The bottom line: From 2026, approximately 29,500 companies in Germany will fall under NIS2 compliance requirements and face fines up to €10 million.
The NIS2 Directive will impose liability risks of up to €10 million on around 29,500 companies in Germany from 2026. The regulation significantly expands the scope of regulated operators of critical infrastructure.
Germany’s national implementation of the NIS2 Directive substantially tightens cybersecurity requirements. As matters currently stand, around 29,500 companies will be classified as operators of critical infrastructure or important digital service providers and must meet the new requirements.
The increase in liability is considerable: non-compliance can be penalised with fines up to €10 million. This particularly affects organisations in sectors such as energy, transport, water, health, communications and digital services. CISOs must expect that their security responsibility will be defined more broadly in legal terms, and gaps will have significant financial consequences.
The deadline until 2026 gives affected organisations time to adapt their security architecture, incident response processes and governance structures to the new standards. CISOs should already conduct a gap analysis, clarify their own applicability and plan investments in awareness, technology and processes.
Source: news.google.com · Published 1 August 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.