NIS2 for SMEs in Germany: scope, duties and deadlines

Legal position in October 2026: EU directive and new BSI Act

The basis is Directive (EU) 2022/2555 of 14 December 2022, the NIS 2 Directive, which member states had to transpose by 17 October 2024. Germany did so with the “Act implementing the NIS 2 Directive and regulating essential principles of information security management in the federal administration”, often called NIS2UmsuCG. It was signed on 2 December 2025, promulgated on 5 December 2025 (Federal Law Gazette 2025 I No. 301) and took effect on 6 December 2025. Its core is a rewritten BSI Act (BSIG), amended several times since, most recently on 23 July 2026; sections cited refer to that version.

The BSI expects around 29,500 particularly important and important entities. By 30 September 2026, 20,141 had registered (13,252 important, 6,837 particularly important). At EU level an amendment is under way: in January 2026 the Commission proposed simplifying the directive and aligning it with the revised Cybersecurity Act (procedure 2026/0012(COD)). As of October 2026 it is still with the European Parliament’s lead committee and nothing has been adopted, so the current BSI Act applies.

Who is in scope: sector and size

The BSI Act has two categories: particularly important and important entities (Section 28 BSIG). As a rule, your company must belong to an entity type in Annex 1 or 2 and offer goods or services there for payment, and it must reach the size threshold. Activities that are negligible within the business as a whole can be disregarded (Section 28(3)).

• Annex 1: energy, transport, banking and financial market infrastructure, health, water, digital infrastructure (including cloud services, data centres, managed service and managed security service providers) and space.
• Annex 2: postal and courier services, waste management, chemicals, food (wholesale and industrial production and processing), manufacturing (medical devices, computers and electronics, electrical equipment, machinery, motor vehicles, other transport equipment), online marketplaces, search engines, social networks and research organisations.

Figures follow the European Commission’s SME Recommendation (2003/361/EC), referenced in Section 28(4) BSIG. Employees are counted in annual work units: part-time and seasonal work count pro rata, working owners count, apprentices do not. The latest annual accounts apply, with turnover net of VAT. According to the BSI, a threshold must be exceeded in two consecutive financial years, not just once (Article 4(2) of the recommendation; new companies excepted). Partner enterprises are added proportionally and linked enterprises in full, unless your company is legally, economically and in fact independent of them in the design and operation of its IT systems (Section 28(4), second sentence). Rule of thumb: medium-sized companies in the listed sectors are in scope, small and micro enterprises usually are not.

Special cases: in scope regardless of size

• Operators of critical facilities, qualified trust service providers, top-level domain name registries and DNS service providers are always particularly important (Section 28(1)).
• Other trust service providers are always important (Section 28(2)).
• Public telecoms networks and publicly available telecoms services: particularly important from 50 employees or more than EUR 10 million in both turnover and balance sheet total, otherwise important.
• Domain name registration service providers must register with the BSI regardless of size (Section 33(1)).

The act’s risk management, reporting and management duties do not apply to financial entities under the DORA Regulation or parts of the healthcare telematics infrastructure, which have their own rules (Section 28(6)). Section 28(5) largely does the same for public telecoms networks and services and certain energy companies under the Energy Industry Act, unless they have other covered activities.

The core duties: registration, risk management, reporting

Registering with the BSI

Entities in scope must register with the BSI within three months of first or once again falling under the act (Section 33 BSIG). For companies in scope since 6 December 2025, this deadline has passed; the BSI urges them to register without delay. Registration has two steps: apply for an ELSTER organisation certificate via “Mein Unternehmenskonto” (a German tax number is required), then sign in to the BSI portal with it and submit your name and legal form, contact details including public IP address ranges, sector and entity type, the EU countries you operate in and the competent supervisory authorities. Changes must be reported without delay, within two weeks at the latest.

Risk management: ten minimum measures

Entities in scope must take appropriate, proportionate and effective technical and organisational measures and document compliance (Section 30(1) BSIG). Proportionality considers factors such as risk exposure, the entity’s size and implementation costs. The measures should reflect the state of the art and must cover at least the following (Section 30(2)):

• Policies on risk analysis and information security
• Incident handling
• Business continuity, such as backup management, disaster recovery and crisis management
• Supply chain security, including relationships with direct suppliers and service providers
• Security in the acquisition, development and maintenance of IT systems, including vulnerability handling and disclosure
• Policies and procedures to assess the effectiveness of the measures
• Basic IT security training and awareness
• Policies and processes for the use of cryptography
• Human resources security, access control and management of IT systems, products and processes
• Multi-factor or continuous authentication, secured voice, video and text communication and, where appropriate, secured emergency communication

For certain digital providers, including cloud, data centre and managed service providers, Commission Implementing Regulation (EU) 2024/2690 specifies the requirements and takes precedence (Section 30(3)).

Reporting duties with fixed deadlines

Significant security incidents must be reported to the BSI (Section 32 BSIG). An incident is significant if it has caused or can cause severe operational disruption or financial loss for the entity, or can cause considerable material or non-material damage to others (Section 2 No. 11). Reporting is staged:

The BSI says the clock starts once an employee learns of the significant incident during working hours. The BSI stresses speed over completeness; details can follow in later reports. A service provider may report for you, but responsibility for the incident and the report stays with you.

Management duties, training and fines

Management must implement the risk management measures and oversee them (Section 38(1) BSIG); the BSI says this responsibility cannot be delegated. Managers who breach this duty are liable to their entity for culpably caused damage under company law (Section 38(2)). Management must also attend regular training to identify and assess risks and risk management practices and judge their impact on the entity’s services (Section 38(3)). The act sets no interval or duration. The BSI recommends thorough initial training with regular follow-ups and complete records of dates, duration and content.

Section 65 BSIG sets the fines; the highest ranges cover, among others, breaches of the risk management, documentation and reporting duties:

Affected indirectly: when your customers fall under NIS2

Many small companies are not covered but supply entities that are, and these must address supply chain security (Section 30(2), second sentence, No. 4). The BSI clarifies that the act does not indirectly oblige all suppliers and service providers. Entities in scope must, however, bind their suppliers to corresponding security requirements and may be unable to work with every company without breaching their own duties.

Suppliers may see this as a contract clause or audit request. The BSI recommends that entities in scope agree terms with suppliers on matters such as risk management, incident handling and patch management. Showing inventoried devices, planned updates, MFA-protected accounts and tested backups makes such requests easier to answer. For SMEs, the BSI names the CyberRisikoCheck under DIN SPEC 27076 as a low-threshold check of where you stand, but says it does not achieve NIS2 compliance.

What SMEs can do in practice now

In scope or not, these steps follow the BSI’s NIS2 recommendations:

• Check and record your status: run the BSI scope check with your annual accounts and headcount to hand and file the dated result. If in doubt, take legal advice, as the BSI recommends.
• Build an inventory: the BSI says all systems, applications and data must be known to be protected. A centrally maintained device inventory is the foundation.
• Backups and recovery: the act explicitly names backup management and disaster recovery. On ransomware, the BSI stresses offline backups and asks whether restores are prepared and rehearsed.
• Multi-factor authentication: the BSI recommends MFA with suitable knowledge and possession factors. My advice: start with email, remote access and administrator accounts.
• Patch management: as the BSI describes for NIS2 entities, update all relevant systems regularly, critical flaws first, closing known weaknesses before they are exploited.
• Incident and reporting plan: decide who assesses an incident, who reports within 24 hours and how warnings are passed on. The BSI recommends internal processes that alert suitable contacts to its warnings and queries outside business hours too.
• Train management: the BSI’s management training guidance covers content and formats, from classic courses to tabletop exercises.

Much of this is everyday IT work: inventory, patching and remote maintenance run through endpoint management (explained in RMM and managed IT for SMEs), backups and restore tests in the backup strategy for SMEs, and networks and servers belong to IT infrastructure. We set your priorities together in IT consulting.