New NIS-2 Law in Germany Expands Cybersecurity Oversight and Introduces Heavy Fines

Germany is taking decisive steps to strengthen its cybersecurity framework following the rise of digital threats. Last month, the Bundestag adopted the NIS-2 Implementation Act, translating the EU NIS-2 Directive (Directive (EU) 2022/2555) into national law. Published in the Federal Law Gazette on 5 December 2025 and in force since 6 December 2025, the Act modernizes the country’s IT security legislation and broadens the range of entities subject to regulatory oversight. The Federal Office for Information Security (BSI) is tasked with supervision and enforcement under the Act, coordinating cybersecurity across federal agencies in its role as the CISO Bund. The law applies to industrial production, including electronics, machinery, vehicles, and other transport systems. Obligations generally target companies with at least 50 employees or that meet specific revenue and balance sheet thresholds. Certain sensitive sectors, such as telecommunications and digital services, are covered regardless of size. As a result, the number of regulated entities in Germany rises dramatically, from around 4,500 under previous frameworks to roughly 30,000, including many mid-sized companies that were previously outside critical infrastructure regulations. Registration and Reporting Requirements Entities within scope must register within three months with the BSI and the Federal Office for Civil Protection and Disaster Assistance (BBK). Registration requires providing company master data, designated contact points, and internal reporting structures. The law establishes a three-step incident reporting process: an initial notification within 24 hours of becoming aware of a cybersecurity incident, an update within 72 hours, and a final report within 30 days, with additional interim reports if requested. The NIS-2 Implementation Act sets binding, verifiable minimum requirements, including risk management, vulnerability and patch management, incident response planning, end-to-end logging, multi-factor authentication, and supply chain security. Industrial operators must secure control systems, manage distributed device fleets, and document supplier components. Management is explicitly responsible for oversight, decision-making, and training, embedding cybersecurity accountability at the executive level. Violations carry severe penalties. “Particularly important entities” can face fines of up to €10 million or 2% of global annual turnover, while “important entities” may incur fines up to €7 million or 1.4% of turnover. The BSI is empowered to issue binding orders, and management members may be held personally liable for failures to implement or supervise required measures. Section 38 of the Act effectively obliges management to implement cybersecurity measures, not just approve them. Section 2(13) defines “members of management bodies” as executives appointed by law, articles of association, or partnership agreements, covering executive functions but excluding supervisory board roles in two-tier structures. Integration with EU Cybersecurity Legislation The NIS-2 Directive establishes EU-wide requirements for risk management, incident reporting, and operational resilience. It applies to essential entities and mandates an “all-hazards” approach to protect against cyberattacks, technical failures, sabotage, and natural disasters. Germany’s NIS-2 Implementation Act integrates these obligations with sector-specific legislation, including the Digital Operational Resilience Act (DORA) for financial services, the Cyber Resilience Act for digital products, and the Critical Entities Resilience Directive (CER). Sector-specific laws generally take precedence where requirements overlap, ensuring legal clarity under the lex specialis principle. The EU Cyber Solidarity Act complements NIS-2 by providing operational frameworks for cross-border emergency response, including the Cybersecurity Emergency Mechanism and the European Cybersecurity Alert System. Coordination through the NIS Cooperation Group and networks such as EU-CyCLONe supports strategic and operational collaboration for large-scale incidents. Next Steps for Organizations With the NIS-2 Implementation Act now active, organizations have until April 2026 to register with the BSI and establish governance, risk-management, and reporting structures. The law raises accountability to both operational teams and executive leadership, creating a more unified, EU-aligned cybersecurity framework across Germany. As regulatory expectations tighten, organizations will need faster threat visibility and stronger security operations. Cyble, ranked the #1 Cyber Threat Intelligence Technology by Gartner Peer Insights, offers AI-native tools that help companies identify vulnerabilities, monitor new cyber threats, and strengthen resilience, critical capabilities under NIS-2. Organizations preparing for NIS-2 compliance can benefit from Cyble’s AI-powered security ecosystem and are encouraged to explore its free external threat assessment and personalized demo to understand how these capabilities support stronger, regulation-ready defenses. References: https://www.recht.bund.de/bgbl/1/2025/301/VO.html?utm_source=chatgpt.com https://www.gesetze-im-internet.de/bsig_2025/BJNR12D0B0025.html?utm_source=chatgpt.com https://digital-strategy.ec.europa.eu/en/policies/cyber-solidarity?utm_source=chatgpt.com The post New NIS-2 Law in Germany Expands Cybersecurity Oversight and Introduces Heavy Fines appeared first on Cyble.