NIS2 In Germany: The New BSI Act Makes Cybersecurity A Board-Level Issue

Read in German.

Immediate considerations for "important" and "essential" entities

On Dec. 5, 2025, the German act implementing the EU NIS2 Directive was published. The centerpiece of the German implementation is the newly revised Act on the Federal Office for Information Security (Gesetz über das Bundesamt für Sicherheit in der Informationstechnik – BSI Act, BSIG), which redefines security-related requirements for companies and public bodies across Germany and fundamentally modernizes the regulatory framework for IT security. The number of regulated entities may increase from approximately 4,500 to around 29,000. For these entities, the new requirements will generally apply from the day after publication in the Federal Law Gazette; there is no general transitional period. In practice, this means that cybersecurity may no longer be viewed primarily as a technical task for the IT department, but becomes an immediate, liability-exposed leadership responsibility of