What is NIS2? Definition, duties and liability

By Alec Chizhik · July 5, 2026 · 5 min read

NIS2 is the EU’s second directive on the security of network and information systems. In Germany, the NIS2 Implementation Act has been in force since 6 December 2025. Affected entities must manage risks to their IT, report significant security incidents and register with the Federal Office for Information Security (BSI). Management has its own duties and may be liable to its entity.

Key takeaways

Scope depends on several criteria. Alongside the activity, employee numbers, turnover and balance sheet total are often decisive. Certain entities are exempt from the size thresholds.
Significant incidents must be reported. As a rule, an early warning must be submitted within 24 hours and a notification within 72 hours of becoming aware of an incident.
Management has obligations. It must implement and oversee risk management measures and take part in regular training.

What NIS2 regulates in Germany

Directive (EU) 2022/2555 establishes a European framework for cyber security. Germany transposed it into the BSI Act through the NIS2 Implementation Act. The Act distinguishes in particular between essential and important entities.

The Act generally requires both groups to manage risks, report incidents and register. Which rules apply in each case also depends on exceptions under sector-specific legislation and the activity concerned.

Which entities are affected

The BSI Act covers certain types of entity listed in its annexes. These include activities in sectors such as energy, transport, health and digital infrastructure. Belonging to a sector alone is not sufficient for classification.

For many entities, size and financial figures are decisive. The threshold for important entities can be reached in particular with at least 50 employees or with annual turnover of more than ten million euros and an annual balance sheet total of more than ten million euros. For certain services, the Act applies regardless of size. Companies should therefore check the specific type of entity and the statutory exceptions when determining their classification.

Which duties and deadlines apply

Affected entities must take appropriate, proportionate and effective technical and organisational measures. These include risk analyses, security incident handling, business continuity management and supply chain security. The measures must be suited to the entity’s risk exposure and size.

Significant security incidents must generally be reported to the BSI without undue delay: first as an early warning within 24 hours of becoming aware of the incident and then as a security incident notification within 72 hours. A final report generally follows no later than one month after the notification. Special rules apply in individual cases.

Important and essential entities must generally register within three months of meeting the respective criteria. Registration takes place through the BSI portal. Entities that have been affected for some time and have not yet registered should complete their registration.

What management is responsible for

Management must implement the required risk management measures and oversee their implementation. It must also take part in regular training. In practice, traceable decisions, clear responsibilities and documented controls are important.

If management breaches its duty to implement or oversee measures and culpably causes damage to the entity as a result, it may be liable to the entity. The company law rules applicable to the entity’s legal form are decisive. The BSI Act does not limit liability in this way to gross breaches of duty.

For certain breaches of risk management or reporting duties, essential entities face fines of up to ten million euros or up to two per cent of worldwide annual turnover in the preceding financial year. The higher amount applies.

Frequently asked questions

Each question is closed. Tap to reveal the answer.

Can small businesses also be affected?

Yes. For certain types of entity named in the Act, the duties apply regardless of company size. The specific activity is decisive.

When must registration take place?

Generally within three months of the entity meeting the statutory criteria. Entities already affected should complete any outstanding registration.

How does NIS2 relate to DORA?

DORA regulates the digital operational resilience of certain financial entities. The BSI Act exempts these entities from several explicitly specified NIS2 duties. Which other duties apply depends on the individual case.

Editor’s Picks

Editor’s PickFive Line Items That Need Budget Before SIEM Editor’s PickWhat Management Must Document Under NIS2 Editor’s PickDORA in Operation: What the Regulator Wants to See

More from the MBF Media Network

cloudmagazinKRITIS in the Cloud: What Secures the Migration MyBusinessFutureThe AI oversight in Germany now has an address Digital ChiefsThe AI writes the code. Who is liable for it?

More from the MBF Media network

Image source: AI-generated (Juli 2026)

Translated from the German original using artificial intelligence. The German version is authoritative.