Germany Transposes NIS2: New BSI Act in Force With a Rolling Three-Month Registration Clock
Germany's NIS2 implementing act was signed on 2 December 2025, published as BGBl. 2025 I Nr. 301 on 5 December 2025, and took effect on 6 December 2025. It replaces the old BSI-Gesetz with a new BSIG that carries the directive's duties directly, including a registration duty in Section 33 and incident reporting duties in Section 32.
Key Analytics
Impact Analysis
Germany is the largest economy in the EU, so its transposition converts NIS2 from a directive that member states owe the Commission into a law that binds companies operating there. Two mechanics matter for planning. First, Section 33 BSIG sets a ROLLING clock, not a one-off cutover: besonders wichtige Einrichtungen, wichtige Einrichtungen and domain name registry service providers must submit their registration details to the BSI at the latest three months after they first qualify, or qualify again, so a company that crosses a size or sector threshold next quarter starts a fresh three-month window then. Changes to registered details are due within two weeks. Second, the BSI's own NIS2 pages now tell affected companies that the statutory registration period has already expired and that any entity in scope which has not registered should do so immediately, which means a late registrant is not opening a window but closing a gap. Section 32 routes incident reports to a joint reporting point operated by the BSI and the Federal Office of Civil Protection and Disaster Assistance.
Recommended Actions
- Determine whether each German entity in your group is a besonders wichtige Einrichtung or a wichtige Einrichtung under the BSIG's size and sector criteria, and record the reasoning; self-identification is the mechanism, and no regulator sends a notice first.
- Register in the BSI portal now if an entity is in scope and has not registered, rather than waiting for a window: the statutory period has already passed for entities that qualified when the law took effect.
- Put a trigger in the process that watches for newly qualifying entities, because Section 33 restarts a three-month registration clock each time an entity first qualifies or qualifies again.
- Route German incident reporting to the joint BSI and BBK reporting point and rehearse it against the directive's staged timings, so the first real incident is not the first time the path is used.
- Treat notified changes to registered details as a two-week obligation and assign an owner, since group restructures and service changes are the usual cause of a missed update.
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›Gap assessment against current controls
- ›Applicability analysis
- ›Control mapping and implementation
- ›Evidence and audit preparation
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 70 to 305 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.