Germany is stepping up enforcement of NIS2 requirements and preparing to implement the Cyber Resilience Act. The German cybersecurity authority (BSI) is expected to begin inspections in 2027. Affected businesses should review their registration, cybersecurity measures and documentation to demonstrate compliance with their obligations.
NIS2 and the Cyber Resilience Act: German enforcement takes shape
The Bundesamt für Sicherheit in der Informationstechnik (BSI), Germany’s national cybersecurity authority and broadly the equivalent of ANSSI, intends to contact companies in the fourth quarter of 2026 that have so far failed to register despite being subject to NIS2. From early 2027, inspections are expected to be ordered for selected entities. At the same time, Germany’s national framework for enforcing the Cyber Resilience Act is taking shape. For affected companies, the question of how to demonstrate compliance to the supervisory authority is therefore becoming increasingly pressing.
Two frameworks, two perspectives
Directive (EU) 2022/2555 (NIS2) governs the cybersecurity of companies in sectors that are essential to the economy and society. Covered entities must implement risk management measures and report significant security incidents. As a directive, NIS2 had to be transposed separately in each Member State. In Germany, the German NIS2 transposition act has been in force since 6 December 2025. It anchors the obligations in the revised BSI-Gesetz (BSIG), without a general transitional period. This German law therefore applies to German companies belonging to French groups.
The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, takes a product-based approach. It lays down cybersecurity requirements for hardware and software products whose intended or reasonably foreseeable use involves a direct or indirect connection to a device or network. As a regulation, it applies directly in all Member States. The two frameworks complement each other: complying with one does not replace compliance with the other.
BSI announces enforcement and audits
According to press reports, the BSI will initially contact companies whose registration obligation appears obvious to it. The procedure is expected to begin with a hearing and may end in an administrative fine. From the first quarter of 2027, inspections and the production of evidence are expected to be ordered for individual entities. The first to be targeted are likely to be particularly important entities in sectors where the BSI sees the greatest need. Each audit is expected to focus on a specific topic. No official BSI publication setting out the details appears to have been issued so far.
For entities already covered when the law entered into force on 6 December 2025, the three-month registration period ended on 6 March 2026. For companies that only become subject to the law later, the three-month period starts when they first fall within its scope. As at 30 September 2026, around 20,000 entities had registered, with just under 30,000 expected. The BSI’s documentation guidance explains the existing obligations and provides recommendations. Among other things, it recommends documenting the assessment of whether the law applies, even where the result is negative. It does not contain a binding audit checklist.
Who is covered?
The relevant factor is not the industry as such. What matters is whether the company falls within an entity category in Annex 1 or 2 to the BSIG and the size of the company. An Annex 1 company is generally a particularly important entity if it has at least 250 employees or more than €50 million in turnover and, at the same time, more than €43 million in total assets. Companies in Annexes 1 and 2 may already qualify as important entities if they have at least 50 employees or if both their turnover and total assets exceed €10 million. There are also size-independent cases, such as operators of critical facilities. Certain food and chemicals companies, as well as manufacturers of machinery, vehicles and electronic products, may also be covered.
This is a pitfall for French groups. Each German company must indeed be assessed separately. For the purpose of determining its size, however, the Commission’s SME Recommendation applies: the employees and financial figures of partner and linked enterprises are generally aggregated. A small German subsidiary of a large group may therefore be covered. Aggregation applies only if, taking into account the legal, economic and factual circumstances, the subsidiary is independent in the nature and operation of its IT systems, components and processes. IT operated centrally from France tends to argue against such independence.
Management is responsible
Management must implement the risk management measures, monitor their implementation and regularly take part in training itself. If it breaches its duty to implement or monitor the measures and culpably causes damage as a result, it is liable to the company under the applicable company law, in the case of a GmbH under § 43 GmbHG. This also applies to Geschäftsführer who perform their office from France. A central IT security organisation may support them, but it does not replace their own duty to monitor. For core breaches, such as breaches of risk management and reporting obligations, particularly important entities face administrative fines of up to €10 million, and important entities fines of up to €7 million. Where total turnover exceeds €500 million, the limits rise to 2% and 1.4%, respectively. The relevant figure is the worldwide turnover in the previous financial year of the company to which the entity belongs.
CRA: reporting obligations since September 2026, product requirements from December 2027
The CRA has been in force since December 2024, but applies in stages. On 15 October 2026, the Bundestag adopted the German implementing act. The BSI is consequently expected to become the central enforcement authority. It is to monitor the market, notify conformity assessment bodies, process manufacturers’ reports and conduct administrative fine proceedings. This does not entail approval of every individual product. The CRA also applies independently of the NIS2 thresholds. There is no general exemption for small companies; the decisive question is whether the product falls within the scope of the Act. Importers and distributors are subject to manufacturers’ obligations when they market products under their own name or brand.
Since 11 September 2026, manufacturers have had to report actively exploited vulnerabilities and serious security incidents affecting the security of their products. Reports are submitted through the European reporting platform. An early warning must be submitted without undue delay and no later than 24 hours after becoming aware of the matter; a more detailed report is generally due within 72 hours. If a company is both a NIS2 entity and a manufacturer, the same attack may trigger both reporting channels: the joint reporting office of the BSI and the Bundesamt für Bevölkerungsschutz und Katastrophenhilfe under § 32 BSIG, and the European platform under Art. 14 CRA. The two grounds must be assessed separately. The attack on connected cooling systems at hundreds of French supermarkets in October showed how closely operator and product security are linked. According to ANSSI, however, basic security deficiencies were the main factor there, including systems directly accessible from the internet and weak passwords.
The product requirements will generally apply from 11 December 2027. For products placed on the market earlier, they will generally apply only if those products are substantially modified from that date onwards. The reporting obligations already cover those products. On the same date, the CRA sanctions framework will become applicable. For the most serious breaches, it provides for up to €15 million or 2.5% of worldwide annual turnover in the preceding financial year, whichever is higher. A consumer complaints office is also expected to be established at the BSI. Reports of missing updates should therefore not be treated within the company as ordinary support cases.
What needs to be done now
German companies that may be covered should document their classification, including group aggregation, in a comprehensible manner, verify their registration and keep their evidence organised and readily available. It must also be clear who will assess an enquiry from the BSI, coordinate the response and monitor the deadline. Manufacturers must keep two time horizons in view at once: the reporting obligations already in force and the product requirements from December 2027.
Registration does not replace cybersecurity measures. With the announced inspections, it is becoming increasingly important to provide robust evidence that those measures have been implemented.