After a delay of more than a year, the German implementation law
for the
NIS2 Directive (Directive (EU) 2022/2555) came into force in
December 2025 (Law on the
Implementation of the NIS 2 Directive and on the Regulation of
Essential Features of Information Security Management in the
Federal Administration). The law provides for significant
changes and revisions to various cybersecurity laws, in particular
the BSI Act.
Many more companies than before now fall within the scope of the
BSI Act. Previously, the BSI Act only regulated traditional
critical infrastructure such as transport and traffic, energy,
finance, health, research, and the telecommunications industry.
Now, the digital sector is also covered, in particular cloud
computing services, data center operators, managed (security)
service providers, and providers of online marketplaces, online
search engines, and social networks. The production and trade of
chemical substances, the production, processing, and