Germany’s NIS2 implementation act has applied since 6 December 2025. Around 29,500 companies are affected — many don’t know it. Check in three steps.
What is NIS2?
The EU NIS2 directive requires organisations in critical sectors to meet minimum cybersecurity standards. Germany transposed it with the NIS2UmsuCG, in force since 6 December 2025 without a transition period. The competent authority is the BSI.
Who is affected?
What counts is sector and size:
| Medium (50+ employees or > €10m turnover and balance sheet) | Large (250+ employees or > €50m turnover and > €43m balance sheet) | |
|---|---|---|
| High-criticality sectors (energy, transport, banking, health, water, digital infrastructure, MSPs …) | important entity | essential entity |
| Other critical sectors (postal, waste, chemicals, food, manufacturing, digital providers, research) | important entity | important entity |
Regardless of size: DNS service providers, TLD registries, qualified trust service providers and operators of critical facilities (KRITIS).
Obligations
- Registration with the BSI — the deadline has passed; affected companies should register immediately.
- Risk management measures under § 30 BSIG.
- Incident reporting: 24 hours / 72 hours / 1 month.
- Management accountability, including training and personal liability.
- Fines up to €10m or 2% of turnover (essential) or €7m or 1.4% (important entities).
This check is a simplified first assessment, not legal advice. The BSIG and the BSI’s scope check are authoritative.