Does your company fall under NIS2?

Since 6 December 2025, the German NIS2 Implementation Act (NIS2UmsuCG) has been in force in Germany. It revised the German BSI Act (BSIG) and considerably widened the range of companies covered. Previously, the focus was essentially on operators of critical infrastructure. Today, many mid-sized manufacturers, logistics companies, food businesses and IT service providers are also covered. This check is based on the German rules; other EU member states have implemented NIS2 in their own laws.

First question: what do you do?

The law lists the activities covered in two annexes. Annex 1 covers sectors of high criticality: energy, transport, banking and financial market infrastructure, health, water and waste water, digital infrastructure, IT service providers offering managed services, and space. Annex 2 names further sectors: postal and courier services, waste, chemicals, food, parts of manufacturing from mechanical engineering to vehicle manufacturing, digital services such as online marketplaces, and research. Activities that carry little weight in relation to your overall business can be disregarded for the classification.

Second question: how large are you?

As a rule, only medium-sized and large companies are covered. An entity is an important entity if it is active in a sector of Annex 1 or 2 and has at least 50 employees, or both more than €10 million annual turnover and more than €10 million balance sheet total. An entity in Annex 1 becomes an essential entity from 250 employees, or with more than €50 million turnover and at the same time more than €43 million balance sheet total. The count follows the EU recommendation on small and medium-sized enterprises, i.e. including partner and linked enterprises. The BSIG disregards these figures if your IT is independent of them.

Third question: is there a special case?

Some entities are covered regardless of their size. Operators of critical facilities, qualified trust service providers, top-level domain registries and DNS providers are always essential entities. Non-qualified trust service providers are always important entities. For telecommunications providers, the threshold for an essential entity is already 50 employees, or more than €10 million turnover and balance sheet total. Separate rules apply to the federal administration. State and local government administrations are regulated by the German states (Länder).

What follows

Companies affected must register with the Federal Office for Information Security (BSI) within three months. They implement appropriate risk management measures in the ten areas of section 30 and document them. They report significant security incidents under section 32 in three stages: an early warning within 24 hours, a notification with an initial assessment within 72 hours and a final report after one month. Management must implement the measures, monitor their implementation and take part in training regularly (section 38). Breaches can be expensive: up to €10 million for essential entities and up to €7 million for important entities, and for large companies also a share of worldwide turnover.

And if you are not affected?

Then the BSIG does not apply to you directly. Your customers may still be affected. They have to take the security of their supply chain into account and therefore ask their suppliers and service providers. If you can present your measures in an orderly way, you save time and build trust.

You can read more about the individual obligations on the page Implementing NIS2. A working list to tick off is available in the NIS2 checklist.