If your company operates in Germany
This page is not legal advice. It sets out what the statute and the BSI’s own FAQ say, with a source for every claim, so you can ask a lawyer better questions. Statute text is German; translations and paraphrases are ours and the German text governs. Read against the BSIG as in force since 6 December 2025, and the BSI’s general NIS-2 FAQ, in October 2026.
The short version
Section titled “The short version”- The law follows establishment in Germany, not your parent company’s headquarters. The BSI is the competent authority for covered entities “established in the Federal Republic of Germany” (§ 59 BSIG). A German subsidiary of a foreign group can be covered.
- Size is counted group-wide. Headcount, turnover and balance sheet total include partner and affiliated companies, including those outside Germany and the EU, unless the entity is genuinely independent in how its IT systems and processes are run (§ 28 (4) BSIG; BSI FAQ).
- Nobody tells you. You assess whether you are covered yourself; the BSI does not notify you.
- There is no general transition period. Registration is due within three months of becoming covered; risk management and incident reporting apply from the start (BSI FAQ).
- Some regulated sectors are exempt from most of these duties — financial entities under DORA, telecoms, energy. See “Exemptions for regulated sectors” below.
- Grundschutz is not mandatory. The law requires a set of risk management measures. IT-Grundschutz, ISO 27001 and other frameworks are ways to build toward them, not substitutes for checking against the statute.
Are we covered?
Section titled “Are we covered?”Are we established in Germany?
Section titled “Are we established in Germany?”§ 59 BSIG makes the BSI the competent authority for particularly important and important entities that are established in Germany, and for operators of critical facilities whose facilities are in Germany. The BSIG text does not define “established” further. Whether a branch, a representative office or a German-registered subsidiary counts is a question for counsel, not something this page can settle.
Two things are clearer:
- Operators of critical facilities (KRITIS) stay in scope regardless of where their headquarters are, according to the BSI FAQ.
- Certain digital service types follow a separate rule (§ 60 BSIG): DNS service providers, top-level domain registries, domain name registry service providers, cloud computing and data centre providers, content delivery networks, managed service providers, managed security service providers, online marketplaces, search engines and social network platforms. For these, the BSI is only competent if the company’s main establishment in the EU is in Germany — or, if it has no establishment in the EU but offers services here, if the representative it must name is established in Germany. The BSI may also declare itself competent if no representative was named.
We found nothing in the statute that brings an entity under the BSIG merely because it sells to customers in Germany from abroad, outside those § 60 service types. If that is your situation, ask a lawyer, and check the NIS2 law of the EU country where you are established.
Does our size and sector qualify?
Section titled “Does our size and sector qualify?”Two categories, by sector and size (§ 28 BSIG):
| Category | Employees | or annual turnover | and annual balance sheet total | Sector |
|---|---|---|---|---|
| Particularly important entity (besonders wichtige Einrichtung) | 250 or more | over €50 million | over €43 million | Annex 1 |
| Important entity (wichtige Einrichtung) | 50 or more | over €10 million | over €10 million | Annex 1 or 2 |
A few entities are covered regardless of size: operators of critical facilities, qualified trust service providers, top-level domain registries and DNS service providers (all particularly important), and non-qualified trust service providers (important). Telecommunications providers have their own thresholds (§ 28 (1) no. 3 and (2) no. 2).
Sectors in Annex 1: energy; transport and traffic; finance; health; water; digital infrastructure; space. Added in Annex 2: postal and courier services; waste management; production and trade of chemicals; food; manufacturing; digital service providers; research. Each sector breaks down into specific entity types — check the annexes themselves, because the entity type is what decides, not the industry label.
An activity that is negligible relative to your overall business can be disregarded when assigning an entity type (§ 28 (3)).
How the group counts
Section titled “How the group counts”This is where foreign-owned companies most often get surprised.
- Size is computed under the EU Commission Recommendation 2003/361/EC (without Article 3(4) of its annex). Partner and affiliated companies are added in.
- The BSI FAQ confirms affiliated companies outside Germany and outside the EU are included.
- The only way out is § 28 (4) sentence 2: an entity is not aggregated with its group if, given the legal, economic and actual circumstances, it is independent in the nature and operation of its IT systems, components and processes. Shared IT with a parent points the other way.
- If both parent and subsidiary fall within an entity type and meet the thresholds together, both are covered and both are subject to §§ 30 ff. (BSI FAQ), unless the independence exception above applies in the individual case.
Sources: § 28 BSIG, BSI NIS-2 FAQ (German).
Exemptions for regulated sectors
Section titled “Exemptions for regulated sectors”Meeting the size and sector criteria does not always mean the full set of duties applies. Under § 28 (5)–(7) BSIG, several provisions do not apply to certain regulated entities:
- Financial entities within the meaning of Article 2(2) of Regulation (EU) 2022/2554 (DORA): credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, trading venues, central counterparties, central securities depositories, insurance and reinsurance undertakings and insurance intermediaries, pension funds, fund managers, credit rating agencies and the other types listed in Article 2(1)(a)–(t) DORA. The exemption also covers undertakings to which DORA applies by virtue of § 1a (2) and (2a) of the German Banking Act (KWG) or § 293 (5) of the Insurance Supervision Act (VAG). For them, §§ 30, 31, 32, 35, 36, 38 and 39 BSIG do not apply (§ 28 (6) no. 1).
- Operators of public telecommunications networks or services, and operators of energy networks, plants or digital energy services that are subject to §§ 5c–5e of the Energy Industry Act (EnWG). For them, §§ 30, 31, 32, 35, 36, 38, 39, 61 and 62 do not apply (§ 28 (5)). This does not cover other critical facilities they operate or other activities that fall under Annex 1 or 2, and it does not apply where operating the energy plant is only an ancillary activity relative to the entity’s business as a whole (§ 28 (5) sentences 2–4).
- The German telematics infrastructure operators named in § 28 (6) no. 2.
Operators of critical facilities are also relieved of the reporting duty in § 32 insofar as they run a facility for a financial entity of this kind (§ 28 (7)).
Two limits of the financial-entity exemption. ICT third-party service providers (Article 2(1)(u) DORA) are not “financial entities” within Article 2(2), so a provider of IT or cloud services to banks is not exempt on that basis alone. And DORA itself does not apply to some of the entities in its list (Article 2(3), for example very small pension schemes and small insurance intermediaries); the BSIG text does not say whether they still count for this exemption.
The statute’s lists do not mention the registration duty (§ 33). This page does not assess which duties apply to you instead, or whether registration is still required. Ask counsel which regime governs you.
Sources: § 28 (5)–(7) BSIG, Regulation (EU) 2022/2554, Article 2 (both German).
What is due, and when
Section titled “What is due, and when”| Duty | What the law says | Source |
|---|---|---|
| Register with the BSI | Within three months of first (or again) becoming a particularly important or important entity. Changes to registered details within two weeks. Registration goes through a portal set up by the BSI. | § 33 (1), (5) BSIG |
| Risk management measures | Appropriate, proportionate and effective technical and organizational measures covering at least ten listed areas (risk analysis and IT security policies, incident handling, business continuity, supply chain security, secure acquisition, development and maintenance including vulnerability handling, measuring effectiveness, basic training, cryptography, personnel security and access control, multi-factor authentication and secure communications). Compliance must be documented. | § 30 (1), (2) BSIG |
| Report significant incidents | Early warning within 24 hours of becoming aware; incident report within 72 hours; final report within one month of that. The duty applies at the earliest once the reporting channel has been set up. | § 32 (1) BSIG |
| Management duties | The management must implement the § 30 measures and oversee their implementation, and must take part in training regularly. | § 38 (1), (3) BSIG |
| Proof, on request | Evidence of compliance is required when the BSI orders it. It can be documentation, audit reports or certifications. Operators of critical facilities have separate, regular proof duties (§ 39). | BSI FAQ; § 39 BSIG |
Whether you are covered is your own assessment. The BSI does not notify anyone (BSI FAQ), but offers a non-binding self-check tool.
Outsourcing does not move the responsibility. According to the BSI FAQ, an entity that has handed its IT to external providers remains responsible and must make sure the providers implement the requirements and that incidents are reported; contracts alone are not enough.
Sources: §§ 30, 32, 33, 38 BSIG, BSI NIS-2 FAQ (German).
What a violation costs
Section titled “What a violation costs”Fines depend on the violation and on the category (§ 65 BSIG). The amounts are maxima (“up to”).
| Violation | Particularly important entity | Important entity |
|---|---|---|
| Not taking, or not documenting, the § 30 risk management measures; missing, incorrect, incomplete or late incident reports (§ 32); certain notices to service recipients (§ 35 (2)) | up to €10 million | up to €7 million |
| Failing to register or to submit registration details correctly and on time (§§ 33, 34) | up to €500,000 | |
For a particularly important or important entity whose group turnover worldwide exceeds €500 million, the cap for the first row can instead be 2 percent (particularly important) or 1.4 percent (important) of that turnover (§ 65 (6), (7)). “Turnover” here means the worldwide turnover of the company group the entity belongs to, and it may be estimated (§ 65 (8)). The statute says the fine “may” reach these amounts; it does not say every violation will.
Management liability is separate: breaching the § 38 duties makes the management liable to its own entity for culpably caused damage, under the company law that applies to the entity’s legal form (§ 38 (2) BSIG). The BSIG creates its own liability only if company law provides none. See the German page for executives for the GmbH and AG rules.
Source: § 65 BSIG (German).
Where Grundschutz++ fits
Section titled “Where Grundschutz++ fits”It is not required. The BSI says in its FAQ that IT-Grundschutz is not mandatory for everyone covered by NIS2. An existing Grundschutz-based management system can be a valuable foundation, but it has to be checked against the statutory catalog of measures in § 30 and supplemented where needed. The same applies to ISO 27001: a certification can make the proof easier, and a company certification alone does not meet all requirements of the law.
What it is good for. § 30 says the measures should follow the state of the art and take relevant European and international standards into account. Grundschutz++ is a structured, public, machine-readable catalog of security requirements with a stated obligation level (MUSS/SOLLTE/KANN) for each. If you need to show how you derived your measures, a recognized catalog is a defensible starting point. It does not tell you whether you are covered, and following it does not by itself satisfy § 30.
This site renders the catalog readably and is independent and not an official BSI offering. The requirements themselves are in German for now: browse the catalog.
What we have not settled
Section titled “What we have not settled”- Whether a branch or representative office in Germany counts as “established” under § 59.
- How the NIS2 laws of other EU countries apply if you operate in several of them. The BSI FAQ says the BSIG does not require you to merge different national requirements into one management system, and leaves that to you.
- The exact reporting channel and its start date for § 32. The statute ties the duty to the channel being set up; check the BSI’s current notices.
Sources
Section titled “Sources”- BSIG, as in force since 6 December 2025 — §§ 28, 30, 32, 33, 34, 38, 59, 60, 65 and Annexes 1 and 2 (German)
- BSI: NIS-2 FAQ (German)