Cybersecurity law & regulation in Germany (2026)

Legal framework

NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (NIS2UmsuCG), which amends the BSI-Gesetz (BSIG); administered by the Bundesamt für Sicherheit in der Informationstechnik (BSI). Complemented by the KRITIS-Dachgesetz (Critical Infrastructure Resilience Act), sector rules under DORA/BaFin for finance, and the EU GDPR regime for personal-data breaches.

NIS2 & cybersecurity law in Germany

In Germany, baseline cybersecurity obligations come from the EU NIS2 Directive, transposed into national law, which sets risk-management and incident-reporting duties for essential and important entities.

Framework

the NIS2 Directive (EU) 2022/2555, transposed into national law

Approach

cybersecurity risk-management measures plus mandatory incident reporting for in-scope entities

Applies to

medium and large entities in critical sectors: energy, transport, banking, health, water, digital infrastructure, ICT and public administration

Incident reporting

an early warning within 24 hours and a full notification within 72 hours to the national CSIRT

Maximum fine

up to €10 million or 2% of global annual turnover for essential entities

Oversight

the national competent authority and CSIRT designated under NIS2

NIS2 is a directive, so Germany implements it through national law; exact scope and deadlines can vary slightly by transposition.

Key points: cybersecurity in Germany

1. 01Primary law in force

   The NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (NIS2UmsuCG) was adopted by the Bundestag on 13 November 2025 and entered into force on 6 December 2025 with no grace period, extensively amending the BSI-Gesetz (BSIG). It expands scope from roughly 4,500 KRITIS operators to about 29,500 entities across 18 sectors.

   bsi.bund.de bsi.bund.de

2. 02Competent authority and registration

   The BSI is the central supervisory and incident-reporting authority. Its national NIS2 registration and reporting portal is live since 6 January 2026, and in-scope 'important' and 'particularly important' entities must self-register with the BSI by 6 March 2026 (or within three months of becoming in scope).

   privacyworld.blog dlapiper.com

3. 03Incident reporting duties (24h / 72h / 1 month)

   For significant incidents, entities must file an early warning to BSI within 24 hours of awareness, a full incident notification within 72 hours (with an initial assessment and IOCs), and a final report within one month (or a progress report if the incident is ongoing).

   reedsmith.com gtlaw.com

4. 04Management liability and risk-management measures

   The revised BSIG imposes personal, non-waivable liability on management for approving and overseeing cybersecurity risk-management measures (Section 38 BSIG). Required measures cover risk analysis, incident handling, business continuity, supply-chain security, encryption, MFA and mandatory attack-detection systems for KRITIS operators.

   gtlaw.com bsi.bund.de

5. 05Critical-infrastructure resilience (KRITIS-Dachgesetz)

   The KRITIS-Dachgesetz (Critical Infrastructure Resilience Act) entered into force on 17 March 2026, adding physical/all-hazards resilience duties on top of NIS2 cybersecurity obligations. Operators of designated critical facilities must register with both the BBK and BSI by 17 July 2026 and are automatically 'particularly important entities' under the BSIG.

   aoshearman.com cms.law

6. 06Sectoral overlays: finance (DORA/BaFin) and data protection (GDPR)

   For the financial sector, the EU Digital Operational Resilience Act (DORA) has applied directly since 17 January 2025, with BaFin as the central ICT incident-reporting hub; BaFin repealed its parallel BAIT/VAIT/KAIT/ZAIT circulars to avoid double regulation. Separately, personal-data breaches must be notified to the competent state Data Protection Authority within 72 hours under GDPR Art. 33.

   bafin.de legal.pwc.de

NIS2 in Germany: FAQ

Timeline of decisions

1. 17 Mar 2026Law · official
   KRITIS Umbrella Act (KRITIS-Dachgesetz) enters into force

   Germany's first cross-sectoral law for the physical and organizational resilience of critical facilities, transposing the EU CER Directive (2022/2557); operators must adopt resilience plans, report incidents to BBK and BSI, and register by 17 July 2026. It complements the cyber-focused NIS2 regime with all-hazards (sabotage, natural disaster, terrorism) protection.

   Federal Government (Bundesregierung)

2. 6 Dec 2025Law · official
   NIS2 Implementation Act (NIS2UmsuCG) takes effect, overhauling the BSI Act

   Germany transposed the EU NIS2 Directive, comprehensively amending the BSIG and expanding regulated entities from roughly 4,500 to about 29,000 across 13 sectors, with management liability, 24-hour incident reporting and fines up to EUR 10 million or 2% of global turnover. The BSI registration portal opened 6 January 2026 with no general transition period.

   Bundesgesetzblatt (Federal Law Gazette)

3. 29 Oct 2023Incident
   Südwestfalen IT ransomware attack paralyzes 70+ municipalities

   A ransomware group encrypted the servers of municipal IT provider Südwestfalen IT, knocking out finance, residents' registration, vehicle and registry-office systems across more than 70 municipalities, mostly in North Rhine-Westphalia. It became one of Germany's most disruptive attacks on local-government infrastructure, underscoring KRITIS supply-chain risk.

   The Record (Recorded Future News)

4. 18 Oct 2022Incident
   BSI President Arne Schönbohm dismissed over alleged Russia ties

   Interior Minister Nancy Faeser removed the head of the Federal Office for Information Security after media allegations of links to a cybersecurity association connected to Russian intelligence; a court later found the central accusations to be unfounded. The episode triggered scrutiny of BSI's independence and leadership amid heightened post-invasion threat levels.

   Euronews

5. 8 Sept 2021Guidance · official
   Cyber Security Strategy for Germany 2021 adopted

   The Federal Cabinet adopted a five-year strategy with 44 objectives across four guidelines, replacing the 2016 strategy and emphasizing digital sovereignty, security as a shared state-business-society task, and, for the first time, transparent implementation monitoring. It frames the policy direction underpinning subsequent legislation.

   Federal Government (Bundesregierung)

6. 9 Jul 2021Incident
   Anhalt-Bitterfeld declares Germany's first 'cyber-catastrophe'

   A ransomware attack crippled the district administration serving ~157,000 residents, halting welfare payments and vehicle registration and prompting the first-ever official cyber disaster declaration in Germany. It became a defining demonstration of municipal vulnerability driving stronger KRITIS rules.

   Insurance Journal

7. 28 May 2021Law · official
   IT Security Act 2.0 (IT-SiG 2.0) enters into force

   The most comprehensive pre-NIS2 expansion of the BSIG: it introduced the 'companies in special public interest' (UBI) category, mandatory state-of-the-art attack-detection systems for KRITIS operators (applicable from May 2023), a component ban for critical components, and fines up to EUR 20 million. It significantly strengthened BSI's supervisory and enforcement powers.

   BSI

8. 29 Jun 2017Law · official
   Act implementing the EU NIS Directive proclaimed

   Germany transposed the EU's first Network and Information Security Directive (2016/1148), extending BSI oversight and creating wholly new obligations for digital service providers while building on the existing KRITIS framework. It aligned German law with the EU's first common cybersecurity baseline.

   BSI

9. 25 Jul 2015Law · official
   IT Security Act 1.0 (IT-Sicherheitsgesetz) enacted

   Germany's foundational cybersecurity statute introduced the KRITIS regime, requiring critical-infrastructure operators to implement 'state of the art' security and report significant incidents to BSI, with biennial proof of compliance (BSIG §8a). It established the regulatory architecture that all later acts build on.

   BSI

10. 20 Aug 2009Law · official
    Modernized BSI Act (BSIG) takes effect

    A new BSI Act came into force on 20 August 2009, laying the legal foundation for the BSI as it exists today and giving the office expanded powers to protect federal networks. It is the statutory basis later amended by the IT Security Acts and the NIS2 implementation.

    BSI

11. 1 Jan 1991Law · official
    Federal Office for Information Security (BSI) established

    The BSI began work on 1 January 1991 under the BSI Establishment Act, evolving from the cryptographic department of the BND intelligence service into Germany's central federal cybersecurity authority. It is the institutional cornerstone of every subsequent German cybersecurity law.

    BSI

Sources

1. 1.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2025/251205_NIS-2-Ums
2. 2.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2025/251113_NIS-2-Ums
3. 3.bsi.bund.de/EN/Das-BSI/Auftrag/Gesetze-und-Verordungen/IT-SiG/2-0/it_sig_2-0.html
4. 4.reedsmith.com/articles/germany-implements-nis2-immediate-effect-broad-scope-near-te
5. 5.dlapiper.com/en/insights/publications/2026/02/nis-2-directive-transposed-in-german
6. 6.gtlaw.com/en/insights/2025/12/nis2-in-germany-the-new-bsi-act-makes-cybersecuri
7. 7.privacyworld.blog/2025/12/germany-implements-nis2-registration-portal-will-open-on-janu
8. 8.aoshearman.com/en/insights/critical-infrastructure-new-legislation-in-germany-and-it
9. 9.cms.law/en/deu/legal-updates/kritis-ordinance-what-critical-infrastructure-op
10. 10.bafin.de/EN/die-bafin/publikationen-daten/risiken-im-fokus/Fokusrisiken_2026/R
11. 11.legal.pwc.de/en/news/articles/bafin-publishes-its-2026-risks-in-focus