Germany Passes NIS-2 Implementation Law to Strengthen National Cybersecurity Framework

On November 13, 2025, the German Bundestag passed the NIS-2 implementation law, marking a significant advancement in the country’s cybersecurity legislation. The law is designed to modernize and expand IT security regulations within Germany, aiming to bolster digital resilience across both the economy and public administration.

This legislation notably expands the scope of regulated entities from approximately 4,500 to around 29,500, encompassing critical infrastructure and essential services. These entities are mandated to register with the Federal Office for Information Security (BSI), report significant security incidents, and implement comprehensive risk management measures. The BSI itself is assigned a central, elevated role as the Chief Information Security Officer for the federal government, coordinating cybersecurity efforts across all government departments.

A key feature of the new law is the introduction of a three-tier reporting system for cybersecurity incidents. Entities must submit an initial report within 24 hours of an incident, provide updates within 72 hours, and deliver a complete report within 30 days. Compliance with these reporting requirements is strictly enforced, with penalties imposed for violations.

Additionally, the law equips the Federal Ministry of the Interior with the authority to retroactively ban the use of critical components produced by manufacturers under foreign government control, addressing concerns about supply chain security.

The enactment comes amidst rising cyber threats, with the BSI reporting a 24% increase in daily identified system vulnerabilities. Although the NIS-2 directive at the EU level took effect on January 16, 2023, Germany missed the October 17, 2024 deadline for national legislation, resulting in legal proceedings initiated by the European Commission.

The German NIS-2 implementation law is expected to take effect by the end of 2025 or early 2026, establishing stronger cybersecurity standards and a cohesive protective stance across sectors vital to the nation's security and digital infrastructure.