Germany. Cybersecurity. Act
NIS2UmsuCG / BSIGNIS-2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG), incl. the recast BSI Act (BSIG)
In force
§1Summary
- Synopsis
The NIS2UmsuCG transposes NIS2 in Germany chiefly by recasting the BSI Act. It extends risk management, registration and incident-reporting duties to roughly 30,000 essential and important entities, with management liability.
- Key themes
- Unique features
Applies immediately with no general transition period; management must approve and supervise risk measures and undergo training.
- SaaS relevance
Cloud computing, managed service and digital providers (including SaaS above size thresholds) are in scope and must register with the BSI and report significant incidents.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- BSI: 24h early warning, 72h notification, final report within 1 month
- Cross-border transfers
- None
- Maximum penalty
- Essential: up to €10m or 2% turnover; important: up to €7m or 1.4%
§3Dates
- Key dates
- Adopted
- In force
- Promulgated BGBl. 2025 I Nr. 301; BSI registration portal opened 2026-01-06; entities must register within 3 months of falling in scope
§4Text and authority
- Text
- Authoritative text recht.bund.de
- Authority
- Bundesamt für Sicherheit in der Informationstechnik (BSI)
§5Where it applies
- Domestic law of
- Germany
§6Sources and verification
- Verification
High confidence.
recht.bund.de URL pattern not directly fetched.