NIS2by country

NIS2 in Germany

BSI-Gesetz (BSIG), geändert durch das NIS-2-Umsetzungsgesetz

Law in force since

Law
BSIG
Authority
Federal Office for Information Security (BSI)
Classes
besonders wichtige Einrichtung (essential), wichtige Einrichtung (important)
Register
BSI portal
ISO 27001
Helps, not enough alone
Self-check
BSI NIS-2-Betroffenheitsprüfung

Check your company for Germany

Know when Germany changes its NIS2 rules

  • One email when the law, the deadlines or the portal change.

This site stores your email and emails you when the NIS2 rules in Germany change. Unsubscribe at any time.

The law

The law took effect on 2025-12-06. There is no general transition period, so the duties apply now.

Name
BSI-Gesetz (BSIG), geändert durch das NIS-2-UmsetzungsgesetzBSI Act, as amended by the NIS2 Implementation Act
Published
2025-12-05
In force
2025-12-06
Text
Read the BSIG

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where Germany differs

  • § 28(4) BSIG Partner and linked company figures are not added when your IT systems and processes are independent of the group.
  • § 28(3) BSIG You can leave out business activities that are negligible compared with your whole business. If the NIS2 activity is a small side line, check whether it counts at all.

Also note

  • A SaaS product that runs on another provider's cloud can still count as a cloud computing service.
  • The BSI expects about 29,500 companies to be in scope.

Registration

Register within 3 months after your company first meets the criteria. For companies in scope on 2025-12-06, that deadline has passed. The BSI asks late companies to register at once.

Portal
BSI portal
Rule
Deadline counts from the day you come into scope
Deadline
2026-03-06
Later entrants
3 months after you come into scope
You need
A MUK account (Mein Unternehmenskonto), which needs an ELSTER organisation certificate. Apply for the certificate early: it arrives by post.
Changes
Report changes to your data within 14 days

Incident reporting

  1. 24 hEarly warning
  2. 72 hIncident notification
  3. 1 monthFinal reportafter the notification

Send the reports to the joint BSI/BBK reporting office, through the BSI portal.

Measures and proof

Essential
No single certificate proves compliance. The BSI can check your measures against the catalogue in § 30 BSIG.
Important
The BSI supervises after the fact, for example after an incident. Keep evidence of your measures ready.

The dates, in order

  1. Measures, incident reporting and management duties apply
  2. Registration deadline for companies in scope on day 1Derived from a rule in the law

Duties of management

Management must approve the measures and supervise them. It must also take part in training. A manager who breaches these duties is liable to the company.

Fines

The ceiling is the higher of a fixed amount and a share of the worldwide annual turnover of the group.

Fine ceilings, § 65 BSIG. The higher amount applies. Each "At EUR" figure is the ceiling at that worldwide turnover.
Class Ceiling At EUR 20mAt EUR 500mAt EUR 2bn
Essential EUR 10m or 2% EUR 10mEUR 10mEUR 40m
Important EUR 7m or 1.4% EUR 7mEUR 7mEUR 28m

The % ceiling applies when total worldwide turnover is above EUR 500 million.