NIS2 in Germany: Which Companies Are Affected and What to Do Now

Germany's NIS2 Implementation Act (NIS2UmsuCG) came into force on December 6, 2025, with no transition period. Around 29,500 companies in 18 sectors are affected, generally those with 50 or more employees or annual revenue above €10 million. The deadline for registering with the BSI, Germany's Federal Office for Information Security, passed on March 6, 2026. If you missed it, the obligation still applies, and you should register without delay.

Previously, around 4,500 companies were supervised by the BSI. That number has grown more than sixfold, and most of the newly affected companies are mid-sized businesses that have never had to deal with IT regulation before.

Are we affected? A two-step check

Step 1: Does your business belong to one of the 18 sectors?

The law distinguishes between sectors of "high criticality" and "other critical sectors". They include energy, transport, banking, healthcare, drinking water, wastewater, digital infrastructure, IT services, public administration and space, as well as postal and courier services, waste management, chemicals, food production, manufacturing (including mechanical engineering and medical devices), digital services and research.

Particularly relevant for mid-sized companies: mechanical engineering, food production, chemicals, logistics and IT services are all covered. If you supply businesses in these areas, take a close look.

Step 2: Do you exceed the thresholds?

The basic rule: 50 or more employees, or more than €10 million in annual revenue and balance sheet total. Larger organizations with 250 or more employees or €50 million in revenue count as "essential entities" with stricter obligations. For operators of critical facilities, lower thresholds sometimes apply regardless of size.

The ten mandatory measures under Section 30

The law doesn't prescribe a particular certification. Instead, it requires "appropriate, effective and proportionate" measures in line with the state of the art. Section 30 names ten areas:

1. Policies for risk analysis and information security
2. Incident handling
3. Business continuity, backup management and crisis management
4. Supply chain security
5. Security in the acquisition, development and maintenance of IT systems
6. Assessing the effectiveness of the measures taken
7. Cybersecurity training and basic cyber hygiene
8. Use of cryptography and encryption
9. Personnel security, access control and asset management
10. Multi-factor authentication and secured communications

In practice, for most businesses this means building an information security management system (ISMS), even though the law doesn't use the term. Without structured documentation, you can't prove any of the ten requirements in an audit.

Reporting obligations: the 24-hour rule

Significant security incidents must be reported to the BSI in three stages:

• Within 24 hours: an early warning with an initial assessment
• Within 72 hours: a more detailed report with an evaluation
• Within one month: a final report

The 24 hours start from the moment you become aware of the incident. If you only then figure out who's allowed to report and through which channel, you lose valuable time. A defined reporting process with named responsibilities is therefore one of the first steps.

Fines and personal liability

Essential entities face fines of up to €10 million or 2 percent of worldwide annual revenue; important entities up to €7 million or 1.4 percent. Whichever amount is higher applies.

The point that gets management's attention: Section 38 explicitly holds senior management accountable. They must approve the measures, oversee their implementation and take part in regular training. Gross breaches of duty can lead to personal liability, and that can't be delegated to IT.

What to do now

If you haven't started yet, work through these steps in this order:

1. Determine whether you're affected. Check the sector and thresholds and document the result. Even a "not affected" should be justified in writing.
2. Register with the BSI, if you're affected. Registration runs through the BSI portal and requires an ELSTER organization certificate.
3. Carry out a gap analysis. Go through the ten areas in Section 30 and honestly assess what's already in place.
4. Set up a reporting process. Who detects an incident, who decides whether to report it, who files the report: all settled before the first incident.
5. Adopt an action plan with a budget and deadlines. An approved plan significantly strengthens your position in an audit, even if not everything has been implemented yet.
6. Include your supply chain. Service providers with access to your systems belong in the assessment.

A realistic timeframe for businesses without existing security management: twelve to 24 months for a complete program. That's no reason to wait. On the contrary, demonstrable progress is what counts.

The most common misconceptions

"We're too small." The threshold is 50 employees, not 500. Many mid-sized businesses are above it without realizing.

"But we have a firewall." NIS2 requires organization, not just technology: processes, responsibilities, evidence, training.

"Our IT provider takes care of that." A provider can handle the implementation, but responsibility stays with management.

"We'll wait until things settle down." The law has applied since December 2025 with no transition period, and the first BSI audits are approaching. There's no grace period.

Frequently asked questions

Since when has NIS2 applied in Germany?

Germany's NIS2 Implementation Act (NIS2UmsuCG) came into force on December 6, 2025, with no transition period. Affected companies had to meet their obligations from day one.

Which companies are affected by NIS2?

Around 29,500 companies in 18 sectors are affected, generally those with 50 or more employees or annual revenue above €10 million. The sectors include energy, transport, healthcare, IT services, mechanical engineering, chemicals, food production and logistics.

How high are the fines under NIS2?

Essential entities face fines of up to €10 million or 2 percent of worldwide annual revenue; important entities up to €7 million or 1.4 percent. In addition, management can be held personally liable for gross breaches of duty.

What happens if we missed the BSI registration?

The registration deadline passed on March 6, 2026. The obligation still applies, and late registration is possible. If you haven't registered yet, you're in default and should register through the BSI portal without delay.

Are small companies with fewer than 50 employees affected by NIS2?

Usually not directly. They can be affected indirectly through the supply chain, because companies covered by NIS2 must assess the security of their service providers and suppliers and pass requirements on to them contractually.