NIS2 Implementation Act Germany (NIS2UmsuCG): Duties and Deadlines

The NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) has been in force since 6 December 2025. As a result, the cybersecurity requirements of the European NIS 2 Directive are binding in Germany, and they apply to a much larger group of companies than before. Organisations that fail to implement risk management face fines of up to EUR 10 million or 2 % of worldwide turnover, and a missed registration can cost up to EUR 500,000. The fines are imposed on the entity; management is liable to the entity for culpable breaches of duty (Section 38(2) BSIG).

This article summarises what the act actually says. All statements have been checked against the official text in the Federal Law Gazette (Bundesgesetzblatt), not against third-party summaries.

What the NIS2 Implementation Act is

The full official title is "Act implementing the NIS 2 Directive and regulating essential principles of information security management in the federal administration" (Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung). The common abbreviation is NIS2UmsuCG.

The act is dated 2 December 2025 and was promulgated on 5 December 2025 in the Federal Law Gazette Part I, No. 301. The final provision is brief: "This Act shall enter into force on the day following its promulgation." The relevant date is therefore 6 December 2025.

One point is key to understanding it: this is an omnibus act (Artikelgesetz). It does not create a catalogue of obligations of its own but amends existing laws. At its core is the completely revised Act on the Federal Office for Information Security (BSI-Gesetz, BSIG). Where sections are referred to below, they are those of the new BSIG. This is also why searching for a "NIS2 Act" often leads nowhere: the obligations are in the BSIG.

Who the act applies to

The act distinguishes two tiers: particularly important entities (besonders wichtige Einrichtungen) and important entities (wichtige Einrichtungen). Classification follows two criteria that must both be met: belonging to a type of entity listed in Annex 1 or Annex 2, and reaching certain size thresholds.

The size thresholds

For particularly important entities, Section 28(1) provides, among other things: at least 250 employees, or annual turnover of more than EUR 50 million together with an annual balance sheet total of more than EUR 43 million. For providers of publicly available telecommunications services the threshold is lower: 50 employees, or turnover and balance sheet total each exceeding EUR 10 million, are sufficient.

Important entities are covered by Section 28(2). Here, at least 50 employees, or annual turnover and an annual balance sheet total each exceeding EUR 10 million, are sufficient. Entities that already qualify as particularly important entities do not additionally fall under this category; entities of the federal administration are excluded. The difference between the two tiers is not a formality: it determines the intensity of supervision and the range of fines.

For calculating headcount, turnover and balance sheet total, Section 28(4) refers to the European Commission's SME Recommendation (2003/361/EC). Under certain conditions, data from partner and linked enterprises is not added. Companies doing the calculation within a group should examine this exception closely, as it often decides whether they are in scope.

The negligibility rule in Section 28(3)

One provision is regularly underestimated in practice. Section 28(3) reads: "When assigning an entity to one of the types of entity listed in Annexes 1 and 2, business activities that are negligible in relation to the entity's overall business activities may be disregarded."

This sounds like relief, but above all it is a judgement risk. The act does not define what negligible means. If you consider an ancillary activity insignificant and therefore do not register, the burden of justification is on you if the supervisory authority sees it differently. The assessment needs to be documented, not merely thought through.

Registration obligation: the first deadline that counts

Under Section 33(1), particularly important entities, important entities and domain name registry service providers must register with the Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI) no later than three months after they first qualify, or qualify again, as such. The information submitted includes the name and legal form, address and contact details, public IP address ranges, the relevant sector under Annex 1 or 2, and the EU Member States in which services are provided.

This gives rise to the much-cited deadline: companies that already fell under the act when it entered into force on 6 December 2025 had to register by 6 March 2026. For companies that only exceed the thresholds later, the three-month period runs from that point. The deadline is therefore not a one-off date but an ongoing obligation.

If the registered information changes, it must be updated without undue delay under Section 33(5), and no later than two weeks after becoming aware of the change. Information on critical components must be submitted once a year. For certain types of entity, Section 34 contains a special registration obligation with its own three-month deadline.

Section 33(3) is significant in practice: the BSI can carry out the registration itself if a company fails to meet its obligation. Doing nothing therefore does not mean staying undetected.

How registration in the BSI portal works step by step, what information needs to be prepared and which certificate is required is described in our guide to NIS2 registration with the BSI.

Risk management under Section 30

Section 30 obliges particularly important and important entities to take appropriate, proportionate and effective technical and organisational measures. The standard is risk-based: it depends on the degree of risk exposure, the size of the entity, the likelihood and severity of potential incidents, and their societal and economic impact.

Organisations that already operate a management system based on ISO/IEC 27001 or BSI IT-Grundschutz have a large part of the foundation in place. It is not a complete match, however, particularly with regard to reporting processes and providing evidence to the BSI.

Critical facilities: the additional tier

For operators of critical facilities (kritische Anlagen), Section 30 is not the end of it. Section 31 sets special requirements for their risk management measures, and Section 39 establishes separate evidence obligations. Evidence is the decisive difference: while Section 30 requires an appropriate level of protection, here the point is to demonstrate this level to the BSI in a suitable form.

In practice, this means that KRITIS operators (critical infrastructure operators) have to serve two regulatory levels at once. Anyone coming from the previous KRITIS regime should not assume that existing evidence remains valid unchanged. The BSI Act has been completely revised as part of the implementation act, including the system of annexes and thresholds.

Reporting obligations under Section 32: the 24-72 rule and the month after

In the event of a significant security incident, a staged reporting chain to the joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK) applies:

Early warning: without undue delay, and no later than 24 hours after becoming aware of the incident. It must state whether unlawful or malicious acts are suspected and whether cross-border effects are possible.

Incident notification: without undue delay, and no later than 72 hours. It confirms or updates the early warning and contains an initial assessment covering severity, impact and, where applicable, indicators of compromise.

Intermediate report: at the request of the BSI, with relevant status updates.

Final report: no later than one month after the 72-hour notification, with a detailed description of the incident, information on the type of threat and the underlying root cause.

The 24 hours are the real organisational test. They run from the moment of awareness, not from the end of the working day and not from Monday morning. Without a practised reporting process with clear on-call arrangements, you will miss this deadline when it matters.

Management obligations under Section 38

The section with the strongest business relevance is Section 38, headed "Implementation, monitoring and training obligation for management bodies". Management must implement the risk management measures and monitor their implementation. Cybersecurity is thus explicitly a management responsibility and not an IT matter that can be delegated.

In addition, there is a training obligation: management must undergo regular training itself in order to be able to assess risks and evaluate management practices. Operational implementation may be delegated, responsibility for it may not.

Fines

The range of fines is tiered. For particularly important entities it extends to EUR 10 million, for important entities to EUR 7 million. For individual offences, Section 65 provides lower ranges, for example up to EUR 500,000 for failure to register.

For companies with total turnover of more than EUR 500 million, the act contains a different, turnover-based rule. For large groups, the absolute maximum amount is therefore not the upper limit.

How supervision actually works in 2026, which audits the BSI schedules and what specifically is at stake when deadlines are missed is covered in our article on NIS2 enforcement by the BSI.

What companies should do now

First, check whether you are in scope and document the result, including the justification if activities are classified as negligible under Section 28(3).

Second, complete registration with the BSI or verify that it has been completed, and set up a process that reports changes within two weeks.

Third, set up and practise the incident reporting process, with clear responsibility for the 24-hour early warning.

Fourth, compare the measures under Section 30 against your current state and prioritise the gaps. Existing management systems are the basis, not the goal.

Fifth, involve management and document the training under Section 38 in a verifiable way.

Mid-sized companies without their own security department will find a process tailored to their circumstances in our practical guide for mid-sized companies.

If you want to clarify your scope and implementation status in a structured way, our NIS2 scope assessment supports you from classification and registration through to a security concept that stands up to scrutiny.

Frequently asked questions

Since when has the NIS2 Implementation Act applied?

Since 6 December 2025. The act of 2 December 2025 was promulgated in the Federal Law Gazette on 5 December 2025 and, under its final provision, entered into force on the day following promulgation.

What is the correct name of the act?

"Act implementing the NIS 2 Directive and regulating essential principles of information security management in the federal administration" (Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung), abbreviated NIS2UmsuCG. The substantive obligations are set out in the revised BSI Act.

By when did registration have to be completed?

Under Section 33(1), within three months after an entity first falls, or falls again, under the act. For companies already in scope when the act entered into force, that was 6 March 2026. Companies that exceed the thresholds later have three months from that point.

What reporting deadlines apply to a security incident?

Early warning within 24 hours, incident notification within 72 hours, an intermediate report at the request of the BSI, and a final report no later than one month after the 72-hour notification (Section 32(1)).

How high are the fines?

Up to EUR 10 million for particularly important entities and up to EUR 7 million for important entities, plus lower ranges for individual offences, for example up to EUR 500,000 for failure to register. For total turnover of more than EUR 500 million, a different, turnover-based rule applies.

Are managing directors personally liable?

Section 38 obliges management to implement the risk management measures, to monitor their implementation and to undergo regular training. Operational implementation can be delegated, management responsibility cannot. If management culpably breaches these duties, it is liable to the entity for the damage under the rules of company law (Section 38(2)). Fines are directed at the entity, not at the individual.

Is ISO 27001 enough to comply with the act?

A management system based on ISO/IEC 27001 or BSI IT-Grundschutz covers a large part of the requirements of Section 30 but is not a complete match. In particular, the statutory reporting process and providing evidence to the BSI need to be added.