NIS2 Implementation in the EU |
|
Germany |
|
|
(Europe)
Firm
Noerr
Contributors
Julian Monschke |
|
| Status | Ongoing |
| Status of the NIS2 Implementation Act | The Federal Government presented its official draft of the Act (“NIS2UmsuCG”) in July 2024. |
| If available, foreseeable significant deviations of the National Implementation Act from the NIS2 Directive | In some respects, the official draft differs from the NIS2 Directive. For example, with regard to the “size cap rule“, according to which only companies that meet certain employee, turnover and balance sheet thresholds fall within the scope of application, the German legislator intends to take into account only those employees, turnover and balance sheet amounts that are relevant for the specific activities in a NIS2 sector. Additionally, some sector definitions differ. There will also be additional requirements for critical infrastructure operators (which may include intrusion detection systems, for example). Additional requirements will apply to physical resilience following the implementation of the CER Directive. |
| Expected date of entry into force of the Implementation Act | Summer/Autumn 2025. |
NIS2 Implementation in the EU
Ongoing
The Federal Government presented its official draft of the Act (“NIS2UmsuCG”) in July 2024.
The national parliament (Bundestag) first debated the NIS2UmsuCG in early October 2024. Due to a government crisis in Germany, which will require a general election in February 2025, the NIS2UmsuCG will not be implemented by then. Parliament will have to discuss it again after the elections.
In some respects, the official draft differs from the NIS2 Directive. For example, with regard to the “size cap rule“, according to which only companies that meet certain employee, turnover and balance sheet thresholds fall within the scope of application, the German legislator intends to take into account only those employees, turnover and balance sheet amounts that are relevant for the specific activities in a NIS2 sector. Additionally, some sector definitions differ.
There will also be additional requirements for critical infrastructure operators (which may include intrusion detection systems, for example). Additional requirements will apply to physical resilience following the implementation of the CER Directive.
Summer/Autumn 2025.