Germany NIS2 cybersecurity law implementation

Germany has implemented the NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG), which became effective in late 2025. The law impacts approximately 29,500 medium and large entities in critical sectors. Following the registration deadline with the Federal Office for Information Security (BSI), the regulatory focus has moved toward the implementation of risk management measures.

A primary concern involves the use of End-of-Life (EOL) software. While not explicitly banned, legal standards require companies to maintain IT systems according to the “current state of the art,” which may be difficult to achieve with unpatchable software. Under the law, company management bears responsibility for monitoring risk management, with potential personal liability for executives and fines of up to 10 million euros for violations in especially important entities.

As compliance requirements progress, there is an increasing emphasis on securing operational technology (OT) within industrial companies. Beyond standard office IT, organizations must now secure control systems, engineering computers, and maintenance access points. This includes identifying critical assets and establishing clear decision-making authorities to manage maintenance access or network segmentation without disrupting continuous production processes.