Overview

• The federal cabinet adopted the draft law on July 30 to transpose the EU’s NIS2 directive into German law, targeting critical infrastructure, federal agencies and financial services.
• Operators of around 29,500 entities must now implement tighter security measures, including encryption, backup concepts and risk management processes.
• Major security incidents that threaten operations or third parties must be reported within 24 hours, with a detailed 72-hour follow-up analysis.
• The Federal Office for Information Security will gain enhanced powers to audit, sanction and hold company executives personally liable, with fines of up to €10 million or 2% of global turnover.
• Following the spring 2025 election, the bill will return to the Bundestag and is expected to take effect by the end of 2025, with industry groups calling for clearer exemption rules.