NIS2 Is in Force in Germany: What Non-EU Tech Companies Must Do

§ IWhy is NIS2 fundamentally different from NIS1?

NIS2 (Directive (EU) 2022/2555) replaces the 2016 NIS Directive and widens the regime in three directions: 18 sectors instead of 7, a binding ten-point catalogue of risk-management measures in Article 21, and, for essential entities that breach Articles 21 or 23, fines of up to €10 million or 2 % of worldwide turnover (Article 34).

The NIS2 Directive (Directive (EU) 2022/2555, "NIS2") replaces the first-generation NIS Directive of 2016 and expands the Union's cybersecurity regime across three structural dimensions: the range of sectors in scope, the specificity of risk-management obligations, and the severity of enforcement consequences. In contrast to NIS1, which primarily addressed traditional critical-infrastructure operators and a small number of digital service providers, NIS2 covers a wide range of entities across 18 sectors — including cloud computing services, data centres, content-delivery networks, digital marketplaces, online search engines, social networking platforms, managed service providers, and managed security service providers.

Germany's national implementation is carried out through the NIS2 Implementation and Cybersecurity Strengthening Act ("NIS2UmsuCG"), which recast the BSI-Gesetz and amended adjacent statutes. The transposition deadline under Union law was 17 October 2024; the German act of 2 December 2025 (BGBl. 2025 I No. 301) entered into force on 6 December 2025 under Article 30 of that act. References below are to the BSIG as recast.

§ IIWhich companies are in scope — and which size thresholds apply?

NIS2 covers essential entities (Annex I) and important entities (Annex II). The threshold is the medium-sized enterprise: from 50 staff, or turnover and balance-sheet total each above €10 million (Article 2(1)). Public electronic communications, trust services, TLD registries, DNS providers (Article 2(2)(a)), domain name registration services (Article 2(4)) and critical entities (Article 2(3)) are in scope regardless of size.

NIS2 distinguishes two categories of regulated entities, both of which trigger substantive obligations: essential entities (Annex I sectors, including energy, transport, banking, health, drinking water, digital infrastructure, and ICT service management) and important entities (Annex II sectors, including digital providers, postal services, manufacturing of certain critical products, and research). The division is not primarily a function of sector alone, but of the combination of sector and company size. The size line follows Article 2 of the Annex to Recommendation 2003/361/EC: it is reached from 50 staff, or where annual turnover and balance-sheet total each exceed €10 million — the German transposition says so in those words (§ 28(2) No. 3 BSIG).

Four groups are in scope regardless of size: providers of public electronic communications networks or of publicly available electronic communications services, trust service providers, and top-level domain name registries and DNS service providers (Article 2(2)(a) NIS2); entities providing domain name registration services, that is registrars (Article 2(4) NIS2); entities identified as critical entities under Directive (EU) 2022/2557 (Article 2(3) NIS2); and entities caught by one of the further size-independent cases of Article 2(2)(b) to (f) NIS2 — sole provider in a Member State of an essential service, significant impact on public safety, security or health, significant systemic risk, criticality at national or regional level, and public administration entities. For technology companies offering services into Germany, the assessment turns on (i) the sector classification, (ii) whether the size thresholds are met, and (iii) whether any size-independent scoping criterion applies. Since the assessment is layered and fact-specific, the BSI has published a formal affected-party assessment tool that structures the analysis; the BSI states that its result is not legally binding and does not replace the self-identification required by §§ 33, 34 BSIG.

§ IIIWhich obligations does NIS2 impose on entities in scope?

Article 21 NIS2 requires regulated entities to implement appropriate and proportionate technical, operational, and organisational cybersecurity risk-management measures. This is not a generic "state-of-the-art" clause: the provision specifies a minimum catalogue of ten measure categories that every essential and important entity must implement.

Article 23 NIS2 imposes a multi-stage incident-reporting regime. A significant incident must be reported to the national computer security incident response team (CSIRT) — in Germany, the BSI — in three stages: (i) an early warning within 24 hours of becoming aware of the incident; (ii) an incident notification within 72 hours, including an initial assessment and, where applicable, indicators of compromise; and (iii) a final report within one month, containing a detailed description and the mitigation measures taken. The timelines are short and do not await completion of internal forensic analysis.

§ IVHow is NIS2 enforced — and who is personally liable?

The national authorities — in Germany the BSI — may inspect, audit and issue binding orders (Articles 32, 33 NIS2). For breaches of Articles 21 and 23, Article 34 NIS2 sets fines up to €10 million or 2 % of turnover for essential and €7 million or 1.4 % for important entities; management bodies are liable under Article 20.

The enforcement regime under NIS2 is materially stricter than under NIS1. Article 32 NIS2 grants the competent authorities — in Germany, the BSI — extensive supervisory powers over essential entities, including on-site inspections, targeted audits, ad-hoc audits, requests for information, and the power to issue binding orders to bring an entity into compliance; for important entities Article 33 NIS2 provides the same toolbox, but only ex post, on evidence of a breach. Article 34 NIS2 establishes the administrative-fine framework for breaches of the risk-management duties in Article 21 and the reporting duties in Article 23: up to €10 million or 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher, for essential entities; up to €7 million or 1.4% of worldwide annual turnover for important entities.

Article 20 NIS2 introduces a point that is sometimes overlooked but deserves particular attention: management-body liability. The management bodies of essential and important entities are required to approve the cybersecurity risk-management measures, to oversee their implementation, and can be held liable for breaches by the entity of its obligations under Article 21. The provision explicitly requires members of management bodies to undergo training to acquire sufficient knowledge to identify risks and evaluate cybersecurity practices. In German corporate-liability terms, this construction brings NIS2 obligations squarely into the domain of §§ 93 AktG / 43 GmbHG directors' duties.

§ VWhat does the German BSIG require of providers without an EU establishment?

Since 6 December 2025 the recast BSIG applies. For providers established outside the Union it contains two operative rules that are easy to miss: the duty to designate a representative (§ 60(3) BSIG, in the supervision part of the act) and the three-month registration duty (§§ 33, 34 BSIG, in the duties part).

The representative (§ 60(3) BSIG). An entity of one of the types listed in § 60(1) sentence 1 BSIG — DNS service providers, TLD name registries, domain-name registration service providers, cloud computing service providers, data centre service providers, content delivery network operators, managed service providers, managed security service providers, and providers of online marketplaces, online search engines and social networking platforms — that has no establishment in the Union but offers services within it must designate a representative. The representative must be established in a Member State in which the entity offers its services (§ 60(3) sentence 2 BSIG), which mirrors Article 26(3) NIS2.

Why the seat of the representative matters. Under § 60(3) sentence 3 BSIG, if the representative is established in the Federal Republic of Germany, the BSI becomes the competent authority for that entity. The channelling effect itself follows from Article 26(3) sentence 3 NIS2: such an entity "shall be considered to fall under the jurisdiction of the Member State where the representative is established". Choosing Germany therefore converts a potentially fragmented supervisory picture into a single point of contact. The converse is equally concrete: where no representative has been designated anywhere in the Union, § 60(3) sentence 4 BSIG allows the BSI to declare itself competent for the entity on its own motion.

Registration (§§ 33, 34 BSIG). Entities must transmit their registration data to the BSI within three months of first qualifying as an entity of the relevant type (§ 33(1) BSIG). For exactly the entity types that carry the representative duty, § 34(1) BSIG adds a special registration obligation on the same three-month clock; its No. 3 requires the address of the representative designated under § 60(3) where the entity is not established in the Union, and No. 4 its contact details. Changes must be notified without undue delay, at the latest within three months (§ 34(2) BSIG); the BSI forwards the data — except the public IP ranges — to ENISA (§ 34(3) in conjunction with § 34(1) No. 6 BSIG). For entities already covered when the act entered into force, the three-month period ran until 6 March 2026.

What is actually sanctioned. There is no separate fine for failing to designate a representative under § 60(3) BSIG; the consequence is the BSI's self-declaration of competence. What is sanctioned is the missing or incorrect registration: § 65(2) No. 6 in conjunction with § 65(5) No. 5 BSIG provides for an administrative fine of up to €500,000, or up to €250,000 in the case of negligence (§ 17(2) of the German Administrative Offences Act, OWiG). The higher ceilings of €10 million / 2% and €7 million / 1.4% that Article 34 NIS2 prescribes — and that § 65(5) No. 1 and, above a total turnover of €500 million, § 65(6) and (7) BSIG transpose — attach to other conduct, in particular breaches of the risk-management and reporting duties under Articles 21 and 23 NIS2, not to the designation of a representative.

§ VIHow do you check quickly whether NIS2 applies to you?

Given the structural complexity of the scoping analysis — multiple Annexes, size thresholds, size-independent criteria, and sector-specific carve-outs — the single most efficient first step for any technology company operating in or into Germany is a structured affected-party assessment. The BSI’s official assessment tool structures that analysis and produces an initial scoping result.

The tool generates an initial scoping result, but it does not substitute for legal qualification where edge cases arise — for example, where an entity operates across multiple sectors, where affiliated-entity aggregation applies, or where the cross-border provision-of-services rules under Article 26 NIS2 require additional analysis for non-German or non-EU providers. In those cases, the tool's output is the starting point; legal qualification of the facts against the statutory framework is the next step.

§ VIIWhat should technology companies do now?

A structured response has four layers that run in parallel rather than in sequence: confirm scope, close the gaps against the Article 21 measure catalogue, make the 24-hour, 72-hour and one-month reporting cadence of Article 23 workable, and bring the framework to the management body for approval and training.

1. Scoping. Determine whether the entity (and any affiliates aggregated for NIS2 purposes) falls within the scope of the German implementation. The BSI tool provides the official pathway; legal qualification resolves ambiguities.

2. Gap analysis. Against the Article 21 minimum measure catalogue, identify which of the ten measure categories are already implemented, which are partially implemented, and which are absent. Document the assessment — documentation itself is an element of the compliance duty.

3. Incident-reporting readiness. Establish and test the internal processes necessary to meet the 24-hour / 72-hour / one-month reporting cadence. Most internal incident-response workflows that were designed for NIS1 or purely for internal notification timelines do not yet meet the NIS2 cadence.

4. Governance and management-body engagement. Bring the cybersecurity risk-management framework to the approval stage at board or management-body level, and organise the required training. Document the approval and the training delivery — both will be the first items reviewed under any supervisory inspection.

Technology companies operating into Germany from outside the EU should additionally consider the interaction with other EU digital-regulation regimes: NIS2 applies in parallel with the Digital Services Act (DSA), the AI Act, the Data Act, the GDPR, and sector-specific regulation such as DORA for financial entities. A cross-regime coherence analysis — identifying where incident-reporting, risk-management, and supervisory regimes overlap — is the most efficient way to avoid duplicative compliance expenditure.