{"id":21976,"date":"2026-07-05T08:00:00","date_gmt":"2026-07-05T08:00:00","guid":{"rendered":"https:\/\/www.securitytoday.de\/2026\/07\/05\/what-is-nis2-definition-obligations-liability\/"},"modified":"2026-11-03T14:46:32","modified_gmt":"2026-11-03T14:46:32","slug":"what-is-nis2-definition-obligations-liability","status":"publish","type":"post","link":"https:\/\/www.securitytoday.de\/en\/2026\/07\/05\/what-is-nis2-definition-obligations-liability\/","title":{"rendered":"What is NIS2? Definition, duties and liability"},"content":{"rendered":"<p><strong>NIS2 is the EU\u2019s second directive on the security of network and information systems. In Germany, the NIS2 Implementation Act has been in force since 6 December 2025. Affected entities must manage risks to their IT, report significant security incidents and register with the Federal Office for Information Security (BSI). Management has its own duties and may be liable to its entity.<\/strong><\/p>\n<div style=\"background:#003340;color:#fff;padding:32px 36px;margin:32px 0;border-radius:8px;\">\n<p style=\"color:#69d8ed;text-transform:uppercase;letter-spacing:0.08em;font-size:0.82em;font-weight:700;margin:0 0 16px;\">Key takeaways<\/p>\n<ul style=\"margin:0;padding-left:20px;line-height:1.7;\">\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">Scope depends on several criteria.<\/strong> Alongside the activity, employee numbers, turnover and balance sheet total are often decisive. Certain entities are exempt from the size thresholds.<\/li>\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">Significant incidents must be reported.<\/strong> As a rule, an early warning must be submitted within 24 hours and a notification within 72 hours of becoming aware of an incident.<\/li>\n<li style=\"margin-bottom:0;\"><strong style=\"color:#69d8ed;\">Management has obligations.<\/strong> It must implement and oversee risk management measures and take part in regular training.<\/li>\n<\/ul>\n<\/div>\n<h2>What NIS2 regulates in Germany<\/h2>\n<p><a href=\"https:\/\/eur-lex.europa.eu\/eli\/dir\/2022\/2555\/oj?eliuri=eli%3Adir%3A2022%3A2555%3Aoj&amp;locale=de\">Directive (EU) 2022\/2555<\/a> establishes a European framework for cyber security. Germany transposed it into the BSI Act through the NIS2 Implementation Act. The Act distinguishes in particular between essential and important entities.<\/p>\n<p>The Act generally requires both groups to manage risks, report incidents and register. Which rules apply in each case also depends on exceptions under sector-specific legislation and the activity concerned.<\/p>\n<h2>Which entities are affected<\/h2>\n<p>The <a href=\"https:\/\/www.gesetze-im-internet.de\/bsig_2025\/BJNR12D0B0025.html\">BSI Act<\/a> covers certain types of entity listed in its annexes. These include activities in sectors such as energy, transport, health and digital infrastructure. Belonging to a sector alone is not sufficient for classification.<\/p>\n<p>For many entities, size and financial figures are decisive. The threshold for important entities can be reached in particular with at least 50 employees or with annual turnover of more than ten million euros and an annual balance sheet total of more than ten million euros. For certain services, the Act applies regardless of size. Companies should therefore check the specific type of entity and the statutory exceptions when determining their classification.<\/p>\n<h2>Which duties and deadlines apply<\/h2>\n<p>Affected entities must take appropriate, proportionate and effective technical and organisational measures. These include risk analyses, security incident handling, business continuity management and supply chain security. The measures must be suited to the entity\u2019s risk exposure and size.<\/p>\n<p>Significant security incidents must generally be reported to the BSI without undue delay: first as an early warning within 24 hours of becoming aware of the incident and then as a security incident notification within 72 hours. A final report generally follows no later than one month after the notification. Special rules apply in individual cases.<\/p>\n<p>Important and essential entities must generally register within three months of meeting the respective criteria. Registration takes place through the <a href=\"https:\/\/mip2.bsi.bund.de\/de\/info-nis2-registrierung\/\">BSI portal<\/a>. Entities that have been affected for some time and have not yet registered should complete their registration.<\/p>\n<h2>What management is responsible for<\/h2>\n<p>Management must implement the required risk management measures and oversee their implementation. It must also take part in regular training. In practice, traceable decisions, clear responsibilities and documented controls are important.<\/p>\n<p>If management breaches its duty to implement or oversee measures and culpably causes damage to the entity as a result, it may be liable to the entity. The company law rules applicable to the entity\u2019s legal form are decisive. The BSI Act does not limit liability in this way to gross breaches of duty.<\/p>\n<p>For certain breaches of risk management or reporting duties, essential entities face fines of up to ten million euros or up to two per cent of worldwide annual turnover in the preceding financial year. The higher amount applies.<\/p>\n<h2 style=\"padding-top:64px;margin-bottom:20px;\">Frequently asked questions<\/h2>\n<p class=\"st-faq-hint\">Each question is closed. Tap to reveal the answer.<\/p>\n<details>\n<summary><strong>Can small businesses also be affected?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Yes. For certain types of entity named in the Act, the duties apply regardless of company size. The specific activity is decisive.<\/p>\n<\/details>\n<details>\n<summary><strong>When must registration take place?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Generally within three months of the entity meeting the statutory criteria. Entities already affected should complete any outstanding registration.<\/p>\n<\/details>\n<details>\n<summary><strong>How does NIS2 relate to DORA?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">DORA regulates the digital operational resilience of certain financial entities. The BSI Act exempts these entities from several explicitly specified NIS2 duties. Which other duties apply depends on the individual case.<\/p>\n<\/details>\n<p><!--ST-LOWER-CARDS lang=en--><\/p>\n<h3 style=\"margin:48px 0 18px;font-size:1.05em;font-weight:800;color:#e6e3da;line-height:1.2;\">Editor&#8217;s Picks<\/h3>\n<p><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/07\/02\/five-positions-that-require-a-siem-budget\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/security-budget-priorisierung-nis2-paragraf-30-cover-hero-250x143.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Five Line Items That Need Budget Before SIEM<\/span><\/span><\/a><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/06\/30\/what-management-must-document-under-nis2\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/geschaeftsfuehrung-nis2-dokumentationspflicht-bsig-cover-hero-250x143.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">What Management Must Document Under NIS2<\/span><\/span><\/a><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/06\/29\/dora-in-operation-what-the-regulator-wants-to-see\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/06\/dora-finanzinstitute-resilienz-nachweis-tlpt-cover-hero-250x141.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">DORA in Operation: What the Regulator Wants to See<\/span><\/span><\/a><\/p>\n<h3 style=\"margin:48px 0 18px;font-size:1.05em;font-weight:800;color:#e6e3da;line-height:1.2;\">More from the MBF Media Network<\/h3>\n<p><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/06\/29\/kritis-in-the-cloud-what-secures-the-migration\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/11\/net-kritis-cloud-migration-c5-nis2-dachgeset-54268377.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#0bb7fd;margin-bottom:5px;\">cloudmagazin<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">KRITIS in the Cloud: What Secures the Migration<\/span><\/span><\/a><a href=\"https:\/\/mybusinessfuture.com\/en\/the-ai-oversight-in-germany-now-has-an-address\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/11\/net-die-ki-aufsicht-in-deutschland-hat-jetzt-62200846-250x141.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#aa8ac2;margin-bottom:5px;\">MyBusinessFuture<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">The AI oversight in Germany now has an address<\/span><\/span><\/a><a href=\"https:\/\/www.digital-chiefs.de\/en\/the-ai-writes-the-code-who-is-liable-for-it\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/11\/net-ki-generierter-code-haftung-governance-r-96016855-250x143.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#e8828d;margin-bottom:5px;\">Digital Chiefs<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">The AI writes the code. Who is liable for it?<\/span><\/span><\/a><!--\/ST-LOWER-CARDS--><\/p>\n<h3>More from the MBF Media network<\/h3>\n<ul>\n<li><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/06\/29\/kritis-in-the-cloud-what-secures-the-migration\/\">Critical infrastructure in the cloud: securing the migration<\/a><\/li>\n<li><a href=\"https:\/\/mybusinessfuture.com\/en\/the-ai-oversight-in-germany-now-has-an-address\/\">Germany\u2019s AI supervision now has an address<\/a><\/li>\n<li><a href=\"https:\/\/www.digital-chiefs.de\/en\/the-ai-writes-the-code-who-is-liable-for-it\/\">AI writes the code. Who is liable?<\/a><\/li>\n<\/ul>\n<p style=\"text-align:right;\"><em>Image source: AI-generated (Juli 2026)<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"NIS2 requires affected entities to manage cyber security, report incidents and register. Management also bears responsibility.","protected":false},"author":10,"featured_media":20756,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"NIS2 directive","_yoast_wpseo_title":"What is NIS2? Definition, duties and liability","_yoast_wpseo_metadesc":"NIS2 explained: which entities are affected, which deadlines apply and when management is liable to its entity.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/was-ist-nis2-cover-hero-1.jpg","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/was-ist-nis2-cover-hero-1.jpg","_yoast_wpseo_twitter-image-id":0,"evm_kih_original":false,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"en","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[263],"tags":[],"class_list":["post-21976","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sicherheitslexikon-en"],"evm_reading_time_minutes":5,"wpml_language":"en","wpml_translation_of":20745,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/21976","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=21976"}],"version-history":[{"count":5,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/21976\/revisions"}],"predecessor-version":[{"id":26381,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/21976\/revisions\/26381"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/20756"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=21976"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=21976"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=21976"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}