Germany implements NIS2 cybersecurity law

Germany has implemented the NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG), which became effective on December 6, 2025. The law affects approximately 29,500 entities, primarily medium and large companies in sectors designated as important or especially important.

With the registration deadline for the Federal Office for Information Security (BSI) having passed, the focus has shifted to the implementation of risk management measures. A critical issue is the use of End-of-Life (EOL) software, which no longer receives security updates. While the law does not explicitly ban unpatched software, § 30 BSIG requires companies to maintain IT systems according to the current state of the art, including vulnerability management. Because EOL software cannot be patched, relying solely on documentation and mitigation measures may not meet these legal standards.

Under § 38 BSIG, company management is responsible for approving and monitoring risk management measures. Failure to fulfill these duties can lead to personal liability for executives, and the BSI has the authority to issue fines of up to 10 million euros for violations in especially important entities.