NIS2 requirements in Germany: BSIG obligations matrix

Last updated: 2026-11-06

The ten areas of measures are covered in detail on the Section 30 BSIG page, the order of implementation in the NIS2 implementation plan. Whether your company is in scope at all is the subject of the NIS2 applicability check.

What does NIS2 require of companies in Germany?

NIS2 is an EU directive (Directive (EU) 2022/2555). Germany transposed it through the BSI Act (BSIG), enacted by the NIS2 Implementation Act, which entered into force on 6 December 2025; this page refers to the version as amended on 22 October 2026. There is no general transition period. Section 66 BSIG defers only certain provisions on critical facilities and parts of registration; the duties under Sections 30, 32 and 38 have applied since the act entered into force, whether or not the entity has completed its registration yet.

Diagram “NIS2 obligations under the BSIG”. It starts with classification under Section 28. Five blocks of obligations follow, grouped in one frame: registration (Sections 33, 34, no later than three months after becoming subject), risk management and documentation (Section 30), reporting significant incidents (Section 32, 24 hours, 72 hours, one month), management (Section 38, implement, oversee, train regularly), supervision and evidence (Section 61 for essential, Section 62 for important entities, Section 39 for operators of critical facilities). Attached to the frame at the bottom: in case of breach, fines under Section 65 by offence. Footer: applies since 6 December 2025. — Tap the graphic to open it at full size.NIS2 obligations under the BSIG. Source: BSIG as amended on 22 October 2026; own illustration.

Obligations matrix: duty, legal reference, addressee, timing

“EE” means essential entities, “IE” important entities. “Since 6 Dec 2025” applies to entities in scope on that date; an entity that crosses a threshold later is in scope from that point on (our reading).

Obligation	Legal reference	Who	From when	More
Assess applicability and record the result (prerequisite for everything else; the BSI does not notify you)	Section 28 BSIG, Annexes 1 and 2	any company in one of the sectors	ongoing, whenever size or activities change	Applicability
Register with the BSI	Section 33(1); additionally Section 34 for certain digital entity types	EE, IE, domain name registration service providers; also entities exempted under Section 28(5) and (6)	no later than three months after coming into scope; for entities in scope on 6 Dec 2025 this was 6 March 2026 (calculated)	Registration
Report changes to registration data	Section 33(5), Section 34(2)	registered entities	Section 34: within three months; Section 33(5) currently applies in its version up to 28 July 2026 (Section 66)	Registration
Risk management measures in ten areas	Section 30(1), (2); for certain digital entity types Implementing Regulation (EU) 2024/2690 takes precedence (Section 30(3))	EE, IE	since 6 Dec 2025	Section 30 BSIG
Document compliance	Section 30(1) sentence 3	EE, IE	since 6 Dec 2025	Section 30 BSIG
Attack detection systems	Section 31(2)	operators of critical facilities	since 6 Dec 2025	-
Report significant incidents: early warning (German: frühe Erstmeldung), 72-hour notification, final report (progress report if the incident is ongoing)	Section 32(1), (2)	EE, IE	since 6 Dec 2025; 24 hours and 72 hours after becoming aware, final report one month after the notification	Incident reporting
Inform recipients of services	Section 35(1) (when ordered by the BSI); Section 35(2) (on own initiative, certain sectors only)	EE, IE	when the case arises	Incident reporting
Implement the measures and oversee their implementation	Section 38(1)	management of EE and IE	since 6 Dec 2025	Management
Regular training	Section 38(3)	every member of management	regularly; the act sets no interval	Management training
Evidence through audits, inspections or certifications	Section 39	operators of critical facilities	every three years, date set by the BSI	-
Supervision: audits, inspections, on-site checks ordered by the BSI	Section 61	EE	evidence under Section 61(3) no earlier than three years after entry into force, i.e. from 6 Dec 2028 (calculated)	Applicability (supervision by category)
Supervision when there are indications	Section 62	IE, where facts suggest a breach	since 6 Dec 2025	Applicability (supervision by category)
Fines by offence	Section 65	EE, IE	since 6 Dec 2025	table below on this page

Exemptions: Sections 30, 32 and 38, among others, do not apply to public telecoms operators and providers or to energy companies subject to Sections 5c to 5e of the Energy Industry Act (Section 28(5)), nor to financial entities under DORA and the telematics infrastructure (Section 28(6)); registration remains mandatory in both cases. If operating an energy installation is only a secondary activity, the exemption does not apply (Section 28(5) sentence 4). Which sections are exempted and the further limits are explained in the NIS2 applicability check.

Do essential and important entities have different obligations?

Not for registration, measures, reporting or management: Sections 30, 32, 33 and 38 apply to both categories alike. The differences lie in supervision and fines. The BSI may order audits and inspections of essential entities on its own initiative (Section 61), but of important entities only where facts suggest a breach (Section 62). Maximum fines differ as shown below. Operators of critical facilities have additional duties under Sections 31 and 39.

Which fines apply to which obligation?

Maximum fines depend on the offence and the category of entity. A selection from Section 65 BSIG:

Offence	EE	IE
Measures under Section 30(1) not taken or not documented; incident not reported, or not reported in time, under Section 32	up to €10 million; with total turnover above €500 million, up to 2% of total turnover	up to €7 million; with total turnover above €500 million, up to 1.4% of total turnover
Registration under Section 33 or 34 not made, incorrect or late	up to €500,000

For the offences in the first row the maximum is not halved for negligence (Section 65(9)). Other offences, for example regarding evidence from operators of critical facilities, carry their own maximums. Management is liable to its own entity for culpably caused damage under company law (Section 38(2)); the page on management obligations explains this.

Example: the matrix filled in for a courier company

Fictitious example, not a client. A regional courier and parcel company employs 90 people (in annual work units), has a turnover of €14 million and does not belong to a group. Postal and courier services are listed in Annex 2; with 50 or more employees the company is an important entity. Management has the matrix filled in for the company:

Obligation	Status in the example	Next step	Owner
Classification	memo from January 2026, important entity	review annually with the year-end figures	Management
Registration	completed in February 2026	report changes to contact data and IP ranges	Head of IT
Section 30 measures	backups and MFA in place, no risk analysis, supply chain not addressed	review all ten areas with the checklist	Head of IT, Purchasing
Section 30 documentation	scattered, no register	set up an evidence register	Head of IT
Section 32 reporting	no reporting process, reachable on weekdays only	reporting chain with deputies, check access to the BSI portal	Head of IT, Management
Section 38 oversight	no reporting to management	quarterly status report	Management
Section 38 training	no training yet	initial training for both managing directors	Management

The matrix shows the company where it stands: registration is done, reporting and management duties are largely open. These items move to the front of the implementation plan.

Typical gaps

Gap	Cause	Effect	Remedy
Waiting for registration before starting measures	Belief that obligations start with registration	Duties under Sections 30, 32 and 38 remain unmet although they apply	Handle registration and measures in parallel
No reporting capability	Incidents are handled technically, nobody owns the report to the BSI	The 24-hour deadline passes in a real incident	Reporting process with roles, deputies and out-of-hours availability
Management merely informed	Information security is seen as an IT topic	The oversight duty under Section 38(1) cannot be evidenced	Regular report to management with recorded decisions

NIS2 alongside other frameworks

Other frameworks may apply alongside NIS2. The pages linked below cover each relationship in detail:

ISO 27001: According to the BSI, a comprehensively implemented ISMS covers a large part of Section 30, but a certificate does not automatically fulfil all BSIG obligations. There is no “NIS2 certification”. See NIS2 and ISO 27001.
IT-Grundschutz: The BSI baseline protection methodology is not mandatory for NIS2; a certification based on it can make evidence easier. See Grundschutz-Readiness: NIS2 and IT-Grundschutz (German).
C5: Cloud providers with a C5 audit report ask what counts for NIS2. Which obligations remain is explained at C5-Readiness: C5 and NIS2 (German).
CRA: Regulation (EU) 2024/2847 governs the cybersecurity of products with digital elements and the obligations of manufacturers and other economic operators; NIS2 governs the obligations of the entity operating IT. See CRA-Readiness: CRA, NIS2 and DORA.
DORA: Sections 30, 31, 32, 35, 36, 38 and 39 BSIG do not apply to financial entities under DORA, but they still have to register with the BSI. How the two regimes divide in detail: DORA and NIS2.
KRITIS Umbrella Act (KRITIS-Dachgesetz): In force since 17 March 2026, it covers the resilience of critical facilities; pure IT security incidents remain under the BSIG. There is currently no registration obligation under this act because the ordinance identifying critical facilities is still pending.
Telecommunications: Under Section 28(5), Sections 30, 31, 32, 35, 36, 38, 39, 61 and 62 BSIG do not apply to operators of public telecoms networks and providers of publicly available telecoms services; registration remains. The rules under the Telecommunications Act are covered at Blackfort Technology: telecoms providers under NIS2 and the TKG.

The BSIG does not directly oblige suppliers that are not themselves in scope. In the BSI’s view, however, their customers must bind them to security requirements in order to meet Section 30(2) no. 4.

This page provides general information, not legal advice. Which obligations apply to your company has to be assessed case by case.

Frequently asked questions

Which obligation comes first when time is short?+

Legally, none: the obligations have applied side by side since 6 December 2025, and the law sets no order. Our professional recommendation is to start with the obligations that have short deadlines and with management responsibility, that is classification, registration, the ability to report incidents and a management decision, and to follow with the risk analysis and the Section 30 measures. The NIS2 implementation plan shows what such a set of immediate measures looks like; a plan sets the order of work but does not postpone any obligation.

Do we have to send evidence to the BSI regularly?+

Only operators of critical facilities, every three years under Section 39. All other entities provide evidence when the BSI orders it. You still have to document compliance on an ongoing basis (Section 30(1) sentence 3).

Do the requirements also apply to our suppliers?+

Not directly. The BSIG does not oblige suppliers that are not themselves in scope. In the BSI’s view, however, entities in scope must bind their suppliers to security requirements in order to meet Section 30(2) no. 4.

Who monitors compliance?+

The BSI. It may order audits, inspections and on-site checks for essential entities (Section 61) and act against important entities where facts suggest a breach (Section 62). In almost all cases the BSI is also the authority for fines (Section 65(10)).

Sources

BSI Act (BSIG), consolidated version as amended on 22 October 2026 (retrieved 2026-11-06)
BSIG Section 28: essential and important entities (retrieved 2026-11-06)
BSIG Section 32: reporting obligations (retrieved 2026-11-06)
BSIG Section 33: registration obligation (retrieved 2026-11-06)
BSIG Section 38: duties of management (retrieved 2026-11-06)
BSIG Section 61: supervision of essential entities (retrieved 2026-11-06)
BSIG Section 65: fines (retrieved 2026-11-06)
BSIG Section 66: transitional provisions (retrieved 2026-11-06)
Directive (EU) 2022/2555 (NIS2 Directive) (retrieved 2026-11-06)
Regulation (EU) 2024/2847 (CRA), Art. 1 (retrieved 2026-11-06)
BSI: general NIS2 FAQ (German) (retrieved 2026-11-06)
BSI: one-pager NIS2 and ISO 27001, version 1.0 (German) (retrieved 2026-11-06)
BBK: FAQ on the KRITIS Umbrella Act (German) (retrieved 2026-11-06)

This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).

NIS2 requirements: which obligation applies to whom, and from when