On 6 December 2025, Germany transposed the NIS2 Directive into national law. The NIS2UmsuCG amended the BSIG (the Federal Office for Information Security Act) to introduce registration, risk management and incident notification obligations for approximately 30,000 entities. Ten months on, the gap between legal obligations and operational reality remains substantial. For French organisations operating in Germany, this delay is not a German problem: it is a compliance risk that belongs to them.
A registration deadline already seven months overdue
The BSI (Bundesamt für Sicherheit in der Informationstechnik) registration portal opened on 6 January 2026, one month after the BSIG came into force. The registration deadline set under Section 33 BSIG was 6 March 2026, three months after the law was published.
By 30 June 2026, the BSI had recorded 17,729 registered entities out of an estimated 30,000 subject to the regime. Around 12,000 organisations had therefore missed their legal deadline, according to data published by the BSI (source: NIS2Certify, July 2026). That figure represents 40% of affected entities in an irregular position seven months after the cut-off date.
This level of non-compliance is less surprising given a G DATA survey conducted earlier in the year: 44% of companies subject to the NIS2UmsuCG stated they were entirely unaware of their obligations (G DATA, March 2026). The law came into force without any grace period, but the information had not reached a significant proportion of the organisations concerned.
What the BSIG actually requires
The BSIG imposes three core obligations on essential and important entities.
Registration with the BSI via the MUK portal (Mein Unternehmenskonto). This first step conditions everything else: an unregistered entity cannot receive BSI alerts or demonstrate compliance during an inspection. The fine provided for under Section 65 BSIG for failure to register can reach EUR 500,000.
Implementation of ten risk management measures defined under Section 30 BSIG. These cover security policies, incident management, business continuity, supply chain security, testing and auditing, cryptography, human resources security, multi-factor authentication and secure communications. This list is drawn directly from Article 21 of the NIS2 Directive and does not differ substantially from what the other national transpositions, including the French one, will require.
Notification of significant incidents to the BSI within 24 hours of detection, followed by a full report within 72 hours. This timetable mirrors that of the Directive, and organisations that have already aligned their processes with NIS2 face no additional effort on this point.
Management personal liability: a distinctive feature of the BSIG
Section 38 BSIG introduces personal liability for members of the executive. They are required to ensure that the Section 30 risk management measures are in place and monitored. This oversight obligation cannot simply be delegated.
This mechanism is more explicit than what some other national transpositions provide. In practice, it means that the board of an entity established in Germany must be able to demonstrate its knowledge of the security measures deployed and their implementation status. An audit revealing that management was unaware of existing shortcomings is an aggravating factor.
A concrete example: a French subsidiary operating in Germany in the energy distribution sector (an essential entity within the meaning of the BSIG) whose chief executive has no knowledge of the company's registration status would face direct exposure in the event of a BSI inspection.
What this means for your cross-border entities
Germany's national transposition of NIS2 creates obligations that are distinct from those that will apply to your French entities. You cannot rely on your French NIS2 programme to cover your German entities.
Several points warrant immediate verification.
Scope of application. The BSIG retains the Directive's thresholds: 50 employees and EUR 10 million in turnover for important entities, 250 employees and EUR 50 million for essential entities. A German subsidiary may fall within the BSIG's scope regardless of the parent company's status in France. The exemption for entities subject to the DORA Regulation applies, but only to financial activities covered by that regulation.
Registration status. If your German entity is not registered with the BSI via the MUK portal, it has been in breach since 6 March 2026. The BSI has announced a systematic reinforcement of controls in 2026, and unregistered entities will be among the first to be checked.
Consistency with your overall NIS2 programme. The ten measures under Section 30 BSIG correspond to those of the Directive. A well-structured NIS2 compliance programme can cover the German requirements with limited adaptations: entity mapping, local registration, and designation of a point of contact with the BSI.
The broader European context shows that this misalignment is not specific to Germany. In the Netherlands, the Cyberbeveiligingswet came into force on 15 August 2026 with no grace period for around 8,000 organisations. The article on the cross-border obligations of the Cyberbeveiligingswet sets out the points common to both transpositions.
Three actions to take immediately
Map your German entities within the scope of the BSIG. Apply the Directive thresholds to each legal entity operating in Germany. Verify the sector: the list of essential and important sectors within the meaning of the BSIG is annexed to Section 28.
Register the entities concerned with the BSI. Registration involves creating an MUK account (muk.bsi.bund.de) and completing the registration form. The procedure takes less than an hour but requires precise information on the legal structure, sector and designated security contacts.
Align the ten Section 30 BSIG measures with your existing NIS2 programme. If you have already engaged in NIS2 compliance for your French entities, the substantive work is largely reusable. The main adaptation concerns local points of contact and the notification chain to the BSI rather than France's national cybersecurity agency (ANSSI).
Bringing your German entities into compliance with the BSIG is part of the same process as your overall NIS2 programme. Our NIS2 compliance programme service covers the mapping of entities under European national transpositions and the alignment of risk management measures with each local regulator's requirements.