{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","NIS2 Implementation in the EU"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[null,"Noerr","Julian Monschke"]
[]
[]
[]
["NIS2 Implementation in the EU"]
[]
["Report Generated: 6/3/2026"]
[]
["View your report results on next tab"]

{"sheet":"NIS2 Implementation in the EU","index":1,"n_rows":6,"n_cols":2,"rows_kept":6,"cut":false,"hidden":false,"merged":[]}
["Question","Germany"]
["NIS2 Implementation Status"]
["Status of the legislative process","Implemented"]
["Status of the NIS2 Implementation Act","Germany has completed the transposition of the \nNIS2 Directive.\nThe \nNIS2 Implementation Act (\"\nNIS2UmsuCG\") was promulgated in the \nFederal Law Gazette on 2 December 2025 (\"\nBGBl. 2025 I No. 301\") and entered into force on 6 December 2025. The \nAct applies in full as of its entry into force. No (de jure) transitional periods are provided. The \nNIS2UmsuCG primarily revises and restructures the \nGerman Act on the Federal Office for Information Security (\"\nBSIG\") to implement the requirements of the \nNIS2 Directive.\n"]
["Significant deviations of the National Implementation Act from the NIS2 Directive, if any","The German implementation broadly follows the structure and approach of the \nNIS2 Directive but contains notable national specifications, in particular regarding the determination of scope.\nSize-cap rule and scope determinationWhile the \nNIS2 Directive relies on a general size-cap rule based on employees, turnover and balance sheet totals, the German legislator applies a more differentiated, activity-based approach.\nPursuant to \nSection 28 (3) BSIG, when assigning an entity to the sectors listed in Annexes 1 and 2, business activities that are negligible in relation to the entity’s overall business activities may be disregarded. The assessment of scope, therefore, focuses on the material relevance of NIS2-related activities within the undertaking, rather than automatically taking the undertaking as a whole into account. This materiality-based determination of scope constitutes a notable deviation from the standard scope logic of the \nNIS2 Directive, which does not expressly provide for such an exclusion of negligible activities.\nSector definitionsCertain sector definitions and classifications under German law differ in detail from the wording of the \nNIS2 Directive.\nCritical infrastructure frameworkThe NIS2 implementation does modify the German critical infrastructure regime. Critical installations remain subject to obligations under the \nBSIG and are to be assessed under the updated \nCritical Infrastructure Ordinance (\"\nKRITIS\").\n"]
["Date of entry into force of the Implementation Act","6 December 2025\n"]