For a long time NIS2 was a "someday" topic. That's over: Germany's NIS2 implementation law (NIS2UmsuCG) has been in force since 6 December 2025. Around 30,000 companies across 18 sectors are directly affected, and many more via supply chains.
Updated 19 October 2026: This article now also covers the content of the former post "NIS2 Registration After the 31 July 2026 Deadline: Why Businesses Should Now Complete Their BSI Registration Without Delay".
Updated 7 October 2026: Clarified: the registration deadline of 6 March 2026 applied to both essential and important entities. According to the BSI, entities that are affected and not yet registered should register in the BSI portal immediately.
Note: This article is not legal advice. It frames the situation and names first steps. As of May 2026; sections on BSI registration as of 11 August 2026.
Am I even affected?
There are two categories with thresholds:
- Essential entities: from roughly 250 employees or €50M turnover and €43M balance sheet.
- Important entities: from roughly 50 employees or €10M turnover, in sectors such as logistics, machinery, food, pharma, digital services, postal/courier services and others.
Many small businesses are below these thresholds and are not directly obligated. But:
What small SMBs often overlook: the supply chain
NIS2 requires affected companies to manage the security of their supply chain. In practice that means: your larger customers pass security requirements down to you contractually, even if you formally don't fall under NIS2 yourself. "We're too small for that" is therefore rarely the whole truth.
What it's about substantively
At its core NIS2 requires appropriate risk-management measures, including:
- Risk analysis and a security concept
- Incident detection and reporting obligations for security incidents: significant incidents go to the BSI as an initial report within 24 hours and with a further report within 72 hours
- Backup, contingency and recovery management
- Supply-chain security, access control, encryption, MFA
- Management responsibility (including personal liability)
BSI registration: deadlines passed, obligation remains
Essential and important entities had to register with the BSI under § 33 BSIG by 6 March 2026. The BSI then stated, via the industry associations, that it expected outstanding registrations to be completed by 31 July 2026 at the latest. That extended deadline has passed as well. The obligation has not lapsed: it is only fulfilled once the registration has actually been made. The BSI calls on everyone affected to register in the BSI portal immediately. Do not wait for an individual letter, because the obligation applies regardless.
Anyone who, contrary to § 33 BSIG, fails to submit the required information, or does not do so correctly, completely or on time, commits an administrative offence (§ 65 (2) no. 6 BSIG). The law provides for a fine of up to €500,000 for this. The frequently cited higher ranges apply to more serious violations, such as breaches of the risk management and reporting obligations. After the deadline, the BSI told trade media that it had so far refrained from enforcement measures. Speculating on that would be a mistake: a fine does not require a security incident, and late registration ends the ongoing violation.
On top of that comes § 38 BSIG: management must implement the risk management measures, monitor their implementation and regularly attend training. If they culpably breach these duties, they are liable to their entity for the damage under the applicable rules of company law.
How to complete a late registration
Registration runs in two steps, and both need lead time:
- ELSTER business account (MUK): without a valid ELSTER certificate there is no access to the BSI portal. Experience shows that postal delivery of the activation data takes up to two weeks, so apply at www.elster.de right away.
- Registration in the BSI portal at portal.bsi.bund.de (open since 6 January 2026). Have ready: company master data and trade register number, the applicable sector or sectors, the ELSTER certificate, and the contact details of the security point of contact (SPOC), meaning a specific, reachable person and not a shared mailbox.
Typical time sinks are a missing ELSTER certificate, a wrongly selected sector (if you operate in several, state all of them) and no named SPOC. And: portal registration fulfils § 33 BSIG, but not the substantive requirements of §§ 30 to 37 BSIG. Anyone who is registered but has no tested backups, no current security concept and no MFA is still non-compliant.
The first concrete steps
- Clarify exposure: directly obligated, or required via customers in the supply chain? Take both seriously.
- Gap analysis: where do you stand today against the requirements (backups, MFA, patching, contingency plan, reporting paths)?
- Quick wins first: MFA everywhere, tested backups, a patch routine, staff awareness. That lowers risk immediately.
- Document: make measures verifiable. No documentation, no compliance.
Much of this is solid IT security that's sensible anyway. NIS2 just makes it mandatory. If you already have a clean GDPR setup, you're not starting from zero.
Conclusion
NIS2 is no reason for panic, but it is a reason to act. Even small companies should actively check their exposure, at the latest when the first big customer sends the questionnaire.
Want to know if and how NIS2 affects you? In a free initial consultation we'll frame your situation, soberly and without scaremongering.
Note: The articles on this blog are produced with the help of AI and are editorially reviewed before publication. Editorial responsibility lies with Emre Yurtbay (see the legal notice).