On this page
Published by horak. Attorneys at law / Patent attorneys
2026 legal update / Reviewed 12 November 2026
German NIS2 implementation is an operational compliance issue in 2026. A documented scope assessment should lead to registration and reporting arrangements where required.
The implementation is in force
The BSI states that the German NIS2 implementation legislation entered into force on 6 December 2025. Registration and reporting duties apply under that legislation. The BSI portal is the route identified for NIS2 registration; the former MIP route should not be assumed to be interchangeable.
Scope first, then operating responsibilities
A business should establish the relevant entity, activities and size criteria before deciding that it is covered or exempt. Once scope is resolved, assign owners for registration, escalation, incident assessment and supplier communication. Existing arrangements for critical infrastructure may need separate consideration.
Four practical examples
Illustrative scenarios, not reports of client mandates. The appropriate response depends on the facts and applicable law.
Group company
A parent company checks which legal entities and activities are relevant instead of relying on a single group-wide assumption.
Managed services
A technology supplier assesses whether its service offering brings it into a regulated category.
Newly covered business
An organisation records the basis for scope and establishes the portal access and contacts needed for timely action.
Legacy reporting process
A business with an established reporting channel checks the BSI’s instructions before changing or duplicating submissions.
Practical next step
Identify the systems, products or contracts affected, assign a responsible owner and preserve the documents supporting your assessment. Read our related service page for the scope of legal support.