{"id":5029,"date":"2026-06-15T11:37:53","date_gmt":"2026-06-15T09:37:53","guid":{"rendered":"https:\/\/www.manage-now.de\/?p=5029"},"modified":"2026-07-01T14:10:59","modified_gmt":"2026-07-01T12:10:59","slug":"nis2-in-practice","status":"publish","type":"post","link":"https:\/\/www.manage-now.de\/en\/blog\/nis2-in-practice\/","title":{"rendered":"NIS2 in Practice: Personal Liability, Documentation Requirements, and What Managing Directors Need to Do Now"},"content":{"rendered":"
\n
\n
\n


\nSince December 6, 2025, the NIS2 Implementation Act has been in force\u2014with no transition period and no grace period. For approximately 30,000 organizations in Germany, this means that cybersecurity is now a management responsibility with personal liability for executive leadership<\/strong>. Anyone who treats NIS2 as merely an IT issue fundamentally underestimates what is at stake, as Section 38 of the amended German Federal Office for Information Security Act (BSIG) holds managing directors directly accountable.
\n<\/em><\/p>\n

 <\/p>\n

 <\/p>\n <\/div>\n \n <\/div>\n<\/section>

\n
\n
\n

What Is NIS2\u2014and Why Has It Been in Force in Germany Since December 2025?<\/h2>

The EU\u2019s NIS2 Directive, implemented into German law through the NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG), marks a historic shift in Germany\u2019s regulatory landscape. For the first time, executive management can be held personally <\/strong>liable for failures in cybersecurity measures. <\/p>\n

Section 38 of the revised German Federal Office for Information Security Act (BSIG) makes this explicit: members of executive management are required to oversee the implementation of cybersecurity measures and may be held personally liable in the event of failure. Under Section 61 BSIG, an unreliable member of executive management may, as a measure of last resort, be temporarily removed from their position. This mechanism was deliberately introduced to elevate cybersecurity from an IT responsibility to a board-level management obligation. <\/p>\n

\n <\/div>\n \n <\/div>\n<\/section>\n

<\/div>\n\n
<\/div>\n
\n
\n
\n

Which Organizations Are Subject to NIS2?<\/h2>\n\n\n\n\n\n\n\n
Criteria<\/th>\nEssential Entities<\/th>\nImportant Entities<\/th>\n<\/tr>\n<\/thead>\n
Organization Size<\/strong><\/td>\nLarge (>250 emp. or >50 M \u20ac annual turnover)<\/td>\nMedium-Sized (>50 emp. or >10 M \u20ac annual turnover)<\/td>\n<\/tr>\n
Sectors<\/strong><\/td>\nEnergy, Healthcare, Water,\n<\/td>\n

Banking, Digital Infrastructure<\/p>\n

Manufacturing, Chemicals, Food, Postal Services, Research, and Others<\/td>\n<\/tr>\n
Maximum Fine<\/strong><\/td>\n\u20ac10M or 2% of Global Annual Turnover<\/td>\n\u20ac7M or 1.4% of Global Annual Turnover<\/td>\n<\/tr>\n
Supervision<\/td>\nProactive Oversight by the BSI<\/td>\nReactive Oversight Following an Incident<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Compared to its predecessor, the scope of NIS2 has been expanded dramatically\u2014from approximately 4,500 organizations to around 29,500\u201330,000 organizations<\/strong> across 18 sectors.<\/p>\n

Important<\/strong>: The BSI registration deadline expired on March 6, 2026. Organizations that failed to register by this date are already exposed to the risk of regulatory penalties. <\/p>\n

\n <\/div>\n \n <\/div>\n<\/section>\n

<\/div>\n
\n
\n
\n

NIS2 at a Glance \u2013 The Most Important Facts and Figures<\/h2>