NIS2 in Germany: what the BSI Act requires and since when
Germany transposed NIS2 with the NIS2UmsuCG. The duties are in the new BSI Act (BSIG) and have applied since 6 December 2025. Companies in scope register with the BSI, take security measures and report significant incidents. Their management implements the measures and oversees them.
The law
The NIS 2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) rewrote the BSI Act. It entered into force on 6 December 2025.
The duties have applied since that day. Only evidence to the BSI has later dates.
The competent authority is the Federal Office for Information Security (BSI).
BGBl. 2025 I no. 301
The key dates
27 December 2022
Directive (EU) 2022/2555 is published in the EU Official Journal.
16 January 2023
The directive enters into force.
17 October 2024
EU deadline for transposition. Germany missed it.
6 December 2025
The new BSIG enters into force. The duties apply immediately.
January 2026
The BSI opens its portal for registration.
6 March 2026
Registration deadline for companies in scope since December 2025.
6 December 2028
From then at the earliest, the BSI can ask essential entities for evidence.
Who is in scope
A company is in scope if it works in a sector listed in Annex 1 or 2 of the BSIG and is large enough.
Such a company is an important entity with at least 50 employees, or with an annual turnover and a balance sheet total of more than EUR 10 million each.
A company in an Annex 1 sector is an essential entity with at least 250 employees, or with more than EUR 50 million turnover and more than EUR 43 million balance sheet total. Operators of critical facilities and some providers regardless of size, such as qualified trust service providers, are also essential entities.
The EU directive says “essential entity”, the BSIG “besonders wichtige Einrichtung” (particularly important entity). Both mean the same group.
The BSI offers a scope check. According to the BSI, its result is not legally binding.
§ 28 BSIG · Annexes 1 and 2
The four duties
Register with the BSI
At the latest three months after your company comes into scope, through the BSI portal. If something changes, you update it within two weeks.
§ 33 BSIG
More on thisTake security measures
Measures in ten areas, from the incident response plan to the second factor, as thorough as your company's size and risk require. You put in writing what you implement.
§ 30 BSIG
More on thisReport significant incidents
In three stages to the joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance, the first within 24 hours.
§ 32 BSIG
More on thisManagement
It implements the measures, oversees their implementation and attends training regularly.
§ 38 BSIG
More on thisHow the BSI checks
The BSI can inspect essential entities, including with the help of third parties, and order audits. It can ask for evidence from 6 December 2028 at the earliest.
It only inspects important entities if facts suggest that they are not complying with § 30, § 32 or § 38(3) BSIG.
Fines are set out in § 65 BSIG. For breaches of the measures and the reporting duty, the upper limit is EUR 10 million for essential and EUR 7 million for important entities.
§§ 61, 62, 65 BSIG
The fines in detailWhat this means for a company with 50 to 150 employees
In a sector of Annex 1 or 2, such a company is usually an important entity.
The four duties are the same for important and essential entities. Supervision differs: the BSI only inspects important entities when there are indications of a breach.
How thorough each measure has to be depends on risk, size and cost. A business with 80 employees does not have to build what a large group needs.
§ 30(1), second sentence, BSIG
An example
A made-up company: a waste management firm with 75 employees.
Waste management is listed in Annex 2 of the BSIG. With 75 employees, the firm is an important entity.
It already has an ELSTER organisation certificate for tax. It uses it to sign in to the BSI portal and register.
It writes down what it works with: route planning, weighbridges, billing, vehicle tracking. The measures follow from that.
The incident response plan says who reports an incident. The managing director attends training and approves the documents.
How the walkthrough does this
The walkthrough at nisd2.eu takes you step by step through the duties in the BSIG.
20 steps. Operators of critical facilities have one more.
Next to each step is the law, explained in plain words.
Registration, measures, reporting and management training are steps of their own.
Your answers produce six documents, among them the security policy and the two emergency plans.
At the end, management approves the documents in the app, signed in with its own account. Name and date then appear on every document.
Common questions
Since when has NIS2 applied in Germany?
Since 6 December 2025. The new BSI Act entered into force on that day.
What is the German NIS2 law called?
The NIS 2 Implementation and Cybersecurity Strengthening Act, NIS2UmsuCG for short. Above all, it rewrote the BSI Act (BSIG). The companies' duties are there, for example in §§ 30, 32, 33 and 38.
Does every company in scope have to register with the BSI?
Yes, every essential and every important entity, at the latest three months after it comes into scope (§ 33(1) BSIG). The duty applies without the BSI asking you.
Who checks implementation?
The BSI. It can inspect essential entities; important entities only when there are indications of a breach (§§ 61 and 62 BSIG).
Sources
- BSI Act (BSIG) §§ 28, 30, 32, 33, 38, 61, 62, 65 and Annexes 1 and 2, gesetze-im-internet.de/bsig_2025
- NIS2UmsuCG, BGBl. 2025 I no. 301
- Directive (EU) 2022/2555 (NIS 2), Art. 41 and 45, EUR-Lex
- BSI: NIS 2 scope check, betroffenheitspruefung-nis-2.bsi.de
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Registration & Reporting
Register with your authority
Your company registers once with your authority.
Incident Handling
Know how to report an incident
Three reports to your authority, with fixed deadlines.
Governance & Liability
Get management trained
Every member of management, regularly.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
