NIS2 Enforcement in Germany: BSI Supervision, Audits and Evidence

It's a Tuesday morning. Your assistant places a letter from the Federal Office for Information Security on your desk. Sender: BSI. Subject: Request for registration according to § 33 BSIG-new — deadline 14 days. Your company employs 120 people, generates 25 million euros in revenue, provides IT services to hospitals. You are NIS2-obligated. And you missed the registration deadline on March 6, 2026.

⚠️ Important: The BSI registration obligation is in effect. Companies that have not yet registered risk a fine of up to €500,000 (Section 65 BSIG). The fine is imposed on the entity, not on managers personally.

This letter is not a hypothetical scenario. Since December 6, 2025, the BSI has supervisory powers under Sections 61 and 62 BSIG: it can order evidence from and audit particularly important entities, while important entities are supervised only when there are indications of non-compliance. Those who have not acted yet risk a fine against the entity, up to €500,000 for missing registration. This article explains what happens now — and what you must do immediately.

What Has Happened So Far: The NIS2 Law is in Effect

Since December 6, 2025, the NIS2 Implementation Act (NIS2UmsuCG) has been in effect in Germany. It affects approximately 29,500 companies in 18 critical sectors — from energy to healthcare to digital infrastructure, logistics, and waste management. In these sectors, companies with at least 50 employees, or with annual turnover and balance sheet total each above €10 million, are covered; each company must assess this itself.

The first obligation: Registration with the BSI via the BSI portal using 'Mein Unternehmenskonto' (MUK) and an ELSTER organisation certificate. The deadline for this was three months after entry into force — March 6, 2026. The deadline has passed; companies that have not yet registered must do so immediately.

BSI Switches to Enforcement Mode

Until now, the BSI was in the orientation and registration phase: online impact assessment, workshops, FAQ pages. Under the NIS2 Implementation Act, the BSI has supervisory powers that differ by entity category: The authority has extensive powers for this:

Binding orders: The BSI can require companies to implement or demonstrate specific security measures.

Audits and inspections: For particularly important entities, the BSI can order evidence and carry out audits under Section 61 BSIG; regular evidence obligations only start three years after entry into force. Important entities are supervised under Section 62 BSIG only on specific grounds.

Public announcements: In case of serious violations, the BSI can make these public — a significant reputational risk.

Fines: For particularly important entities up to €10 million or 2% of global annual turnover, for important entities up to €7 million or 1.4%; up to €500,000 for missing registration.

Personal Liability of Management

NIS2 contains an innovation that many companies are not yet aware of: Managing directors can be held personally liable for NIS2 violations. § 38 BSIG-new provides that management must approve and monitor the implementation of security measures. Managers who culpably breach these duties are liable to their own entity under Section 38 BSIG. For particularly important entities, as a last resort after BSI orders are ignored, managers can be temporarily prohibited from exercising management functions.

What Specifically Happens If You Are Not Yet Registered?

The BSI has not published in detail how it identifies unregistered companies; registers and information from other authorities are possible sources. Anyone operating in a regulated sector and exceeding the size thresholds will sooner or later be identified — through industry and commercial registers, reports from business partners, or BSI's own surveys. Experience from other EU countries shows: Authorities start with high-profile sectors (energy, healthcare, digital infrastructure) and gradually expand audits.

The typical process after a BSI finding: First comes an informal request for registration with a short deadline. If the company does not respond, a formal notice follows. After that, administrative offense proceedings can be initiated. In the worst case, it ends with a fine and public announcement.

Immediate Measures: What You Must Do in the Next 14 Days

If you missed the registration deadline, every day counts now. Here are the prioritized measures:

✅ Step 1: Finally clarify applicability

Use the official BSI decision tree at betroffenheitspruefung-nis-2.bsi.de. Check sector, employee count, and revenue. If in doubt, get legal confirmation — your self-assessment is not binding on the BSI.

✅ Step 2: Apply for ELSTER organization certificate

Without an ELSTER organization certificate, no BSI registration. Application via elster.de, processing time about 3 to 14 days, because activation data is sent by post. Start immediately.

✅ Step 3: Registration in the BSI portal

Once the certificate is available: Registration in the BSI portal (portal.bsi.bund.de) via Mein Unternehmenskonto. Information on company structure, sector, facility type (important vs. particularly important), and contact details for security incidents.

✅ Step 4: Inventory security measures

Section 30(2) BSIG lists ten minimum areas: risk analysis and security policies, incident handling, business continuity with backup and crisis management, supply chain security, security in acquisition, development and maintenance including vulnerability handling, assessing effectiveness, cyber hygiene and training, cryptography, HR security with access control and asset management, and multi-factor authentication and secured communications. Document the current status.

✅ Step 5: Establish reporting process for security incidents

Section 32 BSIG requires, from the time of awareness of a significant incident, an early warning within 24 hours, an incident notification within 72 hours and a final report one month after the 72-hour notification. Those without a process are doubly exposed: once for the missed registration, once for an unreported incident.

Further ADVISORI Articles on NIS2

Detailed information on fines and liability can be found in our article NIS2 Deadline Missed: Fines & Liability 2026. A step-by-step guide to BSI registration is provided by NIS2 Registration with BSI: The Complete Guide.

Frequently Asked Questions About NIS2 Enforcement

What happens if I missed the registration deadline?

Complete the registration immediately. As long as the BSI has not yet issued a notice, voluntary late registration is the best way to minimize fine risk. Fines are set based on the circumstances of the individual case; voluntary late registration before a formal notice counts in the entity's favour.

How does the BSI find out that my company is NIS2-obligated?

The BSI uses various sources: Commercial and company registers, industry associations, self-disclosures, and reports from the business community. Additionally, the BSI works with sector regulators — in the energy and healthcare sectors, for example, with the Federal Network Agency and BfArM.

Am I as a GmbH managing director really personally liable?

Yes, under certain conditions. § 38 BSIG-new obligates company management to approve and monitor cybersecurity measures. In case of demonstrable negligence, managers are liable to their own entity under Section 38 BSIG; fines under Section 65 BSIG are imposed on the entity. For particularly important entities, a temporary prohibition from management functions is possible as a last resort.

Does NIS2 also apply to subsidiaries of international corporations?

Yes. Every entity active in Germany that meets the size thresholds and sector criteria is NIS2-obligated — regardless of whether the parent company is based abroad. Registration and compliance obligations apply to the German legal entity.

ADVISORI Supports You with NIS2 Compliance

The NIS2 clock is ticking. ADVISORI accompanies companies from the impact assessment through BSI registration to complete compliance implementation. Our NIS2 consultants support companies from the scope assessment and registration through to implementing the measures under Section 30 BSIG.

Contact us now — before the BSI does it for you.