NIS2 in Germany: is your organisation affected?

Germany's NIS2 implementation act has been in force since 6 December 2025. The BSI expects organisations to assess for themselves whether they are affected. This check is an indication of whether you are likely a wichtige Einrichtung or a besonders wichtige Einrichtung, which are the German terms for an important entity and an essential entity.

Indicative only, not legal advice.

Check your organisation

Your answers stay in this browser. Submitting the form does not send them to a server, and the page does not store them.

Activity

Annex I is sectors of high criticality. Annex II is other critical sectors. If more than one activity fits, run the check again. Confirm the stricter result with the competent authority.

Size

Use annual figures in euro. Headcount is the number of employees (annual work units if you have them). Medium means 50 or more employees, or turnover and balance sheet total both above EUR 10 million. Large means 250 or more employees, or turnover above EUR 50 million and balance sheet total above EUR 43 million. Simplified: control can also arise from voting rights or the right to appoint the board, some investors at 25–50% don't count as partners, and a change of size category takes effect only after two consecutive years (Rec. 2003/361/EC Annex, Art. 3–4).

Linked and partner enterprises

Add 100 percent of a linked enterprise: a holding or control above 50 percent. Add only your share of a partner enterprise: a holding from 25 to 50 percent. A holding below 25 percent stays out of the total. This is the simple version of Recommendation 2003/361/EC. NIS2 says a public-sector shareholder does not by itself change the size test.

Country

Choose a Member State to see national notes. Austria, Belgium, Finland, Germany, Ireland, Italy, Luxembourg, the Netherlands, Poland, Slovenia and Sweden show national notes. Every other country says that national details are coming soon.

Possible national designation

Optional. Tick a box only if it might apply. The checker cannot see a Member State's list, so the result will tell you to check the designation.

Indicative result only. This is not a legal determination of your NIS2 status and not legal advice. Your status depends on national law and on any identification by your Member State. Confirm it with the competent authority or a qualified adviser.

Try the live demoBook a gap review

Install free from GitHub (self-hosted). Core is the free self-hosted edition.

Last checked: 1 November 2026.

NIS2UmsuCG and the new BSIG (BGBl. 2025 I Nr. 301)

The Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung (NIS2UmsuCG) was signed on 2 December 2025 and published as BGBl. 2025 I Nr. 301. It has been in force since 6 December 2025. Article 1 is the new BSI-Gesetz (BSIG).

Besonders wichtige vs wichtige Einrichtungen

The BSIG uses "besonders wichtige Einrichtung" for an essential entity and "wichtige Einrichtung" for an important entity (§ 28 BSIG). Large Annex I entities, and the size-independent essential cases, are the first group. Medium Annex I entities and medium or large Annex II entities are the second.

Thresholds: staff, turnover, balance sheet

The checker uses the Directive's medium and large test: 50 and 250 staff, EUR 10 million, EUR 50 million and EUR 43 million, including linked and partner figures. Simplified: control can also arise from voting rights or the right to appoint the board, some investors at 25–50% don't count as partners, and a change of size category takes effect only after two consecutive years (Rec. 2003/361/EC Annex, Art. 3–4). Confirm any extra German threshold with the BSI.

KRITIS operators and federal administration

Operators of kritische Anlagen are besonders wichtige Einrichtungen regardless of size (§ 28(1) No. 1 BSIG). Federal administration bodies are excluded from § 28 and covered by separate rules. If you have been identified as a CER critical entity, the checker treats you as essential. If you only might be identified, it tells you to check the national designation.

Registration with the BSI

Register within three months after first or again becoming a besonders wichtige or wichtige Einrichtung (§ 33(1) BSIG). Changes are due within two weeks. Confirm the portal steps with the BSI.

Reporting significant incidents to the BSI

Significant incidents go to the BSI. CERT-Bund is the national CSIRT. Section 38 BSIG requires management to implement and supervise the measures, and to attend training. The clocks are an early warning within 24 hours, a notification within 72 hours, and a final report no later than one month after the incident notification.

Next steps

Check another country. Read the NIS2 checklist for SMEs and the guide to NIS2 incident reporting deadlines. NIS2 compliance software and the self-hosted install are the product pages. Try the live demo or book a gap review.

Other country pages: Austria, Belgium, Finland, Ireland, Italy, Luxembourg, Netherlands, Poland, Slovenia, Sweden.

FAQ

When did NIS2 take effect in Germany?

The NIS2UmsuCG, BGBl. 2025 I Nr. 301, has been in force since 6 December 2025. Article 1 of that act is the new BSI-Gesetz.

Do I have to register with the BSI?

Register within three months after first or again becoming a besonders wichtige or wichtige Einrichtung (§ 33(1) BSIG). Confirm the portal steps with the BSI.

What is MUK?

MUK is Mein Unternehmenskonto, the business user account. Confirm the current registration steps with the BSI.

Are KRITIS operators automatically covered?

Operators of kritische Anlagen are besonders wichtige Einrichtungen regardless of size (§ 28(1) No. 1 BSIG). If you have been identified, the checker treats you as essential. If you only might be identified, it tells you to check the national designation.

Is this checker legal advice?

Indicative only, not legal advice.

Directive text: Directive (EU) 2022/2555 on EUR-Lex. Size test: Commission Recommendation 2003/361/EC. Agency overview: ENISA.

German sources: BGBl. 2025 I Nr. 301, BSI, in force 6 December 2025, BSI portal.