NIS2 in Germany — transposition status and what’s changed

The NIS2UmsuCG expands the German regulated population from roughly 4,500 entities to an estimated 29,500 — one of the largest single-country jumps in the EU. The delta is almost entirely mid-market: the Mittelstand machinery makers, component suppliers, logistics operators, chemical processors, and regional service providers that anchor German industry, most of whom have never operated under BSI supervision before. German law sorts them into two classes — particularly important entities (besonders wichtige Einrichtungen, the essential tier) and important entities (wichtige Einrichtungen) — with obligations scaled by class; operators of critical facilities (KRITIS) count as particularly important entities and carry extra duties.

Two facts define the current moment. There was no general transition period: obligations applied from 6 December 2025, the day the law took effect, with three months to register. And when the registration deadline passed on 6 March 2026, fewer than two in five of the estimated 29,500 entities had registered; by 30 September 2026 the BSI counted 20,141, about two-thirds — meaning a large share of the newly regulated population spent 2026 catching up, working out scope, registration, and supplier evidence in the same quarters their customers are asking them for the same things.

The NIS2UmsuCG is an omnibus act: its first article enacts a new BSI Act (BSIG) in full, replacing the 2009 act, so there is no separate NIS2 statute to read alongside it. Operators of critical facilities (KRITIS) count as particularly important entities and keep a proof obligation of their own — they demonstrate their measures to the BSI every three years, a cycle that moved from two — while both classes carry the directive-shaped duties: risk-management measures across the Article 21 areas, registration with the BSI, and incident reporting on the 24-hour / 72-hour / one-month ladder. Management accountability is explicit: the law makes cybersecurity oversight a statutory duty of the management body, including training — board-level attention is a legal requirement, not a best practice.

BSI is the operational counterpart: the registration portal (open since 6 January 2026), the incident-reporting channel, and a steady stream of orientation guidance including a self-check for whether your organisation is in scope. German supervisory culture is document-heavy in the IT-Grundschutz tradition — expect evidence requests that favour structured, attributable, dated records over narrative assurances. The binding texts and guidance are German; English summaries are orientation, not authority.

German supply chains cascade. OEMs and Tier 1s push evidence obligations down through machinery, automotive, and chemical supply networks that reach deep into Czechia, Slovakia, Poland, and Austria — so a German buyer’s supplier inventory is heavily cross-border, and the suppliers inheriting German NIS2 expectations are often working to their own, differently timed national transpositions. Germany’s existing assurance culture cuts both ways: TISAX and ISO 27001 are widespread, which raises the evidence baseline, but a supplier’s certificate is evidence about them — it is not your documented assessment of them, and the NIS2UmsuCG expects the latter.

The registration shortfall is also a supplier-maturity signal: if three in five regulated German entities had not registered by the deadline, the suppliers below them are further behind still. The pattern a buyer meets in a first structured evidence collection is predictable: the large cloud and ICT providers answer quickly with deep sub-processor stacks you must then actually read, while the specialised Mittelstand suppliers that carry the real operational dependency often have nothing prepared and need months of patient, structured chasing.

Vittnor — Supply Chain Assurance for the mid-market — produces by default the evidence shape German supervision favours: structured, dated, reviewer-attributed, exportable. One record per supplier, current evidence with provenance, a decision trace that survives staff turnover, machine-readable exports. Customer evidence is stored in the EU, on Microsoft Azure in Sweden. Evidence templates are anchored to the directive and ENISA’s technical implementation guidance rather than to any single national methodology.

For the cross-border chains German buyers actually run, the aim is one supplier file that supports both the German buyer’s questions and the supplier’s own Czech or Slovak obligations — cross-buyer routing is planned for later versions. For mid-market German entities without a dedicated CISO, the one-off NIS2 Supplier Exposure Assessment maps the supplier-risk landscape first, and the platform then carries the ongoing programme the NIS2UmsuCG expects.