NIS2 in Germany: the NIS2UmsuCG explained (2026)

In brief: Germany transposed NIS2 late but strictly. The NIS2 Implementation Act (NIS2UmsuCG) and the new BSI Act (BSIG) have applied since 6 December 2025, with no transition period. Roughly 29,500 organizations are in scope, split into “particularly important” (besonders wichtige) and “important” (wichtige) entities. They had to register with the BSI within three months, so by 6 March 2026; by mid-2026 an estimated 10,500 had still not done so. Registration remains mandatory, fines reach €10 million or 2% of global turnover, and management is personally liable. This guide explains who is affected, what the BSI expects, and what to do if you are late.

Timeline: how Germany got here

Who is affected: the German scope

Official sources: the BSI’s NIS2 information page for regulated companies (in German) and its free NIS2 self-assessment tool (Betroffenheitsprüfung) tell you within ten minutes whether you are in scope. The legal text is the new BSIG 2025 on gesetze-im-internet.de.

The BSIG follows the NIS2 logic but uses its own terms:

• Particularly important entities (besonders wichtige Einrichtungen): large companies (250+ employees or €50 million turnover and €43 million balance sheet) in the high-criticality sectors (energy, transport, banking, financial market infrastructure, health, water, waste water, digital infrastructure, ICT service management, public administration, space), plus operators of critical infrastructure (KRITIS) regardless of size, qualified trust service providers, TLD registries and DNS providers.
• Important entities (wichtige Einrichtungen): medium-sized companies (50+ employees or €10 million turnover and balance sheet) in the high-criticality sectors, and medium and large companies in the other critical sectors (postal and courier, waste, chemicals, food, manufacturing of medical devices, machinery, vehicles and electronics, digital providers, research).
• Federal administration: separately regulated in the BSIG, with its own obligations.

The BSI estimates the total at around 29,500 organizations, most of them “important” entities in manufacturing. The BSI provides an online self-check (Betroffenheitsprüfung); the law expects you to assess your own status, not to wait for a letter.

The obligations under the BSIG

1. Registration with the BSI

Within three months of falling into scope, via the BSI portal and the “Mein Unternehmenskonto” business account: company data, sector, contact details, IP ranges and the member states where you operate. Changes must be reported within two weeks. The deadline for entities in scope on day one was 6 March 2026. If you have not registered, register now; the obligation does not lapse and late voluntary registration is treated more favourably than being found.

2. Risk management measures (§ 30 BSIG)

The ten NIS2 minimum measures, proportionate to the risk: risk analysis and security policies, incident handling, business continuity and backup, supply chain security, secure procurement and development, effectiveness assessment, cyber hygiene and cybersecurity training, cryptography, access control and asset management, and multi-factor authentication and secure communication. Particularly important entities must also use attack detection systems where they are KRITIS operators.

3. Incident reporting (§ 32 BSIG)

Early warning within 24 hours, notification within 72 hours, final report within one month, through the BSI’s reporting portal. “Significant” incidents are those causing serious operational disruption or financial loss, or affecting others.

4. Management duties (§ 38 BSIG)

Management must approve and oversee the risk management measures and must regularly attend cybersecurity training. Managers are personally liable for breaches of this duty under German corporate law; the BSIG explicitly excludes the company from waiving that liability.

5. Evidence and supervision

The BSI can request information and evidence, order audits, and for particularly important entities carry out proactive supervision. Fines go up to €10 million or 2% of global turnover for particularly important entities and €7 million or 1.4% for important entities.

Missed the registration deadline? Do this

1. Run the BSI self-check today and document the result, including if you conclude you are out of scope.
2. Register immediately if in scope. Late is better than absent, and the registration itself takes under an hour once you have the business account.
3. Gap-assess against § 30. Most German SMEs find three gaps: supply chain security, documented incident handling, and training without evidence.
4. Put the board on a training record. § 38 requires it, and it is the first thing an auditor asks for. Guardey’s weekly challenges include a management track and produce per-person completion reports.
5. Test the 24-hour reporting path. Who notices, who decides, who files? Rehearse once.

Training as evidence: what the BSI will accept

Neither the directive nor the BSIG prescribes a format, but “cyber hygiene and cybersecurity training” must be demonstrable. A yearly slide deck with a sign-in sheet is weak evidence; a continuous program with completion data per employee, phishing simulation results and a management training record is strong evidence. Guardey’s security awareness training is available in German, runs in three minutes a week, includes phishing simulations and generates the reports for NIS2, ISO 27001 and other frameworks.

Frequently asked questions

Is NIS2 already in force in Germany?

Yes. The NIS2UmsuCG and the new BSIG have applied since 6 December 2025. There is no transition period.

Who must register with the BSI?

Every particularly important and important entity, within three months of falling into scope. For organizations in scope on 6 December 2025 the deadline was 6 March 2026. Registration is still required if you missed it.

What is the difference between “besonders wichtig” and “wichtig”?

Size and sector. Large companies in high-criticality sectors and KRITIS operators are “particularly important” (proactive supervision, higher fines); medium companies in those sectors and medium and large companies in the other sectors are “important” (reactive supervision).

Does NIS2 in Germany require employee training?

Yes. § 30 BSIG lists cyber hygiene and cybersecurity training among the mandatory measures, and § 38 obliges management to attend training themselves.

Where can I find the official text?

The NIS2UmsuCG was published in the Federal Law Gazette (BGBl. 2025 I No. 301). The BSI’s NIS-2 pages contain the self-check, the registration portal and FAQs. For the EU-level picture, see our NIS2 guide 2026 and NIS1 vs NIS2.