WONE Global's guide to Germany records these changes under data protection. Each statement below has been checked against the source it links to.
The BSI Act places implementation, oversight and training duties on the management of particularly important and important entities.
Content of the duties is set out in § 38 BSIG; detail not reviewed for this record beyond the section heading.
Bundesministerium der Justiz und für Verbraucherschutz / Bundesamt für Justiz (gesetze-im-internet.de) · BSIG – nichtamtliches Inhaltsverzeichnis ↗ Checked against an official source · Not yet professionally reviewed · checked 18 October 2026
Maximum fines for core NIS2 breaches are EUR 10 million or 2% of worldwide turnover for particularly important entities, and EUR 7 million or 1.4% of worldwide turnover for important entities.
Turnover-based caps apply where the undertaking's worldwide turnover exceeds EUR 500 million; covers the offences listed in § 65(5) sentence 1 no. 1 BSIG.
Bundesministerium der Justiz und für Verbraucherschutz / Bundesamt für Justiz (gesetze-im-internet.de) · § 65 BSIG – Bußgeldvorschriften ↗ Checked against an official source · Not yet professionally reviewed · checked 18 October 2026
Under § 28 BSIG, an entity in an Annex 1 sector is a particularly important entity (besonders wichtige Einrichtung) if it has at least 250 employees, or annual turnover above EUR 50 million and a balance sheet total above EUR 43 million.
Operators of critical installations, qualified trust service providers, TLD registries and DNS service providers are particularly important regardless of size; telecoms providers qualify from 50 employees or turnover and balance sheet each above EUR 10 million.
Bundesministerium der Justiz und für Verbraucherschutz / Bundesamt für Justiz (gesetze-im-internet.de) · § 28 BSIG – Besonders wichtige Einrichtungen und wichtige Einrichtungen ↗ Checked against an official source · Not yet professionally reviewed · checked 18 October 2026
Germany's NIS2 implementation act (NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz) was promulgated on 5 December 2025 and entered into force on 6 December 2025, with the BSI as the competent supervisory authority for in-scope entities.
Entities in the sectors listed in Annexes 1 and 2 of the BSI Act (BSIG) that meet the size thresholds, plus certain entity types regardless of size.
Bundesamt für Sicherheit in der Informationstechnik (BSI) · Fragen und Antworten zu NIS-2 ↗ Checked against an official source · Not yet professionally reviewed · checked 18 October 2026
Under § 28 BSIG, an entity in an Annex 1 or Annex 2 sector is an important entity (wichtige Einrichtung) if it has at least 50 employees, or annual turnover and balance sheet total each above EUR 10 million, and is not a particularly important entity.
Trust service providers are important entities regardless of size. Headcount and turnover are counted using EU SME Recommendation 2003/361/EC (per BSI FAQ).
Bundesministerium der Justiz und für Verbraucherschutz / Bundesamt für Justiz (gesetze-im-internet.de) · § 28 BSIG – Besonders wichtige Einrichtungen und wichtige Einrichtungen ↗ Checked against an official source · Not yet professionally reviewed · checked 18 October 2026
Significant security incidents must be reported to the joint BSI and BBK reporting office with an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report no later than one month after the notification.
Particularly important and important entities. An intermediate report is due only on BSI request; a progress report replaces the final report while an incident is ongoing.
Bundesministerium der Justiz und für Verbraucherschutz / Bundesamt für Justiz (gesetze-im-internet.de) · § 32 BSIG – Meldepflichten ↗ Checked against an official source · Not yet professionally reviewed · checked 18 October 2026
Particularly important and important entities must register with the BSI no later than three months after they first (or again) meet the criteria, giving details including legal form, register number, contact details, public IP address ranges, sector and the EU states where they provide services.
Registration is made through the joint BSI and BBK portal.
Bundesministerium der Justiz und für Verbraucherschutz / Bundesamt für Justiz (gesetze-im-internet.de) · § 33 BSIG – Registrierungspflicht ↗ Checked against an official source · Not yet professionally reviewed · checked 18 October 2026
This is a summary of the rule as published, not advice on how it applies to you. The WONE Global Partner for this service in Germany can advise on that.
