NIS2 and the KRITIS Umbrella Act: Two Laws, Two Deadlines, One Boardroom Matter

Two laws, two deadlines: what applies in 2026

Germany has put two separate but interlocking sets of rules into force in 2026. The NIS2 Implementation Act governs digital cybersecurity, the KRITIS Umbrella Act (Critical Infrastructure Umbrella Act) governs the physical and organisational protection of critical installations. Anyone affected must keep the two logics apart, because they have different authorities, duties and deadlines.

The split is clear. NIS2 addresses IT and network security and applies through the BSI, while the KRITIS Umbrella Act addresses access control, perimeter protection and business continuity and applies through the BBK. The NIS2 Implementation Act was promulgated on 6 December 2025 and applies without a transition period; the regular BSI registration deadline ended on 6 March 2026. The KRITIS Umbrella Act of 11 March 2026 has applied since 17 March 2026. Operators of critical installations register with the BBK no later than three months after an installation counts as critical (Section 8(1)), and the ordinance that decides which ones do is still missing. What about 17 July 2026, often quoted as the start of registration? That was the CER Directive deadline for member states to identify their critical entities. It set no date for operators. The two regimes are interlocking, which innobu set out in its guide to BSI-compliant integration.

Who is affected: sectors and thresholds

The question is no longer whether a company is affected but how strongly. The NIS2 Implementation Act covers around 29,500 to over 30,000 companies with at least 50 employees or 10 million euros in annual turnover across 18 sectors, and it splits them into two classes with different levels of duty. The KRITIS Umbrella Act covers a much narrower group of operators of critical installations.

The KRITIS Umbrella Act is framed more narrowly. It affects around 1,300 to 2,000 operators of critical installations, and the decisive criterion is the supply of at least 500,000 people. A single company can therefore fall under both regimes at once: under NIS2 for its digital security and under the KRITIS Umbrella Act for the physical resilience of its critical installations, from perimeter protection to counter-drone defense at energy facilities. The applicability check has to be run separately for each law.

Management liability: cybersecurity becomes a boardroom matter

The biggest break with the old legal position is the personal responsibility of the management. Under Section 38 BSIG (Federal Information Security Act) managing directors must approve the risk management measures, monitor their implementation and attend training in person, and they are liable to their own entity for culpably caused damage. Cybersecurity is no longer an IT task but a duty of the management board.

In practice this changes how decisions are recorded. It is no longer enough for an IT department to implement controls; the management must show that it approved the measures, kept their implementation under review and took part in the required training. The documentation of that chain becomes the evidence that protects the individual managing director when supervision asks questions.

Fines and enforcement: up to 10 million euros

Breaches can become expensive, and the BSI is already conducting active supervision in 2026. Essential entities face fines up to 10 million euros or 2 percent of worldwide annual turnover, important entities up to 7 million euros or 1.4 percent. In each case the higher of the two figures, the euro cap or the turnover share, applies.

The obligations catalogue: from registration to audit

NIS2 compliance is not a single step but a recurring cycle of registration, risk management, reporting channels and evidence. Whoever sets the chain up cleanly once meets the ongoing duties far more easily. The path runs from checking applicability through registration to the audits that supervision can call at any time.

The first step is registration with the BSI for NIS2, and separately with the BBK for the KRITIS Umbrella Act, with operator and installation details. The second is the substantive risk management: security concepts, emergency and backup management, and supply chain security. The third is the three-stage reporting duty, with an early warning within 24 hours, a substantive report within 72 hours, and a final report within one month. The fourth is the standing evidence base that an audit can draw on without a break.

What companies should do now

Utilities, municipal utilities and industrial firms should treat NIS2 and the KRITIS Umbrella Act as a governance and data topic, not a pure IT project, and build the ransomware resilience for municipal utilities that the reporting duty assumes. Whoever structures applicability, supply chains and evidence now avoids liability risks and is ready to deliver at the first inspection.

1. Check applicability per sector and threshold

   Test applicability against the 18 NIS2 sectors and the employee and turnover thresholds, then separately against the KRITIS supply threshold, and keep both registrations in view: the BSI one under NIS2 and the BBK one, due three months after the KRITIS ordinance classifies an installation.

2. Build risk management as a provable process

   Set up risk management, supply chain security and reporting channels as provable processes, not only as documents, and extend them at the product level with OT security under IEC 62443 and the Cyber Resilience Act.

3. Make the management board sign off

   Have the management personally approve and document the risk analysis and attend the required training, because approval, monitoring and training under Section 38 BSIG cannot be delegated or waived.

4. Design data architecture for audit and reporting

   Build the data architecture and logging so that audits and incident reports can be evidenced without a break, with the 24-hour, 72-hour and one-month reporting stages supported end to end.

Further reading

Frequently asked questions