· Luca Moretti
NIS2 is German law: 11,500 of about 29,850 firms had registered by the deadline
Germany’s NIS2 law took effect on 6 December 2025. The BSI registration deadline passed on 6 March 2026 with most firms missing.
The EU’s NIS2 Directive (2022/2555) should have been law across the Union by 18 October 2024. Germany missed that date. The Bundestag passed the implementing law on 13 November 2025; it was published on 5 December and took effect on 6 December 2025, amending 28 federal laws.
The registration deadline
“Important” and “particularly important” entities had three months to register with the BSI, so the deadline was 6 March 2026. About 11,500 had registered by then, out of an estimated 29,850.
If you are not sure whether it applies
- Check your sector against the NIS2 sector lists.
- Check your size: headcount and turnover thresholds decide most cases.
- If it applies: register, then work through risk management, incident reporting and supply-chain security.
Registering late is better than not registering. The work behind it, a risk analysis and a reporting plan, is useful even for firms that turn out to be outside the scope.