NIS2 in Germany — from the BSIG to your evidence.

Find out whether you're in scope, and at which tier — before anything else gets registered or reported.

Register with the competent national authority inside the statutory deadline.

Put all ten statutory minimum measures in place — from risk analysis to multi-factor authentication — each backed by dated evidence, not a checkbox.

Report incidents through the correct channel, at every stage the law requires: early warning, formal report, and follow-up.

Competent authority

Bundesamt für Sicherheit in der Informationstechnik (BSI) — Germany's Federal Office for Information Security

Classification: Section 28 BSIG · Registration: Section 33 BSIG — registration with the BSI

Reporting incidents: Section 32 BSIG — reported to the joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK) (early warning within 24 hours, report within 72 hours, follow-up report one month after the 72-hour report)

Key dates — all already in force

• NIS2: the BSI registration grace period has ended — in force since 31/07/2026(§ 33 BSIG)

What does the NIS2 in Germany module cost at Compliverse?

We don't publish a list price for this module — we calculate it with you, because scope, the number of companies and, for NIS2, the number of countries differ too much. You get a written quote with a fixed amount before anything starts. You can ask for one through the contact form; a sales call is not a precondition.

NIS2 in Germany: legal obligation or voluntary?

An obligation — though not for every company. Sector and size decide whether you are in scope (Section 28 BSIG). No official notice arrives: you assess the classification yourself and register if it applies (Section 33 BSIG). Judging your individual case is a lawyer's job; we supply structure and evidence, not legal advice.

What does NIS2 in Germany actually require of us?

Find out whether you're in scope, and at which tier — before anything else gets registered or reported. Register with the competent national authority inside the statutory deadline. Put all ten statutory minimum measures in place — from risk analysis to multi-factor authentication — each backed by dated evidence, not a checkbox. Report incidents through the correct channel, at every stage the law requires: early warning, formal report, and follow-up.

How completely does Compliverse cover NIS2 in Germany?

Our catalogue holds 13 requirements for this framework. Each carries a legal source and each has at least one measure behind it — checked by an automated test on every change, not by good intentions. That is what "audit-ready" means for us: we do not guarantee that you end up compliant, because nobody can do that honestly. We guarantee that it is provable.

Which authority is responsible in Germany — and where do we report an incident?

Registration and supervision: Bundesamt für Sicherheit in der Informationstechnik (BSI) — Germany's Federal Office for Information Security. Registering: Section 33 BSIG — registration with the BSI. Reporting an incident: to the joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK), under Section 32 BSIG (early warning within 24 hours, report within 72 hours, follow-up report one month after the 72-hour report). Note that the supervisory authority and the reporting office are not the same body — the incident assistant takes you to the right one when it matters.

Legal Landscape

Deadline radar and change log — every update with a checked date.

Further reading

• EU AI Act: What Really Changed on 27 July 2026?
• Missed the NIS2 Registration? Why Now Is Still the Best Time
• The Competence Obligation Almost Every Company Overlooks