In Germany, the US has begun putting the NIS-2 law into effect, tightening the managerial cybersecurity regulations, enforcement, and penalties for noncompliance for thousands of companies. This law, which comes into effect on December 6, 2025, will implement the EU`s NIS-2 Directive and give regulators greater authority and flexibility to monitor compliance, as well as charge more severe infractions. Previously, only 4,500 companies were mandated to comply, the majority of which were critical infrastructures. This number increased fivefold to 30,000 NIS-2 companies.
Classification of entities at risk of infractions
- Businesses are classified into essential and important entities based on their size and sector
- Essential entities are those in the fields of energy, transportation, finance, healthcare, water, digital infrastructure, and mail.
- Important entities are those in the manufacturing, chemicals, food, and digital services sectors.
In general, companies with 50 or more employees or €10 million in annual turnover are captured within these rules. Smaller companies will still qualify if their services are deemed critical.
What are the obligations for companies?
Some of the obligations this law creates for companies include:
- 3 months after becoming BSI qualified, the company must preemptively register with BSI, as a new portal for implementation will be live in January 2026.
- Report incidents expeditiously: Preliminary report within 24 hours, and if a claim is to be made, A detailed report within 72 hours, and for the ultimate report, Final report within one month.
- Facilitate and improve risk management by instituting control and mitigation security measures; a business continuity and recovery plan; and controls and measures in monitoring the supply chain.
- Operators of critical infrastructure must now conduct audits and share information about certain key elements with the BSI.
Enforcing power: The minimum requirements of the EU
Enforcement power has expanded for the BSI to:
- Require companies to provide notification to customers about significant events.
- Impose restrictions on the use of high-risk IT components in critical systems.
- Demand periodic audits and certifications.
These measures are in addition to the minimum requirements of the EU, indicating that Germany is among the most advanced and strict countries in the application of the NIS-2.
Non-compliance will result in significant penalties for firms
Companies can get penalties, including fines of upwards of €20 million or 2% of the total worldwide revenue for the previous financial year, whichever is greater. Negligence of the senior management of such companies will also result in personal liability.
“With fines up to €20 million or 2% of global turnover, Germany signals it’s serious about cybersecurity and accountability.”
Germany did not adopt NIS 2 in 2024, which was a legislative requirement and attracted the attention of Brussels. After several months of discussions, the law was promulgated in November and came into force in December. The aim is to enhance the sustainability of cyber protective measures and to mitigate risks involved in critical sectors.
What are the requirements of firms?
Firms must:
- Determine whether or not the firm is subject to the new requirements.
- Revise and enhance internal procedures regarding security systems and the manner in which the firm reports on breaches.
- Provide training to the management regarding the newly imposed obligations.
- Be ready to file an application with the BSI portal, which is expected to be operational in early 2026.
“Germany’s NIS-2 law expands cybersecurity rules to nearly 30,000 companies, making compliance a top priority for essential and important sectors.”
Germany’s new NIS-2 law gets Germany one step closer to better cybersecurity. More businesses will be required to invest in tighter security systems and will need to prepare for more stringent supervision. Businesses will now have bigger penalties and more of an obligation to report; therefore they can no longer ignore the changing requirements.
