NIS-2: duties, deadlines, and what to do now
The German NIS-2 act has been in force since December 2025, and the registration grace period ended on 31 July 2026. This page explains who is affected, what applies now, and which duties our NOC and SOC take over in daily operations.
NIS-2 is the EU directive on network and information security. Germany implemented it through the NIS2UmsuCG, in force since 6 December 2025. It obliges an estimated 30,000 companies, far beyond classic KRITIS operators: important and particularly important entities in 18 sectors, as a rule of thumb from 50 employees or 10 million euros turnover.
Am I affected?
The BSI offers an anonymous self-check: NIS-2 impact assessment (betroffenheitspruefung-nis-2.bsi.de). The result is non-binding, and the harder question usually follows it: which of the duties your organisation must cover itself and which ones a service provider can carry.
We clarify both in a free 30-minute conversation: whether you are affected, in which category, and what that means concretely for your operations. No tool, no forms, a conversation with the people who later run the systems.
Missed the registration deadline? The order matters.
The statutory registration deadline under section 33 BSIG ended on 6 March 2026, the BSI grace period on 31 July 2026. Since then, enforcement applies: failure to register is an administrative offence with fines of up to 500,000 euros. Tens of thousands of entities are still unregistered. If yours is one of them, this is the sensible order:
First, clarify your category, because it determines the duties. Second, register with the BSI immediately, late is far better than never. Third, set up the reporting chain, because the deadlines run from the incident, not from your readiness. Fourth, document your risk management measures under section 30 BSIG. We support all four steps and operate the technical part permanently.
The 24-hour reporting chain, without your own SOC
The reporting duties are the part of NIS-2 with the hardest time pressure, and they apply since the act came into force:
| Within 24 hours | Early warning of the significant incident to the BSI |
| Within 72 hours | Follow-up report with an initial assessment |
| Within one month | Final report on cause, impact and countermeasures |
Detecting an attack at 2 a.m., assessing it and reporting it within 24 hours is hardly feasible without around-the-clock operations. Exactly this is what our SOC does: continuous attack detection, qualified assessment, and the deadlines of the reporting chain as an operational process.
What our NOC and SOC cover, and what stays with you
We take over the operational duties: attack detection (including SzA for KRITIS operators), the reporting chain, monitoring, backup and recovery processes, patch and firewall operations, and the documentation that auditors ask for.
What no service provider can take off your hands: governance and responsibility of the management (section 38 BSIG makes it personal and non-delegable, including a training duty), supply chain security in your purchasing, and your internal policies. We are honest about this boundary, and it is where we work hand in hand with your management and legal advisors.
The deadlines at a glance
| 6 December 2025 | NIS2UmsuCG in force, reporting duties apply since then |
| 6 March 2026 | End of the statutory registration deadline (section 33 BSIG) |
| 31 July 2026 | End of the BSI grace period, enforcement since then |
| From December 2028 | Evidence of measures for particularly important entities on request |
| KRITIS operators | Additionally: attack detection systems and evidence audits every three years |
Frequently asked questions
Does NIS-2 apply to my company?
As a rule of thumb: yes, if your company belongs to one of the 18 sectors and has at least 50 employees or 10 million euros annual turnover. Smaller companies can also be covered, for example as part of a critical supply chain. The BSI self-check gives a first answer, a short conversation the reliable one.
The registration deadline has passed. What happens now?
Failure to register is an administrative offence with fines of up to 500,000 euros, and enforcement has been possible since 31 July 2026. Registering late is still far better than not registering: it shows willingness to comply and takes the easiest lever for fines off the table.
Is an ISO 27001 certificate enough for NIS-2?
It helps a lot, because the measures overlap widely, and it will count as evidence. It does not replace NIS-2 duties automatically: registration, the reporting chain and the management duties apply independently of any certificate.
Is the management personally liable?
Section 38 BSIG obliges the management personally to approve and supervise the risk management measures, and this duty cannot be delegated. It also requires regular training. This is why the decision about NIS-2 belongs at management level, not only in IT.
Clarify your NIS-2 status in 30 minutes
Tell us your sector and roughly your size. We will tell you whether and how you are affected, which duties our NOC and SOC can carry, and where you need management and legal instead of technology.
This page provides general information as of August 2026 and is no substitute for legal advice.