NIS-2 Directive

The NIS2 Directive is EU-wide legislation on network and information security with the aim of strengthening the cyber security of companies and ensuring a uniformly high level of security in the EU. Every company must check whether it is affected by the directive - the decisive factors are the type of business activity and the size of the company. A total of 18 sectors are covered, divided into particularly important facilities and important facilities.

The NIS2 Directive builds on the original NIS Directive from 2016 and came into force on January 16, 2023. The EU member states had until October 17, 2024 to transpose it into national law. Germany missed this deadline, which is why the NIS 2 Implementation Act (NIS2UmsuCG) has now been passed. It adapts the BSI Act (BSIG) and transposes the new requirements - such as risk management, reporting obligations, registration obligations and supervision - into German law.

The Bundestag passed the law implementing the NIS 2 Directive on November 13, 2025 . It has yet to be approved by the Bundesrat and promulgated in the Federal Law Gazette. It is therefore expected to come into force at the end of 2025 or early 2026 at the latest, from which point companies will have to report security incidents in accordance with the NIS2 deadlines. The BSI will act as the central supervisory authority. Violations can be punished with heavy fines. Until the formal entry into force, companies should proactively review and prepare their IT security processes, as the NIS2 requirements reflect the state of the art and are considered a best practice benchmark.

With the introduction of the NIS 2 Directive, the following significant innovations were implemented:

1. Extended scope of application

   The directive no longer only applies to traditional critical infrastructure operators, but to 18 sectors, divided into "particularly important facilities" and "important facilities".

   Many SMEs (with 50 employees or more or a turnover of EUR 10 million) and companies in the supply chain of critical players are also affected.

2. Stricter security requirements

   Obligation for comprehensive risk management (Art. 21), including emergency plans, supply chain security, awareness training and regular updates.

   Reporting obligations (Art. 23): Initial report within 24 hours, clarification after 72 hours, final report after one month at the latest.

3. Liability of the company management

   Management is personally responsible for implementing the measures.

   Complete delegation is not possible - it's a case of "you get what you pay for".

4. Significantly higher sanctions

   For particularly important facilities: up to EUR 10 million or 2% of global annual turnover.

   For important entities: up to EUR 7 million or 1.4% of turnover. For comparison: the old NIS Directive provided for a maximum of EUR 150,000.