NIS2 and the KRITIS Umbrella Act: Two Laws, Two Deadlines, One Boardroom Matter
Cybersecurity in Germany has become a personal duty of the management board in 2026. The NIS2 Implementation Act has applied without a transition period since 6 December 2025 to around 29,500 to over 30,000 companies, with fines up to 10 million euros and personal liability under Section 38 BSIG (Federal Information Security Act). The KRITIS Umbrella Act (Critical Infrastructure Umbrella Act) adds physical resilience and a registration duty with the BBK from 17 July 2026, with fines up to 1 million euros. This article explains who is affected, what management liability means in practice, how the fines are tiered, and what companies should set up now.
Germany put two distinct but interlocking regimes into force in 2026. The NIS2 Implementation Act (NIS2UmsuCG) governs digital cybersecurity and has applied without a transition period since 6 December 2025 to around 29,500 to over 30,000 companies across 18 sectors; the regular registration deadline with the Federal Office for Information Security (BSI) ended on 6 March 2026. The KRITIS Umbrella Act governs the physical and organisational resilience of critical installations, has been in force since 6 March 2026, and requires operators of critical installations to register with the Federal Office of Civil Protection and Disaster Assistance (BBK) from 17 July 2026. The sharpest break with the old law is personal management liability under Section 38 BSIG: approval, monitoring and training cannot be delegated, and a waiver of liability is excluded. Essential entities face fines up to 10 million euros or 2 percent of worldwide turnover, important entities up to 7 million euros or 1.4 percent, while breaches of the physical resilience duties under the KRITIS Umbrella Act carry separate fines up to 1 million euros. The reporting duty runs in three stages: 24 hours, 72 hours and one month.
Two laws, two deadlines: what applies in 2026
Germany has put two separate but interlocking sets of rules into force in 2026. The NIS2 Implementation Act governs digital cybersecurity, the KRITIS Umbrella Act (Critical Infrastructure Umbrella Act) governs the physical and organisational protection of critical installations. Anyone affected must keep the two logics apart, because they have different authorities, duties and deadlines.
The split is clear. NIS2 addresses IT and network security and applies through the BSI, while the KRITIS Umbrella Act addresses access control, perimeter protection and business continuity and applies through the BBK. The NIS2 Implementation Act was promulgated on 6 December 2025 and applies without a transition period; the regular BSI registration deadline ended on 6 March 2026. The KRITIS Umbrella Act was passed by the Bundestag on 29 January 2026, approved by the Bundesrat on 6 March 2026, and the BBK registration for operators of critical installations begins on 17 July 2026. The two regimes are interlocking, which innobu set out in its guide to BSI-compliant integration .
Who is affected: sectors and thresholds
The question is no longer whether a company is affected but how strongly. The NIS2 Implementation Act covers around 29,500 to over 30,000 companies with at least 50 employees or 10 million euros in annual turnover across 18 sectors, and it splits them into two classes with different levels of duty. The KRITIS Umbrella Act covers a much narrower group of operators of critical installations.
The KRITIS Umbrella Act is framed more narrowly. It affects around 1,300 to 2,000 operators of critical installations, and the decisive criterion is the supply of at least 500,000 people. A single company can therefore fall under both regimes at once: under NIS2 for its digital security and under the KRITIS Umbrella Act for the physical resilience of its critical installations. The applicability check has to be run separately for each law.
Management liability: cybersecurity becomes a boardroom matter
The biggest break with the old legal position is the personal responsibility of the management. Under Section 38 BSIG (Federal Information Security Act) managing directors must approve the risk management measures, monitor their implementation and attend training in person, and they are liable to their own entity for culpably caused damage. Cybersecurity is no longer an IT task but a duty of the management board.
Approval, monitoring and training are expressly not delegable. A waiver of liability is excluded by law, and blanket clauses in articles of association do not protect managing directors. The management must personally sign off on and document the results of the risk analysis, which turns the formal cybersecurity duty into a matter that reaches the board table.
In practice this changes how decisions are recorded. It is no longer enough for an IT department to implement controls; the management must show that it approved the measures, kept their implementation under review and took part in the required training. The documentation of that chain becomes the evidence that protects the individual managing director when supervision asks questions.
Fines and enforcement: up to 10 million euros
Breaches can become expensive, and the BSI is already conducting active supervision in 2026. Essential entities face fines up to 10 million euros or 2 percent of worldwide annual turnover, important entities up to 7 million euros or 1.4 percent. In each case the higher of the two figures, the euro cap or the turnover share, applies.
Keep the two fine frameworks distinct: The NIS2 fines up to 10 million euros relate to digital cybersecurity duties supervised by the BSI, while the KRITIS Umbrella Act fines up to 1 million euros relate to physical resilience duties supervised by the BBK. A company under both regimes can be exposed to both frameworks at once, so the applicability and the duties have to be mapped separately for each law.
The obligations catalogue: from registration to audit
NIS2 compliance is not a single step but a recurring cycle of registration, risk management, reporting channels and evidence. Whoever sets the chain up cleanly once meets the ongoing duties far more easily. The path runs from checking applicability through registration to the audits that supervision can call at any time.
The first step is registration with the BSI for NIS2, and separately with the BBK for the KRITIS Umbrella Act, with operator and installation details. The second is the substantive risk management: security concepts, emergency and backup management, and supply chain security. The third is the three-stage reporting duty, with an early warning within 24 hours, a substantive report within 72 hours, and a final report within one month. The fourth is the standing evidence base that an audit can draw on without a break.
What companies should do now
Utilities, municipal utilities and industrial firms should treat NIS2 and the KRITIS Umbrella Act as a governance and data topic, not a pure IT project. Whoever structures applicability, supply chains and evidence now avoids liability risks and is ready to deliver at the first inspection.
-
Check applicability per sector and threshold
Test applicability against the 18 NIS2 sectors and the employee and turnover thresholds, then separately against the KRITIS supply threshold, and keep both deadlines, the BSI and the BBK, in view at once.
-
Build risk management as a provable process
Set up risk management, supply chain security and reporting channels as provable processes, not only as documents, so that controls can be evidenced rather than merely asserted.
-
Make the management board sign off
Have the management personally approve and document the risk analysis and attend the required training, because approval, monitoring and training under Section 38 BSIG cannot be delegated or waived.
-
Design data architecture for audit and reporting
Build the data architecture and logging so that audits and incident reports can be evidenced without a break, with the 24-hour, 72-hour and one-month reporting stages supported end to end.
The two laws apply now, and the registration deadlines have either passed or are close. Whoever maps applicability separately for the BSI and the BBK, builds provable processes and lets the management board sign off turns the legal duty into a defensible position. How a wider ethical and legal compliance approach fits alongside cybersecurity shows that governance and data handling under GDPR belong in the same plan.
Further reading
Frequently asked questions
The NIS2 Implementation Act governs digital cybersecurity. It applies through the Federal Office for Information Security (BSI), demands risk management and reporting, and carries fines up to 10 million euros. The KRITIS Umbrella Act governs the physical and organisational resilience of critical installations. It applies through the Federal Office of Civil Protection and Disaster Assistance (BBK), demands access control, perimeter protection and business continuity, and carries fines up to 1 million euros. They have different authorities, duties and deadlines, so affected companies must keep the two regimes distinct.
The NIS2 Implementation Act covers around 29,500 to over 30,000 companies in 18 sectors that have at least 50 employees or 10 million euros in annual turnover. It splits them into essential entities, such as energy, transport, banking, health, drinking water, waste water and digital infrastructure, and important entities, such as postal and courier services, waste management, chemicals, food, manufacturing and research. The KRITIS Umbrella Act covers a narrower group of around 1,300 to 2,000 operators of critical installations, defined mainly by the supply of at least 500,000 people.
Under Section 38 BSIG the management must approve the risk management measures, monitor their implementation and attend training in person, and it is liable to its own entity for culpably caused damage. Approval, monitoring and training cannot be delegated, and a waiver of liability is excluded by law. Blanket clauses in articles of association do not protect managing directors. The management must personally sign off on and document the results of the risk analysis.
Essential entities face fines up to 10 million euros or 2 percent of worldwide annual turnover, important entities up to 7 million euros or 1.4 percent, with the higher of the euro cap and the turnover share applying in each case. Breaches of the physical resilience duties under the KRITIS Umbrella Act carry separate fines up to 1 million euros. Missing the registration deadline risks fines and additional regulatory scrutiny, and the BSI is already conducting active supervision in 2026.
The reporting duty has three stages, submitted through the BSI reporting portal: an early warning within 24 hours, a substantive incident report within 72 hours, and a final report within one month. The registration duty for operators of critical installations under the KRITIS Umbrella Act, handled by the BBK, begins on 17 July 2026, while the regular BSI registration deadline under NIS2 ended on 6 March 2026.