Germany's NIS2 implementation act and the BSIG 2025: what applies since when

This page sets out the legal position in Germany: which act transposes NIS2, which version applies, what Section 66 of the BSI Act defers and which ordinances are still pending. Which obligations apply in detail is set out in the overview of NIS2 requirements; whether your company is covered is explained under NIS2 applicability. All statutory texts cited here are German; English terms are our working translations.

What is the German NIS2 implementation act called?

Its official title is “Gesetz zur Umsetzung der NIS‑2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung”, roughly “Act implementing the NIS2 Directive and regulating essential principles of information security management in the federal administration”. It is dated 2 December 2025 and was published in the Federal Law Gazette (BGBl.) 2025 I No. 301. The BSI, Germany's Federal Office for Information Security, calls it the “NIS‑2-Umsetzungsgesetz”.

You may come across the abbreviation NIS2UmsuCG in articles and searches. It does not appear in the Federal Law Gazette or in the statutory text. “NIS2-Gesetz” (NIS2 Act) is not an official name either. People who use these terms mean the implementation act and above all the BSI Act contained in it. When you cite the law in policies, contracts or reports, refer to the act that contains the obligations: “BSIG as amended on …”.

How is the act structured?

The implementation act is an omnibus act with 30 articles. Article 1 contains the new BSI Act. It replaces the BSI Act of 2009, which Article 29 repealed on the day after promulgation. The other articles amend other laws and ordinances.

For companies, Article 1 is almost all that matters. Part 3 of the BSIG contains classification (Section 28), risk management (Section 30), incident reporting (Section 32), registration (Sections 33 and 34) and management body duties (Section 38). Under Section 28(5), parts of these rules do not apply to certain telecommunications and energy companies; the exceptions are explained under NIS2 applicability. Telecom providers find the classification at telecoms providers under NIS2 and the TKG.

Which version of the BSIG applies?

The BSI Act of 2 December 2025 applies, last amended by Article 8 of the Act of 22 October 2026 (BGBl. 2026 I No. 318). That is the status on gesetze-im-internet.de on 6 November 2026, in short: BSIG as amended on 22 October 2026. Since promulgation, the act has been amended three times:

• by Article 4 of the Act transposing Directive (EU) 2022/2557 and strengthening the resilience of critical facilities of 11 March 2026 (BGBl. 2026 I No. 66), with effect from 17 March 2026; this act also introduced the KRITIS Umbrella Act,
• by Article 9 of an act of 21 July 2026 (BGBl. 2026 I No. 221), with effect from 29 July 2026,
• by Article 8 of the Act modernising the Federal Police Act of 22 October 2026, with effect from 28 October 2026. According to the amendment overview, this change does not affect the obligations of entities in Sections 28 et seq.; according to a footnote in the consolidated text on gesetze-im-internet.de, one amending instruction concerning Section 2 cannot be carried out because the wording does not match.

The amendment dates are taken from the amendment overview on buzer.de (a secondary source) and checked against the statutory text.

The consolidated text on gesetze-im-internet.de is unofficial. Only the promulgations in the Federal Law Gazette are official. Our recommendation: record in your documentation which version you rely on and check the status at fixed intervals, for example every quarter and before any audit.

Since when does it apply, and is there a transition period?

The act has applied since 6 December 2025. The Bundestag passed it on 13 November 2025, the Bundesrat on 21 November 2025; it was promulgated on 5 December 2025 and entered into force the following day. There is no general transition period. According to the BSI, entities in scope must meet their obligations “in principle immediately after entry into force”, citing registration, risk management and incident reporting as examples.

The obligations do not depend on registration. An entity in scope has had to implement the measures under Section 30 since entry into force and document compliance, even if its registration is still missing. A NIS2 implementation plan does not defer these obligations; it sets the order in which gaps are closed.

Germany transposed late: the Directive required transposition by 17 October 2024 and application from 18 October 2024. Entities that come into scope later, for example because they exceed the size threshold for the second year in a row, have their own effective dates; the NIS2 deadlines then run from the date they come into scope.

What does Section 66 defer, and what not?

Section 66 defers only four rules, all related to critical facilities. The new wording of the definitions of “critical facility” (Section 2 no. 22) and “critical service” (Section 2 no. 24) and of Section 33(2) and (5) applies only once the ordinance under Sections 4(3) and 5(1) of the KRITIS Umbrella Act is in force. Until then, earlier versions continue to apply.

Where you read about “staggered application”, this concerns only these critical facility rules. For all other essential and important entities, Section 66 defers nothing.

What is still left to ordinances?

The BSIG applies without any further ordinance, but it contains several powers to issue ordinances. One European regulation already has effect today, though only for eleven digital entity types: Implementing Regulation (EU) 2024/2690. Under Section 30(3) it takes precedence for these entity types, such as cloud providers, data centres and managed service providers, and also defines for them when an incident is significant. The sector directory shows which entity types these are.

Binding without an ordinance: the BSI has itself set out the registration procedure under Section 33(6), version 1.0 of 26 June 2026. How registration in the BSI portal works is described on a separate page. Physical resilience of critical facilities is governed by the KRITIS Umbrella Act, in force since 17 March 2026; duties under it arise only with the ordinance and registration.

On terminology: the Directive speaks of “essential” and “important” entities, the BSIG of essential entities (in Germany: besonders wichtige Einrichtungen) and important entities (wichtige Einrichtungen). They are the same categories.

Timeline: what applies since when

The overview summarises the legal position for companies. Dates that are not stated verbatim in the source have been calculated by us and are marked as such.

Example: recording the legal basis for management

Fictitious example, not a client. A manufacturer of electric motors with 140 employees has classified itself as an important entity (Annex 2, manufacture of electrical equipment). Management asks the IT manager for a sheet that records the legal position and that internal policies can refer to. He records:

• Legal basis: BSIG as amended on 22 October 2026, checked on 6 November 2026 on gesetze-im-internet.de.
• Application: since 6 December 2025, no transition period; registration, risk management under Section 30 and reporting channels under Section 32 are therefore already required.
• Section 66: does not concern us, because we operate no critical facility under the BSI Critical Infrastructure Ordinance.
• Implementing Regulation 2024/2690: not applicable to us, because we are none of the eleven digital entity types; on whether an incident is significant, we use Article 3(1) as guidance, as the BSI recommends.
• Follow-up: check the version every quarter; when the BSIG changes, align policies and the reporting process.

The sheet does not replace a legal review; it makes sure all internal documents refer to the same version.

Three common misconceptions

This page provides general information. Whether and how your company is affected depends on the individual case and may require legal advice. If you want to know where your company stands against the BSIG obligations, the NIS2 gap analysis is the structured starting point.