Insights · Compliance guide

NIS2 compliance: a practical guide for DACH companies

NIS2 is the EU directive 2022/2555 that sets a common cybersecurity baseline for medium and large companies in many sectors. If you operate in Germany or Austria and sit in a covered sector, the national laws are already in force (Germany since December 2025, Austria since 1 October 2026), so the question is no longer whether but how fast you can close your gaps.

Updated: 6 November 2026

What NIS2 is and why it matters now

The directive replaced the first NIS directive and widened both the sectors and the depth of obligations. It binds you only through national law. The transposition deadline was 17 October 2024, and many countries were late: according to the European Commission, it sent reasoned opinions to 19 member states in May 2025, including Germany and Austria.

The directive rests on three pillars: security measures (Article 21), incident reporting to the authority (Article 23) and personal accountability of management (Article 20). High fines make this a board topic, not only an IT topic.

Who is covered

The directive lists sectors in two annexes. Annex I covers sectors of high criticality such as energy, transport, banking, health, drinking water and digital infrastructure. Annex II covers other critical sectors such as postal services, waste management, chemicals, food, certain manufacturing and digital providers. Essential entities are the larger ones in Annex I, important entities are the rest.

The basic size rule is that medium-sized enterprises and above are in scope. Germany expresses this in its BSI Act: 50 or more employees, or both turnover and balance sheet above 10 million euros, makes you at least an important entity. 250 or more employees, or turnover above 50 million euros together with a balance sheet above 43 million euros, makes you an essential entity in an Annex I sector. Some providers, for example DNS and top-level domain registries, are covered regardless of size.

Parent companies and partners count in the size calculation unless the entity runs its IT independently. Even below the thresholds, large customers will pass requirements down through contracts.

The risk-management measures in Article 21

Article 21 asks for appropriate, proportionate technical, operational and organisational measures. It names a minimum set that works as the skeleton of your programme.

• Risk analysis and information system security policies
• Incident handling
• Business continuity, backup management and crisis management
• Supply chain security, including direct suppliers and service providers
• Secure acquisition, development and maintenance, including vulnerability handling and disclosure
• Policies to assess whether the measures are effective
• Basic cyber hygiene and cybersecurity training
• Cryptography and encryption policies
• Personnel security, access control and asset management
• Multi-factor or continuous authentication, secured communications and emergency communication

Reporting duties and management responsibility

A significant incident triggers three steps. You send an early warning without undue delay and within 24 hours of becoming aware. Within 72 hours you send an incident notification with an initial assessment and, if available, indicators of compromise. A final report follows no later than one month after the notification; if the incident is still running, a progress report comes first. Germany implements this in section 32 of its BSI Act.

Management bodies must approve or implement the measures, oversee them and take part in training. In Germany, section 38 of the BSI Act makes managers liable to their company for culpable breaches. Delegating the work does not delegate the duty.

Fines are set nationally. The directive requires maximum fines of at least 10 million euros or 2 percent of worldwide turnover for essential entities, and at least 7 million euros or 1.4 percent for important entities, whichever is higher. German law sets these caps in section 65.

Status in Germany, Austria and Switzerland (November 2026)

Germany: The NIS2 implementation act entered into force on 6 December 2025 and changed the BSI Act. There is no transition period for the obligations. Affected entities must register with the BSI; the BSI states on its site that the statutory deadline has expired. According to trade press reporting on a BSI statement, the BSI granted a grace period until 31 July 2026, more than 19,000 entities had registered by then, and it reserved the right to take steps backed by fines.

Austria: The Network and Information Systems Security Act 2026 (NISG 2026) was published as BGBl. I Nr. 94/2025, and the consolidated text in the legal information system shows 1 October 2026 as the date of entry into force. It replaces the old NISG and creates the new Federal Office for Cybersecurity. Check the office's official site for the registration procedure, as details may still change.

Switzerland: It is not an EU member, so NIS2 does not apply to Swiss companies as such. Since 1 April 2025, however, operators of critical infrastructure must report cyberattacks to the National Cyber Security Centre within 24 hours of discovery, and the full report may follow within 14 days. Failure to report can be fined up to 100,000 Swiss francs, and fines apply from 1 October 2025. Swiss companies with EU subsidiaries or EU customers should still check NIS2 exposure.

A realistic start in five steps

Most companies need a defensible, documented path, not a perfect programme in month one.

• Scope check: map your legal entities, sectors, headcount and financials against the national law. Use the BSI self-check in Germany. Document the result either way.
• Gap analysis: compare your current controls with the ten Article 21 areas, using an established framework such as ISO/IEC 27001 or the BSI IT-Grundschutz as a yardstick. Rank gaps by risk and effort.
• Measures and ownership: assign an owner per area, get board approval for budget and plan, and schedule board training. Start with identity and access, backups, patching and logging.
• Incident process: define what counts as significant, who decides, who files the 24-hour warning and with which portal, and rehearse it with a tabletop exercise.
• Supply chain: list critical suppliers and service providers, add security clauses and reporting duties to contracts, and ask for evidence proportionate to their role.

When external providers make sense

Few mid-sized companies can staff 24/7 monitoring or an incident team, and the 24-hour clock ignores office hours. External help is most useful for round-the-clock detection (managed SOC), an incident response retainer so containment starts within hours, independent assessments such as gap analyses, penetration tests and vulnerability scans, and support with policies and supplier processes.

Accountability stays inside the company: the board owns the decision and the reporting duty. Ask providers for written scope and response times, and for the evidence a supervisor would expect.