NIS2 directive implementation in Germany

The implementation of the EU NIS2 directive in Germany has seen both commercial responses and identified organizational challenges. In September 2026, the publisher Brain-Media.de introduced ‘Compliance Complete’, a subscription service designed to provide technical guidance on EU regulations, information security, and AI governance. This launch coincided with analysis suggesting that high regulatory compliance scores do not inherently eliminate risk, noting that strategic business value can still result in significant risk costs despite high readiness indices.

By October 2026, a study by Kertos titled ‘NIS2 Readiness Study 2026’ indicated that German companies are making slow progress in meeting these requirements. The study found that only 27% of surveyed companies had registered with the Federal Office for Information Security (BSI), while nearly half were still in the assessment phase or had not yet begun implementation.

Furthermore, the study highlighted a gap in organizational responsibility; while 63% of companies assign NIS2 duties to IT management, experts noted that under § 38 of the BSIG, cybersecurity resilience must be integrated into executive management and daily business operations rather than being treated exclusively as an IT task.