG).
Can there also be a GDPR fine?
Not for the same conduct. If a data protection authority has already fined it, the BSI may not impose another fine (§ 65(11) BSIG).
Sources
- BSI Act (BSIG) §§ 28, 30, 32, 33, 38, 61, 62, 65, gesetze-im-internet.de/bsig_2025
- Directive (EU) 2022/2555 (NIS 2), Art. 32(7) and Art. 34, EUR-Lex
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Incident Handling
Know how to report an incident
Three reports to your authority, with fixed deadlines.
Registration & Reporting
Register with your authority
Your company registers once with your authority.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
