Who is in scope?
The NIS-2 Implementation Act (NIS2UmsuCG) completely revised the German BSI Act (BSIG). It covers companies in 18 sectors – including energy, transport, health, digital infrastructure, managed ICT services, manufacturing of certain products, food, chemicals and digital providers – generally from 50 employees or more than EUR 10 million turnover and balance sheet total. It distinguishes between “particularly important” and “important” entities. International groups must check each German entity, taking group structures into account.
Key obligations
- Registration with the Federal Office for Information Security (BSI) within three months of falling into scope; late registration is an administrative offence.
- Risk management measures, including incident handling, business continuity, supply chain security, access control, encryption and training.
- Incident reporting: early warning within 24 hours, notification within 72 hours, final report after one month.
- Management duties: approval and supervision of measures, regular training, liability for breaches.
Fines can reach EUR 10 million or 2 % of worldwide turnover for particularly important entities and EUR 7 million or 1.4 % for important entities. Manufacturers of products with digital elements must also comply with the EU Cyber Resilience Act, whose reporting obligations apply from 11 September 2026.
Case studies: Cybersecurity & NIS-2
Scope assessment for an international group
Managed service provider and customer demands
Incident with reporting obligation
The examples are typical, anonymised and simplified scenarios from our practice. Every case is different – the outcome depends on the individual circumstances.
Our services: Cybersecurity & NIS-2
- NIS-2 scope assessment
- BSI registration
- Implementation of risk management with your IT
- Incident reporting and response
- Supplier and service provider contracts
- Management training and liability advice
How we work with you
FAQ: Cybersecurity & NIS-2
How do I know whether my company is covered by NIS-2 in Germany?
The decisive factors are the sector of activity under the annexes to the BSI Act and company size – generally from 50 employees or more than EUR 10 million turnover and balance sheet total. Group structures must be taken into account.
What if we missed the registration?
Late registration is still possible and should be made immediately. Failure to register is a separate administrative offence.
Is management personally liable?
Yes. Management of covered entities must approve and supervise the measures; culpable breaches can lead to liability towards the company.
Send us your enquiry
All fields are optional. Only provide what you wish.