NIS2 in Germany: what the NIS2UmsuCG and the new BSIG require, who is in scope and the BSI deadlines

NIS2 applies in Germany through the NIS2UmsuCG, in force since 6 December 2025, and a new BSIG. It covers entities in an Annex 1 or 2 sector with 50 or more staff, or over €10 million in turnover and balance sheet. They must register with the BSI, report significant incidents within 24 hours and take the § 30 measures.

This guide covers the law and its dates, who is in scope, registration, incident reporting, the § 30 measures, KRITIS operators, management duties, supervision and fines, what the law leaves open, and a checklist.

Obligation	BSIG	NIS2	The rule in one line
Scope and entity classes	§ 28(1), (2)	Art. 2, 3	Annex 1 or 2 entity type plus size; some types regardless of size
Negligible activities	§ 28(3)	No equivalent article	Negligible side activities may be disregarded
Counting staff and turnover	§ 28(4)	Art. 2(1)	EU SME Recommendation, with an exception for IT independence
Federal administration	§ 29, § 44	Art. 2(2)(f)	Federal bodies must meet the BSI minimum standards
Risk-management measures	§ 30	Art. 21	Suitable, proportionate and effective measures, documented
Extra measures for kritische Anlagen	§ 31	Art. 5	Higher protection and attack detection for the critical facility
Incident reporting	§ 32	Art. 23	24 hours, 72 hours, one month
Registration	§ 33, § 34	Art. 3(4), 27	Within three months of falling in scope
Management duties	§ 38	Art. 20	Implement, oversee, train; liability to the entity
KRITIS evidence	§ 39	Art. 5	Audits, tests or certification every three years
Supervision	§ 61, § 62	Art. 32, 33	Wider powers over besonders wichtige than over wichtige
Fines	§ 65	Art. 34, 35	Up to €10m (besonders wichtige) or €7m (wichtige); 2% or 1.4% above €500m turnover

What is the NIS2UmsuCG?

The NIS2UmsuCG is Germany’s NIS2 transposition act. Its official title is the Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung. The short form stands for NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz.

It is an Artikelgesetz (omnibus act). One article enacts a new BSIG, the act on the BSI and on the information security of entities. Other articles amend sector laws, including telecommunications and energy law. The company duties sit in the new BSIG.

Step	Date
EU transposition deadline for NIS2	17 October 2024
Federal cabinet adopts the government draft	30 July 2025
Bundestag passes the law	13 November 2025
Bundesrat passes the law	21 November 2025
Law signed (Ausfertigung)	2 December 2025
Published, BGBl. 2025 I Nr. 301	5 December 2025
Entry into force	6 December 2025

Germany transposed more than a year after the EU deadline. The duties below have applied since 6 December 2025.

Who is in scope of NIS2 in Germany?

You are in scope if you match an entity type in Annex 1 or Annex 2 (Anlage 1, Anlage 2) of the BSIG and reach the size thresholds. Some types are in scope regardless of size. The BSIG sorts regulated companies into two classes:

• besonders wichtige Einrichtungen (essential entities; literally “particularly important entities”)
• wichtige Einrichtungen (important entities)

The German text of the Directive says “wesentliche Einrichtungen” for the first class.

Class	Who	Size test
besonders wichtige, § 28(1)	Operators of kritische Anlagen (critical facilities), qualified trust service providers, TLD registries and DNS service providers, whatever their size; public telecoms providers with at least 50 employees, or turnover and balance sheet each above €10m; large Annex 1 entities	Annex 1 entities: at least 250 employees, or turnover above €50m and balance sheet above €43m
wichtige, § 28(2)	Other trust service providers, whatever their size; smaller public telecoms providers; Annex 1 and Annex 2 entities that meet the size test and are not besonders wichtige	Annex 1 and 2 entities: at least 50 employees, or turnover and balance sheet each above €10m

Public telecoms network and service providers, trust service providers, TLD registries and DNS service providers are in scope regardless of size. For public telecoms providers the class depends on size. Trust service providers that are not qualified are wichtige Einrichtungen whatever their size.

Annex 1 covers seven sectors: Energie, Transport und Verkehr, Finanzwesen, Gesundheit, Wasser, Digitale Infrastruktur and Weltraum. In the BSIG, Digitale Infrastruktur also includes managed service and managed security service providers. Annex 2 covers a further part of Transport und Verkehr, Abfallbewirtschaftung, chemicals, food, Verarbeitendes Gewerbe (manufacturing), Anbieter digitaler Dienste (digital providers) and Forschung (research).

The fastest first pass is our NIS2 scope checker. The EU-level logic of the two classes is in essential vs important entities.

How are employees and turnover counted?

• Commission Recommendation 2003/361/EC applies, except Article 3(4) of its Annex.
• Staff are counted in annual work units, not heads.
• The figures cover the whole enterprise, including linked enterprises, even those outside Germany and the EU.
• German exception, § 28(4): partner and linked enterprise data is not added where the entity, taking legal, economic and actual circumstances into account, is independent of those enterprises in the design and operation of its IT systems, components and processes.

That exception matters for subsidiaries. In practice, one that runs its own IT independently may use its own figures. One that runs on group IT will usually count the group.

What is the negligible activities rule in § 28(3)?

When assigning an entity to an Annex 1 or 2 entity type, business activities that are negligible compared with its overall business may be disregarded. The BSI’s possible indicators are the staff working in the activity, the turnover it generates and its balance sheet total. If the articles of association or a comparable founding document name the activity, the BSI says that can be a sign it is not negligible.

In practice, this helps a company whose only link to an Annex sector is a small side business, not one whose articles name that business as a purpose.

KRITIS, DORA, public bodies and foreign companies

• Kritische Anlagen: operators are besonders wichtige regardless of employees, turnover or balance sheet (§ 28(1) no. 1). The BSI says whether a facility counts is checked, as before, against the BSI-Kritisverordnung (BSI-KritisV).
• Financial entities under DORA: § 28(6) no. 1 disapplies §§ 30, 31, 32, 35, 36, 38 and 39 for financial entities under Regulation (EU) 2022/2554, where DORA’s own rules apply. Registration under § 33 is not on that list, so they still register with the BSI.
• Telecoms and energy: § 28(5) disapplies §§ 30, 31, 32, 35, 36, 38, 39, 61 and 62 for public telecoms networks and services, and for energy networks, energy facilities and digital energy services subject to §§ 5c to 5e of the Energy Industry Act (EnWG). Their sector rules in the EnWG and the Telecommunications Act (TKG) apply instead, except insofar as they operate other critical facilities or fall under another Annex entity type.
• Federal administration: bodies of the Bundesverwaltung are covered under § 29(1). The BSI’s minimum standards, set under § 44(1), are binding on them.
• Local administration is not covered as such. Municipal enterprises can be, if they operate a critical facility or meet the thresholds in a listed sector.
• Establishment: the BSI’s test is whether a company is established in Germany or has named a representative here.

The BSI does not tell companies whether they are in scope; each assesses itself. There is no general opt-out either. § 37 lets the Federal Ministry of the Interior issue an exemption notice (Ausnahmebescheid), partial or full, only for entities active in, or serving authorities in, national security, public security, defence or law enforcement, and only where they meet equivalent requirements. The ministry acts on a proposal from other ministries or on its own initiative; the BSI confirms entities cannot apply for one.

When was the BSI registration deadline, and how do you register?

Under § 33 BSIG, besonders wichtige and wichtige Einrichtungen, and domain name registration service providers, must register with the BSI no later than three months after they first, or again, fall in scope. The registration facility is run jointly by the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK). For companies in scope when the law took effect on 6 December 2025, that period ended in early March 2026. The BSI’s NIS-2 page now says the statutory deadline has expired and that affected entities should register in the BSI-Portal immediately.

§ 33(1) lists the data: name with legal form and, where relevant, commercial register number; address and current contact details, including email, public IP ranges and telephone numbers; the relevant Annex sector; the EU Member States where you provide those services; and the competent federal and Land supervisory authorities. Changes must be reported without undue delay, and at the latest within two weeks of becoming aware of them (§ 33(5)).

Digital providers that fall under the main establishment rule, such as cloud, data centre and managed service providers, register under § 34. They report public IP ranges for the main establishment and for other EU locations.

Registration takes two steps:

1. Apply for an ELSTER organisation certificate through Mein Unternehmenskonto (MUK), the federal company account. A German tax number is required. The activation letter comes by post and usually takes at least five working days.
2. Register the entity in the BSI-Portal (portal.bsi.bund.de) with that certificate.

For the IP data, the BSI wants the public IP address ranges under your exclusive control, such as ranges assigned by RIPE or a provider and static line addresses. Whether a range is in active use does not matter; dynamic and shared hosting addresses are excluded.

By 30 June 2026, 17,729 companies had registered, including 6,215 besonders wichtige and 11,501 wichtige Einrichtungen. By sector, manufacturing led with 4,095 registrations, ahead of health (3,354), digital infrastructure (2,373) and energy (2,365). A company can register in more than one sector.

What must you report under § 32 BSIG, and when?

A significant incident (erheblicher Sicherheitsvorfall, § 2 no. 11 BSIG) has caused or can cause severe operational disruption of services or financial loss for the entity. It also counts if it has affected or can affect others through considerable material or non-material damage. Under § 32(1), reports go to a joint reporting office set up by the BSI and the BBK.

Stage	Deadline	Content
Early first report (frühe Erstmeldung)	Without undue delay, at the latest within 24 hours of becoming aware	Early warning: suspected unlawful or malicious cause, possible cross-border impact
Incident notification	Without undue delay, at the latest within 72 hours of becoming aware	Update with an initial assessment of severity and impact, and indicators of compromise where available
Intermediate report	At the BSI’s request	Relevant status updates
Final report (Abschlussmeldung)	No later than one month after the notification	Full description, severity, cause, measures, cross-border impact

If the incident is still ongoing after a month, a progress report is due instead, and the final report follows once it is handled. The BSI’s own rule of thumb is “Schnelligkeit vor Vollständigkeit”: speed before completeness. Report early, even with incomplete information.

Registered entities report through the BSI-Portal. An entity that suffers a significant incident before registering uses the online form in the BSI’s Melde- und Informationsportal (MIP). KRITIS operators and federal authorities use their previous reporting channels for now. By 30 June 2026 the BSI had received 692 early first reports and 1,659 NIS2 reports in total through the portal.

The practical side of running these clocks is in the NIS2 incident reporting timeline.

What does § 30 BSIG require?

§ 30(1) requires besonders wichtige and wichtige Einrichtungen to take suitable, proportionate and effective (“geeignete, verhältnismäßige und wirksame”) technical and organisational measures, and to document their compliance. Under § 30(2) the measures should meet the state of the art, take relevant European and international standards into account, and must follow an all-hazards approach. It lists ten minimum measures that follow Article 21(2) of the Directive:

§ 30(2)	Measure	NIS2 Art. 21(2)
No. 1	Risk analysis and IT security concepts	(a)
No. 2	Handling security incidents	(b)
No. 3	Business continuity, backup, disaster recovery, crisis management	(c)
No. 4	Supply chain security	(d)
No. 5	Security in acquisition, development and maintenance	(e)
No. 6	Assessing the effectiveness of the measures	(f)
No. 7	Basic training and awareness	(g)
No. 8	Cryptography	(h)
No. 9	Personnel security, access control, management of ICT systems, products and processes	(i)
No. 10	Multi-factor or continuous authentication, secured communications, secured emergency communications where appropriate	(j)

Three German points:

• Documentation is part of the duty. § 30(1) requires entities to document their compliance, not only to take the measures. Failing to document is itself a fineable offence (§ 65(2) no. 3).
• State of the art is not defined. The BSIG refers to the “Stand der Technik” in §§ 3, 30, 31 and 44 without defining it. The BSI points to the federal drafting handbook’s definition and publishes guidance.
• ISO 27001 is not proof. The BSI states that ISO/IEC 27001 certification does not automatically mean an entity meets all § 30 requirements, and cannot be treated as proof of NIS2 conformity. It calls it a good foundation.

For cloud, data centre, content delivery network, managed service and managed security service providers, DNS and TLD providers, online marketplaces, search engines, social networks and trust service providers, Implementing Regulation (EU) 2024/2690 sets the detailed technical requirements and takes precedence (§ 30(3)). Suppliers outside the scope feel § 30 too: the BSI notes that regulated customers must secure their supply chain under § 30(2) no. 4 and will pass requirements on.

Each measure is explained in the 10 measures of NIS2 Article 21.

What extra rules apply to KRITIS operators?

Operators of kritische Anlagen are a subset of the besonders wichtige Einrichtungen, and carry more:

• § 31(1): for the IT systems their critical facilities depend on, more demanding protection measures count as proportionate, unless the effort is out of proportion to the consequences of a failure.
• § 31(2): they must use systems for attack detection (Systeme zur Angriffserkennung) on the IT systems, components and processes that are decisive for the facility. These must continuously and automatically collect and evaluate suitable parameters from ongoing operations, a duty carried over from the old law.
• § 39: they must prove to the BSI that the §§ 30 and 31 measures are in place, through security audits, tests or certifications, every three years, and submit the results including any deficiencies found. The BSI sets the first date, at the earliest three years after an operator first qualifies. The cycle was two years under the old law.
• Registration and reporting: they register as besonders wichtige Einrichtungen in the BSI-Portal. Under § 33(2), the critical facilities themselves are registered under § 8 of the KRITIS-Dachgesetz (the KRITIS umbrella act). The BSI’s KRITIS page, checked on 24 September 2026, still directs facility registration and KRITIS incident reports to the MIP and expects it to stay available for this until 31 December 2026. Their reports must also state the type of facility, the critical service and the impact on it (§ 32(3)).
• Energy: because of § 28(5), the BSI says responsibility for digital energy service facilities has moved from the BSI to the Bundesnetzagentur. Operators that only had to send attack-detection evidence to the BSI no longer send it there.

Of the 6,215 besonders wichtige Einrichtungen registered by 30 June 2026, 1,342 were KRITIS operators.

What does § 38 require from the Geschäftsleitung?

The Geschäftsleitung (management body) is the natural persons who, by law, articles or partnership agreement, manage and represent the entity. In a GmbH that is the Geschäftsführung; in an AG, the Vorstand. § 38 gives them three things:

1. Implement and oversee. They must implement the § 30 measures and oversee their implementation (§ 38(1)). The Directive says “approve”; the BSIG says “umsetzen”, implement.
2. Liability. Members who breach these duties are liable to the entity for culpably caused damage under the company-law rules for its legal form (§ 38(2)). The BSIG itself only imposes liability where those company-law rules contain no such provision.
3. Training. They must take part in training regularly, to be able to identify and assess risks and risk-management practices in IT security and their impact on the entity’s services (§ 38(3)). The BSI published guidance (Handreichung) on management training in April 2026.

In practice, the board can delegate the work but not the responsibility. The evidence an authority looks for is a record of what the Geschäftsleitung saw, decided and followed up, and proof of training. More on that in board accountability under NIS2.

How does the BSI supervise, and what are the fines?

The BSI is the supervisory authority for the BSIG. § 61 sets its supervisory and enforcement measures for besonders wichtige Einrichtungen, and § 62 for wichtige Einrichtungen, following the split in Articles 32 and 33 of the Directive. Under § 61(3) the BSI can demand evidence that the § 30 measures are in place.

For failures to take or document the § 30 measures, and to make the § 32 reports including the final report, § 65 sets these maximum fines:

Class	Maximum fine
besonders wichtige Einrichtungen	€10 million; 2% of worldwide turnover if the undertaking’s turnover exceeds €500 million (§ 65(6))
wichtige Einrichtungen	€7 million; 1.4% of worldwide turnover if the undertaking’s turnover exceeds €500 million (§ 65(7))

These match the minimum ceilings Article 34 of the Directive requires: the percentage only exceeds the fixed amount above €500 million of turnover. Turnover is that of the whole undertaking the entity belongs to, in the financial year before the decision (§ 65(8)). The usual halving of the maximum for negligence under § 17(2) of the Administrative Offences Act (OWiG) does not apply to these fines (§ 65(9)). KRITIS operators are besonders wichtige Einrichtungen and fall under the higher tier.

Other breaches have lower maximums: up to €500,000 for failing to register or to provide the registration data, and up to €1 million for failing to provide the § 39 KRITIS evidence. Where a GDPR supervisory authority has already fined the same conduct under Article 58(2)(i) GDPR, no second fine follows under the BSIG (§ 65(11)). How the EU framework works is in NIS2 administrative fines.

What does the BSIG leave open in practice?

The BSIG says what must exist, not what good enough looks like. § 30 requires measures that are “wirksam”, effective, and documented, against a state of the art the law does not define. A certificate does not settle it, as the BSI has said of ISO/IEC 27001. And under § 61(3) the BSI can ask a besonders wichtige Einrichtung for evidence.

So the question is not “do we have a policy for measure no. 10?” but “can we show today that MFA is on for every administrative account?”. The same goes for patching times, restore tests, the supplier register and the record of what the Geschäftsleitung reviewed. The 24-hour clock in § 32 raises the same issue: you can only report an incident you have detected.

That evidence lives in the identity provider, the endpoint tools, the cloud accounts and the ticketing system. Collected by hand before an audit, it is out of date on arrival. Collected continuously from those systems, mapped to the § 30(2) numbers, with a person reviewing the exceptions, it answers the question the BSI asks. That is how the CloudSoul platform works, and the wider programme is on the NIS2 compliance page.

A sensible first artefact is the scope decision itself. The BSI will not make it for you, and it is the first thing to check if the BSI questions your registration.

BSIG SCOPE DECISION RECORD (§ 28)

Entity and legal form:
Established in Germany or representative named:   yes / no

Annex 1 / Annex 2 entity types that may apply:
  - type | sector | description of the activity

Negligible activities excluded (§ 28(3)):
  - activity | staff | turnover | balance sheet share
  - named in articles of association?             yes / no

Size (Recommendation 2003/361/EC, annual work units):
  - own figures: staff | turnover | balance sheet
  - linked and partner enterprises added?         yes / no
  - § 28(4) IT independence relied on?            yes / no
    evidence:

Operator of a kritische Anlage (BSI-KritisV)?     yes / no
DORA financial entity (§ 28(6))?                  yes / no
Telecoms or energy under § 28(5)?                 yes / no

Result: besonders wichtig / wichtig / not in scope
Registered in BSI-Portal on:          reference:
Approved by Geschäftsleitung on:      next review:

NIS2 Germany checklist

• Record your § 28 scope decision, including group figures and any negligible activities.
• If you are in scope and not registered, register in the BSI-Portal now: the deadline has passed. Report changes within two weeks.
• Request the ELSTER organisation certificate early; the activation letter takes at least five working days.
• Test that you can send an early first report within 24 hours of becoming aware of an incident.
• Map your controls to the ten measures in § 30(2) and document them.
• Record the Geschäftsleitung’s oversight of the measures and schedule its § 38 training.
• KRITIS operators: plan the next § 39 evidence under the three-year cycle.
• Keep evidence ready for a BSI request under § 61(3).

Sources

• Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung of 2 December 2025, BGBl. 2025 I Nr. 301, published 5 December 2025, recht.bund.de.
• BSI-Gesetz (BSIG) of 2 December 2025, consolidated text as last amended by the Act of 23 July 2026, gesetze-im-internet.de: § 28, § 30, § 31, § 32, § 33, § 37, § 38, § 39, § 65.
• BMI, legislative procedure for the NIS2UmsuCG, bmi.bund.de.
• BSI, NIS-2-regulierte Unternehmen, bsi.bund.de.
• BSI, general NIS-2 FAQ, bsi.bund.de, and sector FAQ, bsi.bund.de.
• BSI, Registrierungspflicht, bsi.bund.de, and Mein Unternehmenskonto, bsi.bund.de.
• BSI, NIS-2-Meldepflicht, bsi.bund.de.
• BSI, NIS-2 in Zahlen (figures to 30 June 2026), bsi.bund.de.
• BSI, Risikomanagementmaßnahmen, bsi.bund.de, and ISO/IEC 27001 im Kontext NIS-2/BSIG, bsi.bund.de.
• BSI, Kritische Infrastrukturen, bsi.bund.de.
• BSI, Geschäftsleitungsschulungen gemäß BSIG (NIS-2), 17 April 2026, bsi.bund.de.
• BSI, Mindeststandards des Bundes, bsi.bund.de.
• Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 5, 20, 21, 23, 27, 32, 33, 34 and 35, EUR-Lex.
• Commission Recommendation 2003/361/EC on the definition of micro, small and medium-sized enterprises, EUR-Lex.
• Commission Implementing Regulation (EU) 2024/2690, EUR-Lex.

Frequently asked questions