Guide · Data Protection, IT and Digital
Cybersecurity: NIS2, BSIG and the CRA
NIS2 has been implemented in Germany through the new BSI Act, in force since 6 December 2025. This guide explains which companies are particularly important or important entities, how to register with the BSI, the risk-management and reporting duties, management liability, fines, the KRITIS Umbrella Act and the Cyber Resilience Act.
Key takeaways
- Germany's BSI Act implementing NIS2 has been in force since 6 December 2025.
- Important entities generally start at 50 employees or EUR 10 million turnover and balance sheet.
- Significant incidents require an early warning within 24 hours and a notification within 72 hours.
- Management must implement and supervise cyber measures and attend regular training.
- Fines reach EUR 10 million, or 2% of turnover for large particularly important entities.
NIS2 in Germany in brief
Germany implemented the EU's NIS2 Directive (Directive (EU) 2022/2555) through a comprehensive reform of the Act on the Federal Office for Information Security (BSI-Gesetz, BSIG). The new BSI Act was promulgated on 2 December 2025 (BGBl. 2025 I Nr. 301) and entered into force on 6 December 2025.
The reform vastly expands the circle of companies subject to cybersecurity regulation: beyond the traditional operators of critical infrastructure, it now covers "particularly important entities" and "important entities" across a wide range of sectors, from energy, transport, health and digital infrastructure to manufacturing, chemicals, food, waste management and postal services. These companies must register with the Federal Office for Information Security (BSI), manage cyber risks, report significant incidents and ensure that their management is accountable.
Two further instruments complete the picture. The KRITIS Umbrella Act (KRITIS-Dachgesetz), in force since 17 March 2026, addresses the physical resilience of critical facilities. The EU Cyber Resilience Act (CRA) imposes cybersecurity requirements on products with digital elements, with manufacturer reporting duties from 11 September 2026 and full application from 11 December 2027. This page explains who is covered by NIS2 in Germany, what the obligations are, how management liability works and how the CRA fits in. For the broader framework, see our data and digital law overview.
Who is covered: particularly important and important entities
The BSI Act classifies entities in § 28 BSIG. An entity falls within its scope if it offers goods or services in one of the entity types listed in Annexes 1 and 2 of the Act and meets the size thresholds, which are applied using the EU SME recommendation. The headline rules are:
| Category | Who | Basis |
|---|---|---|
| Particularly important entities | Operators of critical facilities; qualified trust service providers, top-level domain registries and DNS providers; public telecoms providers with at least 50 employees or turnover and balance sheet total each above EUR 10 million; Annex 1 entities with at least 250 employees, or turnover above EUR 50 million and balance sheet total above EUR 43 million | § 28(1) BSIG |
| Important entities | Other trust service providers; smaller public telecoms providers; Annex 1 and Annex 2 entities with at least 50 employees, or turnover and balance sheet total each above EUR 10 million | § 28(2) BSIG |
| Not covered (generally) | Entities below these thresholds, unless specific rules apply; negligible activities can be disregarded when classifying an entity | § 28(3), (4) BSIG |
Classification requires care. Groups must determine for each legal entity whether its activity falls within an Annex entity type, whether activities outside the Annex are negligible in relation to its overall business, and how headcount and financial figures are calculated.
Under § 28(4) BSIG, the data of partner and linked enterprises within the meaning of the SME recommendation are not added where the company is independent of them as regards the nature and operation of its IT systems, components and processes, which departs from the usual SME calculation and requires a factual assessment of shared IT.
A holding company that provides IT services to its subsidiaries may itself be covered. Operators of public telecoms networks and energy supply networks and installations are largely subject to sector-specific security rules under the Telecommunications Act and the Energy Industry Act instead of core BSI Act duties (§ 28(5) BSIG). The BSI offers an online self-assessment tool, but the legal responsibility for correct classification lies with the company.
Financial entities are a special case. Banks, insurers, investment firms and other financial entities subject to the EU Digital Operational Resilience Act (DORA) follow DORA's detailed rules on ICT risk management, incident reporting and third-party risk, which take precedence as sector-specific law. They should nevertheless check whether group companies outside the regulated perimeter, such as IT service subsidiaries, fall under the BSI Act in their own right. See our insight on DORA for financial entities.
Registration, risk management and incident reporting
NIS2 registration with the BSI
Particularly important and important entities must register with the BSI at the latest three months after they first fall within one of these categories, providing their name, legal form, register number, contact details, public IP address ranges, sector and Member States in which they provide services (§ 33 BSIG). The BSI states on its website that the statutory registration deadline has passed and that entities that have not yet registered should do so immediately through the BSI portal, which requires an ELSTER organisation certificate. Companies that only now realise they are covered should register without further delay and document why registration was late.
Risk-management measures
Covered entities must take appropriate, proportionate and effective technical and organisational measures to avoid disruptions to the availability, integrity and confidentiality of their IT systems and to minimise the impact of security incidents, and must document compliance (§ 30(1) BSIG).
The measures should reflect the state of the art, take relevant standards into account and follow an all-hazards approach. They must at least include risk analysis and IT security policies; incident handling; business continuity, backup and crisis management; supply chain security; security in acquisition, development and maintenance, including vulnerability handling; assessment of effectiveness; basic training and cyber hygiene; cryptography; personnel security, access control and asset management; and multi-factor authentication and secure communications (§ 30(2) BSIG).
NIS2 incident reporting
Significant security incidents must be reported to a joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance in three stages: an early warning without undue delay and at the latest within 24 hours of becoming aware of the incident, an incident notification within 72 hours with an initial assessment, and a final report at the latest one month after the notification, with interim reports on request (§ 32(1) BSIG).
If personal data are affected, a separate notification to the data protection authority within 72 hours under Article 33 GDPR may be required. Our insight on incident response after a cyber attack explains how to run both processes in parallel.
The 24-hour early warning is short, but it requires only limited information: whether the incident is suspected to be caused by unlawful or malicious acts and whether it could have cross-border effects. Prepare a pre-approved template, decide in advance who may submit it, and make sure out-of-hours escalation works. Many companies lose the first day establishing who is allowed to report.
NIS2 management duties and liability
Management is at the centre of the BSI Act. The management of particularly important and important entities must implement the risk-management measures required by § 30 and supervise their implementation (§ 38(1) BSIG). Managers who breach these duties are liable to their entity for culpably caused damage under the corporate law rules applicable to the entity's legal form, such as § 43 of the Limited Liability Companies Act (GmbHG) or § 93 of the Stock Corporation Act (AktG); the BSI Act provides its own liability basis only where those rules contain no corresponding liability provision (§ 38(2) BSIG).
Management must also attend training regularly to acquire sufficient knowledge to identify and assess cyber risks and risk-management practices (§ 38(3) BSIG).
For German boards, this means that cybersecurity is a personal responsibility of the managing directors or management board, not a task that can be fully delegated to the IT department. Documentation of decisions, training attendance and regular reporting on cyber risk will be important evidence if a claim is brought after an incident. D&O insurance should be reviewed to confirm that claims arising from cybersecurity failures are covered. See our insight on NIS2 and management liability.
NIS2 and IT service contracts
Supply chain security is one of the most demanding parts of the § 30 catalogue in practice. Covered entities must address security-related aspects of their relationships with direct suppliers and service providers, which means assessing the security of key IT providers, agreeing security requirements, audit rights and incident notification duties in contracts, and planning for supplier failure. Suppliers that are not themselves covered by the BSI Act will nevertheless receive contractual requirements from covered customers. Contract templates for managed services, cloud and software development should therefore be updated, and procurement teams trained to apply them consistently.
Directors' and officers' insurance and internal organisation
Because management liability under § 38(2) BSIG runs through the corporate law rules, the usual tools apply: a clear allocation of responsibilities within the management board, documented delegation to a qualified chief information security officer with adequate resources, regular reporting to the board and to the supervisory board where there is one, and an audit trail of decisions on risk acceptance. Supervisory boards should include cyber risk in their monitoring of the management board.
NIS2 supervision, audits and fines
The BSI supervises compliance and can order particularly important entities to have audits, inspections or certifications carried out by independent bodies (§ 61 BSIG). Operators of critical facilities must demonstrate implementation of their measures to the BSI through security audits, inspections or certifications every three years, starting at a date set by the BSI (§ 39 BSIG). Important entities are subject to ex-post supervision, typically triggered by indications of non-compliance, such as an incident report, a complaint or information from another authority. Where an entity fails to register, the BSI can also carry out the registration itself in agreement with the competent supervisory authorities (§ 33(3) BSIG).
Fines under § 65 BSIG are substantial. Breaches of core obligations, including the risk-management, reporting and registration-related duties listed in the provision, can be fined up to EUR 10 million for particularly important entities and up to EUR 7 million for important entities (§ 65(5) BSIG). For particularly important entities with total turnover above EUR 500 million, the maximum rises to 2% of total turnover (§ 65(6) BSIG), and a turnover-based maximum also applies to large important entities (§ 65(7) BSIG). Lower fine tiers apply to other infringements.
The KRITIS Umbrella Act
While the BSI Act deals with information security, the KRITIS Umbrella Act, in force since 17 March 2026 (BGBl. 2026 I Nr. 66), implements the EU Critical Entities Resilience Directive and addresses the physical resilience of operators of critical facilities against risks such as natural disasters, sabotage and terrorism. Operators covered by both regimes should integrate their information security and physical resilience programmes. See our insight on the KRITIS Umbrella Act.
The Cyber Resilience Act
The Cyber Resilience Act (Regulation (EU) 2024/2847) complements NIS2 by regulating products rather than organisations. It applies to hardware and software products with digital elements placed on the EU market, from consumer IoT devices to industrial control software, with lighter rules for certain open-source stewards and exclusions for products covered by specific sectoral rules. Manufacturers must design products to meet essential cybersecurity requirements, handle vulnerabilities throughout a support period, provide security updates, prepare technical documentation and a software bill of materials, carry out conformity assessment and affix the CE marking.
The Regulation applies in stages: the rules on notifying conformity assessment bodies from 11 June 2026, manufacturers' reporting obligations from 11 September 2026 and the remaining obligations from 11 December 2027 (Article 71(2) CRA). From 11 September 2026, manufacturers must notify actively exploited vulnerabilities and severe incidents through the single reporting platform, with an early warning within 24 hours (Article 14 CRA). Breaches of the essential requirements and the obligations in Articles 13 and 14 can lead to fines of up to EUR 15 million or 2.5% of worldwide annual turnover (Article 64(2) CRA). See our insight on the Cyber Resilience Act.
Building a NIS2 compliance programme
- Scope: classify every group entity under § 28 BSIG and record the reasoning.
- Register: complete BSI registration for each covered entity and keep the data current.
- Gap analysis: compare existing measures, for example an ISO/IEC 27001 management system, against the § 30 catalogue.
- Supply chain: update supplier contracts with security requirements, audit rights and incident notification duties.
- Reporting: implement a 24/72-hour reporting process aligned with GDPR breach notification.
- Management: adopt a board resolution approving the measures, schedule training and set up regular reporting.
- Products: if you manufacture products with digital elements, prepare for CRA reporting and design requirements.
Illustration: a hypothetical German family-owned manufacturer of industrial pumps with 400 employees discovers that machinery manufacturing is an Annex 2 entity type and that it is an important entity. It registers with the BSI, maps its existing ISO-based controls against § 30 BSIG, introduces multi-factor authentication across all remote access, adds security clauses to its contracts with IT service providers and arranges cyber training for its managing directors. Because its pumps include networked control software, it also starts a separate CRA project for vulnerability handling and security updates.
How TRW & Co helps
We advise companies on NIS2 compliance in Germany, from scope analysis under § 28 BSIG and BSI registration to risk-management documentation, supplier contracts and incident reporting processes. We brief and train management boards on their duties and liability, review D&O coverage and support companies during BSI supervisory measures and fine proceedings. In a cyber incident, we coordinate legal workstreams across BSI reporting, GDPR notification, insurers, law enforcement and customers. We also advise manufacturers on the Cyber Resilience Act. To discuss your cybersecurity programme, please contact us. This page is general information and not legal advice.
Frequently asked questions
Has the NIS2 registration deadline in Germany passed?
Yes. Entities must register within three months of first falling within scope (§ 33 BSIG), and the BSI states that the statutory deadline has passed. Companies that are covered but not yet registered should register immediately through the BSI portal, which requires an ELSTER organisation certificate, and document their reasons for the delay.
Does NIS2 apply to manufacturing companies in Germany?
Many manufacturers are covered. Manufacturing of certain products, such as machinery, electrical equipment, motor vehicles, medical devices and electronic products, is among the entity types listed in the annexes to the BSI Act. If such a manufacturer has at least 50 employees, or turnover and balance sheet total each above EUR 10 million, it is generally an important entity.
Are managing directors personally liable under the BSI Act?
Managing directors must implement and supervise the required cybersecurity measures (§ 38(1) BSIG). If they culpably breach this duty, they are liable to the company for resulting damage under the corporate law rules for its legal form, such as § 43 GmbHG or § 93 AktG. They must also attend regular cybersecurity training.
How does NIS2 incident reporting relate to GDPR breach notification?
They are separate duties that often apply to the same incident. NIS2 requires an early warning to the joint reporting office within 24 hours of becoming aware of a significant incident, a notification within 72 hours and a final report within one month. The GDPR requires notification to the data protection authority within 72 hours if personal data are affected and there is a risk.
What is the difference between NIS2 and the Cyber Resilience Act?
NIS2, implemented in the BSI Act, regulates organisations: it requires covered entities to secure their own operations. The Cyber Resilience Act regulates products with digital elements: it requires manufacturers to design secure products, handle vulnerabilities and provide updates. A manufacturer can be subject to both regimes at the same time.
Sources
General information only, not legal advice. References to statutes, courts and authorities describe published law and practice at the date shown.