Germany Moves to Implement the NIS2 Directive: What Technology Companies Need to Know

The regulatory frame: why NIS2 is fundamentally different from NIS1

The NIS2 Directive (Directive (EU) 2022/2555, "NIS2") replaces the first-generation NIS Directive of 2016 and expands the Union's cybersecurity regime across three structural dimensions: the range of sectors in scope, the specificity of risk-management obligations, and the severity of enforcement consequences. In contrast to NIS1, which primarily addressed traditional critical-infrastructure operators and a small number of digital service providers, NIS2 covers a wide range of entities across 18 sectors — including cloud computing services, data centres, content-delivery networks, digital marketplaces, online search engines, social networking platforms, managed service providers, and managed security service providers.

Germany's national implementation is carried out through the NIS2 Implementation and Cybersecurity Strengthening Act ("NIS2UmsuCG"), which amends the BSI-Gesetz and adjacent statutes. The transposition deadline under Union law was 17 October 2024; Germany's domestic process is in an advanced phase, and entry into force is expected during the course of the national legislative finalisation.

Who is in scope: essential entities, important entities, size thresholds

NIS2 distinguishes two categories of regulated entities, both of which trigger substantive obligations: essential entities (Annex I sectors, including energy, transport, banking, health, drinking water, digital infrastructure, and ICT service management) and important entities (Annex II sectors, including digital providers, postal services, manufacturing of certain critical products, and research). The division is not primarily a function of sector alone, but of the combination of sector and company size.

Certain entities are in scope regardless of size — for example, providers of public electronic communications networks, trust service providers, and domain-name registration services. For technology companies offering services into Germany, the assessment turns on (i) the sector classification, (ii) whether the size thresholds are met, and (iii) whether any size-independent scoping criterion applies. Since the assessment is layered and fact-specific, the BSI has published a formal affected-party assessment tool that structures the analysis.

Core obligations: risk-management and incident reporting

Article 21 NIS2 requires regulated entities to implement appropriate and proportionate technical, operational, and organisational cybersecurity risk-management measures. This is not a generic "state-of-the-art" clause: the provision specifies a minimum catalogue of ten measure categories that every essential and important entity must implement.

Article 23 NIS2 imposes a multi-stage incident-reporting regime. A significant incident must be reported to the national computer security incident response team (CSIRT) — in Germany, the BSI — in three stages: (i) an early warning within 24 hours of becoming aware of the incident; (ii) an incident notification within 72 hours, including an initial assessment and, where applicable, indicators of compromise; and (iii) a final report within one month, containing a detailed description and the mitigation measures taken. The timelines are short and do not await completion of internal forensic analysis.

Enforcement and executive liability

The enforcement regime under NIS2 is materially stricter than under NIS1. Article 32 NIS2 grants the competent authorities — in Germany, the BSI — extensive supervisory powers, including on-site inspections, targeted audits, ad-hoc audits, requests for information, and the power to issue binding orders to bring an entity into compliance. Article 34 NIS2 establishes the administrative-fine framework: up to €10 million or 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher, for essential entities; up to €7 million or 1.4% of worldwide annual turnover for important entities.

Article 20 NIS2 introduces a point that is sometimes overlooked but deserves particular attention: management-body liability. The management bodies of essential and important entities are required to approve the cybersecurity risk-management measures, to oversee their implementation, and can be held liable for breaches by the entity of its obligations under Article 21. The provision explicitly requires members of management bodies to undergo training to acquire sufficient knowledge to identify risks and evaluate cybersecurity practices. In German corporate-liability terms, this construction brings NIS2 obligations squarely into the domain of §§ 93 AktG / 43 GmbHG directors' duties.

Practical first step: the BSI assessment tool

Given the structural complexity of the scoping analysis — multiple Annexes, size thresholds, size-independent criteria, and sector-specific carve-outs — the single most efficient first step for any technology company operating in or into Germany is a structured affected-party assessment.

The tool generates an initial scoping result, but it does not substitute for legal qualification where edge cases arise — for example, where an entity operates across multiple sectors, where affiliated-entity aggregation applies, or where the cross-border provision-of-services rules under Article 26 NIS2 require additional analysis for non-German or non-EU providers. In those cases, the tool's output is the starting point; legal qualification of the facts against the statutory framework is the next step.

What technology companies should do now

A structured response to NIS2 involves four layers that can be executed in parallel rather than sequentially:

1. Scoping. Determine whether the entity (and any affiliates aggregated for NIS2 purposes) falls within the scope of the German implementation. The BSI tool provides the official pathway; legal qualification resolves ambiguities.

2. Gap analysis. Against the Article 21 minimum measure catalogue, identify which of the ten measure categories are already implemented, which are partially implemented, and which are absent. Document the assessment — documentation itself is an element of the compliance duty.

3. Incident-reporting readiness. Establish and test the internal processes necessary to meet the 24-hour / 72-hour / one-month reporting cadence. Most internal incident-response workflows that were designed for NIS1 or purely for internal notification timelines do not yet meet the NIS2 cadence.

4. Governance and management-body engagement. Bring the cybersecurity risk-management framework to the approval stage at board or management-body level, and organise the required training. Document the approval and the training delivery — both will be the first items reviewed under any supervisory inspection.

Technology companies operating into Germany from outside the EU should additionally consider the interaction with other EU digital-regulation regimes: NIS2 applies in parallel with the Digital Services Act (DSA), the AI Act, the Data Act, the GDPR, and sector-specific regulation such as DORA for financial entities. A cross-regime coherence analysis — identifying where incident-reporting, risk-management, and supervisory regimes overlap — is the most efficient way to avoid duplicative compliance expenditure.