NIS2 in Germany for international companies with a German entity

This page is for companies headquartered outside Germany that have a subsidiary, branch or site here, and for the people responsible in the German entity. It shows what applies in Germany and where German procedures differ from a group policy written for every country at once. We make no statements about the law of other Member States; there, the national transposition of the NIS2 Directive (EU) 2022/2555 applies in each case.

Which law applies to the German entity?

The BSI Act (BSIG) as amended on 22 October 2026. Germany transposed the NIS2 Directive with the NIS2 Implementation Act; its Article 1 is the new BSIG, in force since 6 December 2025 with no general transition period. For the German entity, the German statutory text applies. A group policy built on the Directive or on the transposition in the home country has to be checked against it. The legal framework in detail is covered on the page on the NIS2 implementation act.

German law uses its own terms. This page speaks of essential entities (in Germany: besonders wichtige Einrichtungen; the German version of the Directive says wesentliche Einrichtungen) and important entities (wichtige Einrichtungen). If your group policy is in English, add the German terms next to the English ones so that registration and correspondence with the BSI match.

When is the BSI competent?

As a rule, as soon as the entity is established in Germany. Under Section 59 BSIG, the BSI is the competent supervisory authority for essential and important entities established in Germany and for operators of critical facilities located in Germany. The BSI sums it up: what matters is whether a company is established in Germany or has designated a representative here. According to the BSI, a company can therefore be covered even if it does not provide the relevant services in Germany.

Section 60 BSIG applies to a group of entity types: DNS service providers, top-level domain name registries, domain name registration service providers, cloud computing and data centre service providers, content delivery network providers, managed service providers, managed security service providers, and providers of online marketplaces, online search engines and social networking platforms. For them, the BSI is competent only if their main establishment in the EU is in Germany, but then for the whole EU.

The main establishment is the Member State where decisions on cyber security risk management measures are predominantly taken. If that cannot be determined or the decisions are taken outside the EU, it is the Member State where the cyber security measures are carried out, and failing that, the one with the establishment with the most employees in the EU (Section 60(2)). Designating a representative does not prevent legal action against the entity itself (Section 60(4)). If an entity of these types has no establishment in the EU but offers services in the EU, it must designate a representative in a Member State where it offers the services; if it has not designated one, the BSI may declare itself competent for it (Section 60(3)). The table simplifies: at the request of another Member State for mutual assistance, the BSI may also take action against an entity that offers services in Germany (Section 60(5)).

Does registration in the home country cover Germany?

No, except for the Section 60 entity types. Asked whether international companies can register and report centrally with the BSI for all Member States, the BSI answers: for Section 60 entities this can be the case, otherwise not. Obligations under the national transpositions apply independently of each other; registration duties have to be met in several countries if their laws require it. Conversely, registering with the BSI does not replace a registration that another Member State requires.

For group planning, this means: every entity that is essential or important in a Member State needs its own route there. There is no central group registration for the German subsidiary. If a parent and a subsidiary with shared IT each belong to a covered entity type and together reach the thresholds, both are covered according to the BSI; it is then not enough for only the parent to meet the requirements.

How does the German entity register?

In two stages, like every entity in Germany: first an ELSTER organisation certificate via “Mein Unternehmenskonto” (MUK, the German government’s business account), then registration in the BSI portal. The deadline is three months after the entity first or again qualifies as essential or important (Section 33(1)). For entities already in scope on 6 December 2025 it has passed; the BSI asks them to register without delay. Steps, required details and a completed checklist are on the page on NIS2 registration.

For international groups, three points differ from what many expect:

• Tax number: MUK requires a German tax number. A German GmbH normally has one. According to the BSI, entities without a German tax number can apply to the Neubrandenburg tax office (RAB) for an identifier in the form of a tax number; when registering in “Mein ELSTER”, Mecklenburg-Vorpommern must then be selected as the federal state. The identifier triggers no tax or levy checks.
• One profile per entity: each NIS‑2-relevant entity needs its own MUK profile. Access held by the parent company is not enough for the subsidiary.
• Member States and IP addresses: you list the Member States in which the entity carries out the core activity that leads to its classification; maintenance or customer service do not count, according to the BSI. Public static IP ranges of foreign subsidiaries may be reported as well, the BSI says. Entities registering under Section 34 list the ranges of the main establishment and of the other EU establishments.

Where, and in which language, are incidents reported?

Significant security incidents are reported to the joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK): an early warning no later than 24 hours after becoming aware, an incident notification with an initial assessment no later than 72 hours, and a final report no later than one month after that (Section 32(1)). Reports go through the BSI portal; entities not yet registered report via an online form in the BSI’s reporting and information portal, according to the BSI. The reporting process is described on the page on NIS2 incident reporting.

On language, the BSI states explicitly: incident reports may be submitted in English. Otherwise, Section 23 of the German Administrative Procedure Act (VwVfG) applies to administrative procedures: the official language is German, and for applications or documents in a foreign language the authority should request a translation. For registration, requests for information and supervisory measures, we therefore recommend naming a person in the German entity who can handle correspondence in German.

If an incident has effects in several Member States, the BSI must be informed without undue delay where it is competent. Whether further reporting obligations exist in other countries is for the company to check; according to the BSI, a report to the BSI does not automatically meet them.

What does this mean for group IT and management?

• Size including the group: partner and linked enterprises count towards the classification, according to the BSI also those outside Germany and the EU. Only if the entity is independent of the group in its IT do its own figures alone count (Section 28(4)). How to check and document this is shown in the applicability check.
• Measures apply to the entity: the German entity must take the risk management measures under Section 30 BSIG. If group IT runs its systems, the entity must be able to show that the measures are implemented there; the measures in detail are on the page on Section 30 BSIG.
• Reporting by third parties: service providers, including group IT, can be authorised to report; responsibility for the incident and the content stays with the entity. For the start of the deadlines, the BSI refers to the moment an employee of the entity becomes aware of the incident (during working hours).
• Management of the German entity: Section 38 BSIG obliges the management body of the entity to implement the measures, oversee their implementation and attend training regularly. That means the managing directors of the German entity. Their duties are explained on the page on NIS2 and management.

Example: checklist for a German group subsidiary

Fictitious example, not a client. A group headquartered in the United States makes measuring equipment. It includes a German GmbH that develops and manufactures measuring instruments (NACE division 26, 140 employees in annual work units) and a sales company in the Netherlands. The GmbH’s IT is run by the group data centre in the United States, and a group security team monitors all sites. The GmbH’s completed checklist looks like this:

The checklist is a working aid. Mapping the entity type, the group calculation and whether a representative is needed belong with a lawyer in the individual case.

Three typical gaps in group subsidiaries

Gaps and remedies are our own professional assessment. Whether your German entity meets the requirements of Section 30 BSIG today is shown by the NIS2 gap analysis, which we carry out in German or English.