NIS2UmsuCG

The German NIS2 implementation act, in force since 6 December 2025

26 April 2026 · Category: NIS2 · Compliance-Kit

TL;DR

The Act Implementing the NIS2 Directive (Directive (EU) 2022/2555) (NIS2 Implementation and Cybersecurity Strengthening Act, NIS2UmsuCG) was adopted by the Bundestag on 13 November 2025, approved by the Bundesrat on 21 November 2025 and has been in force since 6 December 2025 (BGBl. 2025 I Nr. 301). It amends the German BSI Act (BSIG) (Act on the Federal Office for Information Security) and implements the EU NIS2 Directive 2022/2555.

What is the NIS2UmsuCG?

The most important changes introduced by the NIS2UmsuCG:

§ 28 BSIG (new): definition of particularly important and important entities (around 29,500 entities in Germany, according to the BSI)
§ 30 BSIG (new): 10 areas of mandatory measures
§ 32 BSIG (new): reporting obligations 24 h / 72 h / 1 month
§ 33 BSIG (new): obligation to register with the BSI (no later than three months after the entity status arises; BSI: the statutory registration deadline has already expired)
§ 38 BSIG (new): management obligations plus personal internal liability (subsection (2))
§ 65 BSIG (new): fines of up to EUR 10 million / EUR 7 million

Germany and Austria: two national implementations

The NIS2UmsuCG is exclusively the German implementation of the NIS2 Directive (an amendment of the BSIG). Austria has implemented the NIS2 Directive not through the BSIG but through a separate act: the NISG 2026 (Austrian Network and Information Systems Security Act 2026, BGBl. I Nr. 94/2025). Because both are based on the same EU directive, the substantive obligations are largely identical; the provisions and the competent authorities, however, differ:

Germany – BSIG, authority: BSI (Federal Office for Information Security): risk management § 30, reporting obligations § 32 (24 h / 72 h / 1 month to the joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK)), registration § 33, governance and management liability § 38, fines § 65 (up to EUR 10 million or 2% for particularly important entities, up to EUR 7 million or 1.4% for important entities).
Austria – NISG 2026, authority: Cybersecurity Authority (Cybersicherheitsbehörde, Austria; Federal Office for Cybersecurity): risk management § 32, reporting obligations § 34 (24 h / 72 h / 1 month to the competent CSIRT), registration § 29, governance § 31, administrative penalties § 45 (up to EUR 10 million or 2% for essential entities, up to EUR 7 million or 1.4% for important entities).

Practical example

Key points according to the BSI on the entry into force (press release of 5 December 2025):

Companies must check for themselves whether they are covered — what matters is the sector and the statutory thresholds for employees, turnover and balance sheet (§ 28 BSIG)
Three core obligations of entities covered: registration with the BSI, reporting of significant security incidents, implementation and documentation of risk-management measures
Operators of critical installations (KRITIS) automatically count as particularly important entities (§ 28(1) BSIG)

Frequently asked questions

When is the BSI registration deadline?

No later than three months after the entity status arises (§ 33(1) BSIG) — the deadline therefore does not run from a single calendar date. The BSI points out that the statutory registration deadline has already expired. Late registration should be made up immediately.

What transitional periods are there?

The Act contains no general grace period for implementation: since entry into force on 6 December 2025, the BSIG obligations have applied in accordance with the deadlines laid down in it (for registration, see above). Individual transitional rules concern special cases, e.g. the registration of critical installations (§ 66 BSIG). No official date for the start of supervisory or fining practice is apparent.

How does it differ from the old BSIG?

Extended scope of application (according to the BSI, from about 4,500 previously regulated organisations to around 29,500 entities), stricter obligations in 10 areas, internal liability of management, reporting obligations 24 h / 72 h / 1 month, BSI registration.