NIS2 Guide 2026: Obligations, Fines, Roadmap under § 30 BSIG

Overview and in-depth reading: this guide places NIS2 in context for Germany and Austria and contains the complete 12-step roadmap. The German legal position in detail is set out in NIS2 implementation in Germany: deadlines, reporting office, evidence, the Austrian position in NIS2 Austria (NISG 2026). All articles are collected in the NIS2 topic area.

1. What is NIS2?

NIS2 is Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. As a directive, it binds companies only through national law. The transposition deadline ran until 17 October 2024 (Art. 41(1) NIS-2 Directive); for an entity's obligations, however, what counts is national entry into force.

In Germany, the BSI Act was newly enacted as Article 1 of the NIS2UmsuCG of 2 December 2025 (BGBl. 2025 I No. 301), entered into force on 6 December 2025 (Art. 30) and was last amended by Art. 8(1) of the Act of 23 July 2026 (BGBl. 2026 I No. 226). According to the BSI, around 29,500 particularly important and important entities have statutory obligations for the first time. In Austria, the NISG 2026 (BGBl. I No. 94/2025) applies; its §§ 2 to 45 have been in force since 1 October 2026 (§ 51(2)).

In substance, NIS2 follows four lines, given here with the German references: risk management with ten minimum areas (Art. 21 NIS-2 Directive, § 30 BSIG), responsibility of management (Art. 20, § 38 BSIG), reporting obligations towards the joint reporting office of the BSI and the BBK (Art. 23, § 32 BSIG) as well as registration with the BSI and supervision (§§ 33, 61, 62, 65 BSIG). The NISG 2026 governs the same lines in Austria in §§ 32, 31, 34 and 29.

2. Who is affected by NIS2?

Classification under § 28 BSIG works in two stages: the entity must belong to a type of entity listed in Annex 1 or 2 BSIG and reach the size threshold, that is, as an important entity at least 50 employees or annual turnover and an annual balance sheet total each exceeding EUR 10 million (§ 28(2) no. 3) and, as a particularly important entity in Annex 1, at least 250 employees or annual turnover over EUR 50 million and an annual balance sheet total over EUR 43 million (§ 28(1) no. 4). Particularly important regardless of size are operators of critical installations, qualified trust service providers, TLD name registries and DNS service providers (§ 28(1) no. 1 and 2); important regardless of size are trust service providers and smaller telecommunications providers (§ 28(2) no. 1 and 2). Germany speaks of particularly important and important entities; "essential entity" is the term used by the Directive and by Austrian law (§ 24 NISG 2026). Size is determined under SME Recommendation 2003/361/EC; partner and linked enterprises are in principle added in (§ 28(4) sentence 1 BSIG), unless the enterprise is independent of them in the design and operation of its IT systems (sentence 2). For critical installations, the KRITIS Umbrella Act has applied since 17 March 2026 (BGBl. 2026 I No. 66); the ordinance under § 4(3) and § 5(1) KRITISDachG is still missing, and until then the thresholds under § 66 BSIG follow from the BSI-KritisV, for example 30,000 inpatient cases per year for hospitals (§ 6(4) in conjunction with Annex 5 Part 3 BSI-KritisV). Classification table and sector lists: NIS2 implementation in Germany.

Practical tip: the BSI does not notify entities that they are covered; the assessment lies with the entity. A first entry point is the NIS2 Readiness Check; smaller entities will find the classification in more depth in NIS2 for small enterprises with 50 to 100 employees.

3. The 10 mandatory measures under § 30 BSIG

§ 30 BSIG transposes Art. 21 NIS-2 Directive. Particularly important and important entities must take appropriate, proportionate and effective technical and organisational measures to avoid disruptions to their IT systems and to keep the impact of security incidents low (§ 30(1) sentence 1). The measures are based on an all-hazards approach and comprise at least:

Proportionality: what matters is risk exposure, the size of the entity, implementation costs and the likelihood, severity and impact of incidents (§ 30(1) sentence 2). "Across the board" does not appear in the Act; for no. 10 as well, the risk assessment decides. Compliance must be documented (§ 30(1) sentence 3). For DNS, TLD, cloud, data centres, CDN, MSP, MSSP, online marketplaces, search engines, social networks and trust services, Implementing Regulation (EU) 2024/2690 takes precedence (§ 30(3) BSIG).

In-depth reading: the overview table of all ten obligations, § 30 BSIG with ISO 27001 mapping, the glossary entry § 30 BSIG and the seven quick wins for SMEs.

4. Deadlines 2024–2027

The registration deadline is not a single calendar date; it runs for each entity from the point at which it qualifies as an entity. For entities already covered, the BSI points out that it has expired. The reporting obligation applies at the earliest from the point at which the reporting channel has been set up (§ 32(1), last sentence, BSIG). Transition and evidence are explained in NIS2 implementation in Germany: deadlines, reporting office, evidence.

5. Fines and management liability (§ 38 BSIG)

5.1 Fines against the entity (§ 65 BSIG)

In Germany, fixed maximum amounts apply; the turnover-based variant applies only where total turnover exceeds EUR 500 million. The rule "whichever is higher" comes from Art. 34 of the Directive and applies in Austria (§ 45 NISG 2026), not in Germany.

Total turnover is worldwide turnover in the financial year preceding the decision (§ 65(8)). Offences subject to fines include missing measures and documentation (§ 65(2) no. 2 and 3), missing or late reports (no. 4 and 5) and registration details (no. 6, up to EUR 500,000, § 65(5) sentence 1 no. 5). The Fine Calculator gives an order of magnitude.

5.2 Management obligations under § 38 BSIG

• § 38(1): management must implement the measures under § 30 and oversee their implementation. "Approve" is the wording of Art. 20 of the Directive, not of § 38.
• § 38(2): in the event of a breach of duty, it is liable to its own entity for culpably caused damage under the company law of the legal form, so for a GmbH under GmbH law; only where that law contains no rule, under the BSIG. This is internal liability, not liability towards third parties.
• § 38(3): management must regularly take part in training.

For particularly important entities, the BSI can order audits that also cover the training obligation under § 38(3) (§ 61(1)); for important entities, where facts justify the assumption that they do not implement their obligations, or do not implement them correctly (§ 62). The resolution, status reports and records of participation therefore belong in the file. For management, the Cybersecurity e-learning has its own path with six chapters in around 35 minutes. D&O questions are covered in § 38 BSIG: management liability and D&O insurance; terms are explained in the glossary entries § 38 BSIG and Managing director liability. The offences subject to fines and the management obligations in detail are set out in NIS2 implementation in Germany under Fines and personal liability and § 38 BSIG: management obligations.

6. 12-step roadmap for NIS2 implementation

For medium-sized entities with 50 to 250 employees and no dedicated CISO function. As a planning assumption, four to six months are realistic. The weeks are practice rhythms; by law, only the registration and reporting deadlines run.

1. Scoping (week 1): type of entity under Annex 1 or 2, size under § 28(4) BSIG including linked enterprises, exception for IT independence, special regimes under § 28(5) and (6). Classify Austrian companies separately under §§ 24 and 25 NISG 2026.
2. Registration (week 2): in Germany via the joint registration facility of the BSI and the BBK, in two stages via "Mein Unternehmenskonto" and the BSI portal (§ 33 BSIG). In Austria with the Cybersecurity Authority (§ 29 NISG 2026).
3. Gap analysis (weeks 3–4): current state against the ten areas of § 30(2) BSIG.
4. Management resolution and training (week 4): management resolution as evidence of its duty to implement and oversee (§ 38(1)), first training under § 38(3), both documented.
5. ISMS build (weeks 5–10): policy, risk-management process, risk register, roles. In-depth reading: ISMS under NIS2 in ten weeks, risk-management template under Art. 21, glossary ISMS.
6. Incident handling (weeks 8–10): classification under § 2 no. 11 BSIG, reporting chain for 24 hours, 72 hours and one month to the joint reporting office of the BSI and the BBK (§ 32 BSIG), for an ongoing incident a progress report first instead of the final report (§ 32(2) BSIG), availability at weekends too. Where personal data are involved, check in parallel the notification to the data protection supervisory authority, without undue delay and where feasible within 72 hours (Art. 33 GDPR).
7. Business continuity (weeks 10–14): business impact analysis, recovery objectives, backup, crisis management (§ 30(2) no. 3). In-depth reading: BCM under NIS2, disaster recovery plan template.
8. Supply chain (weeks 10–16): record and classify ICT service providers, adjust contracts (§ 30(2) no. 4). In-depth reading: NIS2 supply chain security, supplier audit questionnaire.
9. Technical measures (weeks 12–20): MFA by risk, cryptography concept, authorisations, logging, patch management (§ 30(2) no. 5, 8, 9, 10).
10. Training (weeks 14–20): awareness for employees (§ 30(2) no. 7), for example with the Cybersecurity e-learning, regular training of management (§ 38(3)).
11. Effectiveness assessment (weeks 20–24): internal audits, management review (§ 30(2) no. 6).
12. Continuous improvement: regular reviews, annual risk assessment, adaptation to new ordinances and determinations of the BSI.

Documentation with templates: the NIS2 Kit contains 72 editable documents (51 Word, 19 Excel, 2 PowerPoint) for these steps, from the scope assessment to the reporting templates for the reports to the BSI and the BBK after 24 hours, 72 hours and one month (in the version for Austria, to the CSIRT), as a version for Germany or for Austria. Basic with 66 documents EUR 990, Plus with training pack EUR 1,390, Complete with e-learning EUR 1,690, net, one-off, with 12 months of legal-status updates. Standardised documentation, not legal advice in the individual case. The NIS2 templates overview shows which template belongs to which obligation.

7. The most common NIS2 implementation mistakes

1. "We're below the threshold", without a group check. Linked enterprises are in principle counted (§ 28(4) BSIG); a subsidiary with 30 employees can be covered in this way, unless it operates its IT independently.
2. ISO 27001 certification is treated as NIS2 compliance. The BSI disagrees; the gaps are set out in the section NIS2 and ISO 27001.
3. Management delegates everything to IT. § 38(1) BSIG obliges management itself to implement and oversee.
4. Suppliers are not assessed. § 30(2) no. 4 BSIG requires supply chain security; the depth depends on how critical the service is.
5. The reporting deadline is underestimated. The 24 hours for the early first report to the joint reporting office of the BSI and the BBK run from becoming aware (§ 32(1) no. 1 BSIG), at weekends too. Details: NIS2 reporting channels, glossary Incident (NIS2) and Significant Incident.
6. The documentation is missing. § 30(1) sentence 3 BSIG expressly requires it; every measure needs a concept and evidence of implementation.
7. Registration is forgotten. It is a separate obligation under § 33 BSIG and subject to fines (§ 65(2) no. 6).

8. NIS2 vs. ISO 27001 — what covers what?

The BSI is clear: certification under ISO/IEC 27001 does not automatically mean that all requirements under § 30 BSIG are met. As a basis, it is nonetheless valuable.

Conclusion: ISO 27001 covers most of the areas of measures but does not replace NIS2. The obligations of §§ 32, 33 and 38 BSIG are missing, and scope and risk treatment have to be adjusted. Without certification, NIS2 can also be implemented directly under the BSIG. The certification route is described in NIS2 and ISO 27001: 12-month path.

9. Sector practice: NIS2 in different industries

Healthcare: hospitals with 30,000 or more inpatient cases per year operate a critical installation under the BSI-KritisV and are particularly important regardless of size (§ 28(1) no. 1 BSIG), with the evidence obligation under § 39. Vis-à-vis licensed hospitals that are particularly important entities without a critical installation, the BSI can order evidence at the earliest five years after entry into force, unless an ordinance specifies an earlier date (§ 61(3) sentence 5). More: NIS2 in healthcare.

Energy supply: for operators of energy supply networks, energy installations and digital energy services subject to §§ 5c to 5e EnWG, §§ 30, 31, 32, 35, 36, 38, 39, 61 and 62 BSIG do not apply (§ 28(5) sentence 1 no. 2 BSIG); the EnWG is decisive. Exceptions apply to further critical installations or activities (sentence 2) and to energy installations as an ancillary activity (sentence 4). More: NIS2 in energy supply.

Mechanical engineering: it is listed in Annex 2 BSIG under manufacturing; manufacturers with 50 or more employees, or with turnover and a balance sheet total each exceeding EUR 10 million, are important entities. Practical priorities are network segmentation, remote maintenance and the supply chain. More: NIS2 in mechanical engineering.

IT service providers and cloud: cloud computing services and managed service providers belong to Annex 1 and are covered from the size thresholds; they are particularly important regardless of size where they operate a critical installation, for example a data centre or a server farm above the thresholds of the BSI-KritisV (§ 28(1) no. 1 BSIG). Also covered regardless of size are DNS, TLD, trust services and telecommunications providers (§ 28(1) and (2) BSIG). For cloud computing services, data centre services, MSP and MSSP as well as for DNS, TLD and trust services, Implementing Regulation (EU) 2024/2690 takes precedence (§ 30(3)). Cloud, data centre, MSP, MSSP, DNS and TLD providers are in addition subject to central EU competence according to the location of their main establishment (§ 60(1)) and to the special registration obligation (§ 34(1)). More: NIS2 for cloud providers and SaaS providers.

Further sectors: transport and logistics, water and waste as well as banks and financial service providers. For financial entities under the DORA Regulation (EU) 2022/2554, §§ 30, 31, 32, 35, 36, 38 and 39 BSIG do not apply (§ 28(6) no. 1); for operators of public telecommunications networks and providers of publicly available telecommunications services, these provisions likewise do not apply under § 28(5) sentence 1 no. 1 BSIG.

10. Example scenarios for classification

The three constellations are constructed examples, not real cases. They show the assessment route and do not replace an assessment in the individual case.

Scenario 1: mechanical engineering company with 180 employees in Germany

Mechanical engineering belongs to Annex 2, and 180 employees are above 50: important entity (§ 28(2) no. 3 BSIG). Even a group with more than 250 employees does not make it particularly important, because mechanical engineering is not an Annex 1 sector. Priorities: registration, assessment of the platform provider for networked production, network segmentation, management resolution and training.

Scenario 2: hospital with 35,000 inpatient cases

Above the threshold of the BSI-KritisV, the hospital operates a critical installation and is a particularly important entity (§ 28(1) no. 1 BSIG). ISO 27001 certification helps but does not cover reporting, registration and management obligations. Priorities: readiness for the early first report to the joint reporting office of the BSI and the BBK within 24 hours, an inventory of medical technology, evidence under § 39(1) BSIG every three years.

Scenario 3: food manufacturer in Germany and Austria

An industrial food manufacturer with 120 employees belongs to Annex 2 BSIG and is an important entity. Its Austrian sister company is classified under the NISG 2026, where under § 25(1) NISG 2026 Recommendation 2003/361/EC applies and the data of partner and linked enterprises are in principle included, unless the company is organisationally, technically and operationally independent in respect of its network and information systems (§ 25(4) NISG 2026). The German company registers with the BSI and reports to the joint reporting office of the BSI and the BBK. If the Austrian company is then an important entity (§ 24(2) NISG 2026), it registers with the Cybersecurity Authority (§ 29 NISG 2026) and reports to the competent CSIRT (§ 34 NISG 2026).

11. 6 NIS2 myths in Germany and Austria

Myth 1: "We are not KRITIS — therefore NIS2 does not apply"

Wrong. Operators of critical installations are only one group. § 28 BSIG covers all entities in Annexes 1 and 2 from the size thresholds. KRITIS is a subset, not a synonym.

Myth 2: "Compliance is owned by the IT department"

Wrong. IT implements, but management is responsible (§ 38(1) BSIG) and is liable to its own entity for a culpable breach of duty (subsection 2). In Austria, the management bodies must ensure and supervise compliance (§ 31 NISG 2026).

Myth 3: "ISO 27001 is automatically enough"

Wrong. Reporting, registration and management obligations are missing from the standard; details in the section NIS2 and ISO 27001.

Myth 4: "The 24-hour report only applies to large incidents"

Wrong. The early first report to the joint reporting office of the BSI and the BBK is tied to the significant security incident under § 2 no. 11 BSIG: an incident that has caused or can cause severe operational disruption or financial losses, or that can cause considerable damage to others. The potential alone is enough; an ordinance under § 56(5) can specify the term in more detail.

Myth 5: "Nothing changes in an acquisition"

Wrong. A transaction can shift the type of entity and its size (§ 28(1), (2) and (4) BSIG). An entity that thereby qualifies as an entity for the first time or again registers with the BSI within three months (§ 33(1)); changes to an existing registration must be submitted to the BSI within two weeks (§ 33(5)).

Myth 6: "Cloud providers are only processors"

Wrong. Cloud computing services are a type of entity in Annex 1; from the size thresholds, the providers have their own NIS2 obligations, independently of Art. 28 GDPR. The customer must in addition manage its supply chain itself (§ 30(2) no. 4 BSIG); a data processing agreement does not replace that.

Common denominator: all six myths treat NIS2 as an IT task. In reality it is a governance task of management.

12. NIS2 in Germany and Austria — status 2026

Germany: the BSI Act has applied since 6 December 2025; the BSI is the central body for information security (§ 1 BSIG). Details: NIS2 implementation in Germany: deadlines, reporting office, evidence.

Austria: as of 1 October 2026, the NISG 2026 replaced the NISG 2018 (§ 51(2)). The competent authority is the Federal Office for Cybersecurity, an authority directly subordinate to the Federal Minister of the Interior and based in Vienna (§§ 3a and 3b(3)). Significant incidents go to the competent sector-specific or national CSIRT (§ 34(2)). More: NIS2 Austria (NISG 2026).

The point-by-point comparison is shown in NIS2 implementation in Germany.