In short
The NIS 2 Directive is the second EU directive on network and information security, formally Directive (EU) 2022/2555. It obliges companies and organisations from a defined list of sectors to a minimum level of IT security, to reporting channels for security incidents and to a personally responsible management.
In Germany, the directive does not apply directly. What is decisive is the BSI Act (BSIG) in its new version, which entered into force via the NIS 2 Implementation Act on 6 December 2025. Where sections are mentioned below, these are always BSIG sections, not articles of the directive.
For mid-sized companies, this is a break with a convenient assumption. For a long time, IT security regulation was considered a topic for electricity grid operators, hospitals and data centres. NIS 2 redraws the line. A food wholesaler with 60 employees can fall under it, and a mechanical engineering company with 300 employees very probably does.
Who is affected: essential and important entities
The BSIG knows two classes: particularly important entities (essential entities in the terminology of the directive) and important entities. The classification results from two factors that must both be met: the type of entity from Annexes 1 or 2 and the size of the company according to Section 28 BSIG.
The decisive point: being affected arises by operation of law. There is no official notice that establishes it, and no transitional period that waits for an official classification. Anyone checking whether they are affected checks against the text of the law, not against a letter in their inbox.
The thresholds
| Class | Sectors | Employees | Turnover / balance sheet total |
|---|---|---|---|
| Particularly important (essential) entity | Annex 1 only | from 250 | or over €50 million turnover and over €43 million balance sheet total |
| Important entity | Annex 1 and Annex 2 | from 50 | or over €10 million turnover and over €10 million balance sheet total |
| Operators of critical facilities | KRITIS thresholds | independent | independent |
Two details are regularly overlooked. First, the size threshold is an or: the number of employees alone is enough. Second, Section 28(4) BSIG refers to the EU Commission's SME Recommendation 2003/361/EC, but without Article 3(4) of the Annex. Linked and partner enterprises are not added under narrow conditions.
Regardless of size thresholds, some types of entity are always considered particularly important. These include operators of critical facilities, qualified trust service providers, top-level domain registries and DNS service providers. Separate, considerably lower thresholds apply to telecommunications providers.
Annex 1 and Annex 2
Annex 1 ("sectors of particularly important and important entities") covers seven sectors: energy, transport, banking and finance, health, water, digital infrastructure and space. From Annex 1, an entity can end up in either class depending on its size.
Annex 2 ("sectors of important entities") also covers seven sectors: postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research. Anyone who falls only under Annex 2 never becomes a particularly important entity, only an important one at most.
The sector "manufacturing / production of goods" is the most relevant for German mid-sized companies. It applies via NACE classes and covers, among other things, medical devices, data processing equipment, electrical equipment, mechanical engineering, motor vehicle manufacturing and the manufacture of other transport equipment.
The four obligations
1. Registration with the BSI
Under Section 33 BSIG, affected entities must register with the BSI (Federal Office for Information Security) no later than three months after becoming affected. They submit their name and legal form, contact details including public IP address ranges, the relevant sector, the EU Member States in which they provide services and the competent supervisory authorities.
If this information changes, you have two weeks from becoming aware of the change to update it. If an entity fails to meet its registration obligation, the BSI can also register it itself in agreement with the supervisory authorities.
The official statistics show how strongly this takes effect. As of 30 June 2026, the BSI counted 17,945 NIS 2 registrations: 11,501 important and 6,215 particularly important entities, of which 1,342 were operators of critical facilities, plus 216 registered branches (BSI, NIS 2 in figures).
2. Reporting obligations with staggered deadlines
A significant security incident triggers a cascade under Section 32 BSIG. Reports go to a joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance. The deadlines run from becoming aware, not from the time of the attack:
- Within 24 hours: an early warning stating whether there is suspicion of unlawful or malicious action or whether cross-border effects are possible.
- Within 72 hours: confirmation or update of the early warning, plus an initial assessment of severity and impact and, where applicable, indicators of compromise.
- At the BSI's request: intermediate reports with relevant status updates. This stage is not scheduled but event-driven.
- No later than one month after the 72-hour report: a final report with a detailed description, the cause, the remedial measures taken and cross-border effects.
If the incident is still ongoing after one month, a progress report replaces the final report. The definitive final report then follows once processing is complete. There are already figures on this: 692 early warnings and 1,659 reports in total by the end of June 2026.
The hard consequence in practice is organisational, not technical. A 24-hour deadline can only be met if it is established beforehand who is authorised to report, who triggers it outside business hours and where the access data for the BSI portal comes from. This is exactly what is missing from most emergency plans.
3. Risk management under Section 30 BSIG
Section 30 BSIG requires appropriate, proportionate and effective technical and organisational measures. Proportionality is measured by risk exposure, company size, implementation costs and the probability and severity of incidents. Compliance must be documented. The law names ten areas as a minimum:
- Policies on risk analysis and information system security
- Incident handling
- Business continuity, i.e. backup management, disaster recovery and crisis management
- Supply chain security, including relationships with direct suppliers and service providers
- Security in the acquisition, development and maintenance of IT systems, including vulnerability handling
- Policies to assess the effectiveness of risk management measures
- Basic cyber hygiene practices and IT security training
- Policies and procedures for the use of cryptography
- Human resources security, access control and management of ICT systems and processes
- Multi-factor or continuous authentication, secured voice, video and text communication
The wording "should comply with the state of the art" and "take relevant European and international standards into account" is deliberately open. The law does not prescribe a product or a certificate. It prescribes results that you must be able to prove.
4. Management liability and training obligation
Section 38 BSIG is the section that takes NIS 2 out of the IT department. Management bodies must implement the risk management measures and monitor their implementation. Delegating is permitted; looking the other way is not.
If they breach this duty, they are liable to their entity for culpably caused damage under the company law rules of their legal form. The BSIG itself only applies subsidiarily, namely if the relevant company law contains no liability rule. For the GmbH, this means in practice: Section 43 of the Limited Liability Companies Act (GmbHG).
On top of this comes a separate training obligation under Section 38(3) BSIG. Management itself must regularly take part in training in order to be able to identify and assess risks and evaluate their impact on its own services. Training for the IT team does not fulfil this obligation.
Fines
| Entity | Standard range | With total turnover over €500 million |
|---|---|---|
| Particularly important (essential) entity | up to €10 million | alternatively up to 2% of total worldwide turnover |
| Important entity | up to €7 million | alternatively up to 1.4% of total worldwide turnover |
A close look is worthwhile here, because many summaries get it wrong. The turnover percentage is not a general "higher of the two values". Under Section 65(6) and (7) BSIG, it only applies to entities with a total worldwide turnover of more than 500 million euros.
Other breaches have their own ranges: up to 500,000 euros, for example, for failing to register on time, and up to 100,000 euros for refusing to provide information during an inspection. Double sanctions are excluded: if a GDPR fine has already been imposed for the same conduct, no second fine may follow under the BSIG.
Supply chain: why NIS 2 also reaches those not affected
Section 30(2) no. 4 BSIG expressly obliges affected entities to ensure the security of their supply chain and the security-related aspects of their relationships with direct suppliers and service providers. This obligation is passed further down contractually.
In practice, this means: a 40-person software house does not itself fall under NIS 2 but receives a questionnaire on patch cycles, access control and reporting channels from the automotive supplier among its customers. Anyone who cannot answer it loses the framework agreement. The regulatory pressure therefore reaches companies via purchasing, long before an authority comes knocking.
For contract drafting, this partly overlaps with what you regulate in the data processing agreement anyway. It is not identical, however: the DPA protects personal data, while Section 30 BSIG protects the availability and integrity of the service. Anyone who combines both in one annex should describe the reporting channels separately.
The cloud deserves particular attention. If you use SaaS services or a hyperscaler for business-critical processes, this provider is part of your supply chain within the meaning of Section 30. The topic thus touches on the same questions as digital sovereignty.
Distinction: KRITIS, ISO 27001 and BSI C5
KRITIS (critical infrastructure) is not absorbed into NIS 2 but sits within it. Operators of critical facilities are automatically considered particularly important entities. Their registration takes place under Section 33(2) BSIG via Section 8 of the KRITIS Umbrella Act. Of the 6,215 particularly important entities as of 30 June 2026, 1,342 were KRITIS operators.
Only for operators of critical facilities does the additional obligation to provide evidence under Section 39 BSIG apply: implementation must be demonstrated to the BSI through audits, inspections or certifications, and again every three years thereafter. For ordinary important and particularly important entities, this periodic obligation to provide evidence does not exist.
ISO 27001 and BSI C5 are not NIS 2 obligations. No section requires a certificate. However, both are the most pragmatic route to the required documentation: an existing ISMS according to ISO 27001 already covers large parts of the ten areas of measures, and a C5 attestation from the cloud provider makes proof of supply chain security considerably easier.
The honest assessment: certification is an accelerator, not a free pass. The obligation remains results-based, and the supervisory authority checks against Section 30, not against a certificate on the wall.
A worked example from mechanical engineering
A special machine builder in the Sauerland region: 310 employees, 74 million euros turnover, balance sheet total 39 million euros. The business manufactures machines and therefore falls under Annex 2, sector "manufacturing / production of goods".
The check: Annex 2 can only lead to an important entity, regardless of size. The threshold for important entities is 50 employees. At 310, the criterion is met. The balance sheet total of 39 million euros no longer plays a role, because the law accepts the number of employees as an alternative.
Result: important entity. Registration obligation within three months, reporting obligations under Section 32, risk management under Section 30, management liability and training obligation under Section 38. Range of fines up to 7 million euros. No periodic obligation to provide evidence, because no critical facility is operated.
The BSI statistics show that this profile is not a special case: with 4,095 registrations, manufacturing is the largest single sector in Annex 2. Anyone who needs a reliable assessment for their own business should work with the BSI's NIS 2 applicability check.
Frequently asked questions
Will the BSI notify me if I am affected?
No. Being affected results directly from the law; registration is a self-declaration under Section 33 BSIG. The BSI can register an entity ex officio if it fails to meet its obligation. Waiting for this official act is not a strategy but an administrative offence.
Do parent companies and shareholdings count towards the thresholds?
In principle yes, via SME Recommendation 2003/361/EC. However, Section 28(4) BSIG contains an exception: data from partner or linked enterprises is disregarded if the company is actually independent with regard to the nature and operation of its IT systems.
What is a "significant" security incident?
Significance depends on the impact on the service provided, not on the attack technique. The BSI specifies the content of reports under Section 32(4) BSIG and publishes it on its website. A repelled phishing attempt without any operational impact is not one; an encrypted file server generally is.
Does NIS 2 also apply to our IT service providers?
Managed service providers, managed security service providers, cloud providers and data centre services are listed as separate types of entity in Annex 1, digital infrastructure sector. If they meet the size thresholds, they are affected themselves. Regardless of this, they are part of your supply chain under Section 30(2) no. 4 BSIG.
Is our existing IT security policy sufficient?
Rarely. The most common finding in initial discussions is not a lack of technology but a lack of documentation and a reporting channel that has not been rehearsed. Section 30(1) sentence 3 BSIG expressly requires proof of compliance. What is not documented is considered not implemented as far as the supervisory authority is concerned.