NIS2, CRA and DORA: IT Security Law

Home › IT Security Law

IT security law in Germany has become considerably stricter since 2025. With the German NIS2 Implementation Act, the EU Cyber Resilience Act and DORA, thousands of companies are subject to statutory duties on risk management, reporting and evidence for the first time. We assess whether and how you are affected, implement the duties with your IT team and support you in the event of an attack.

NIS2, CRA and DORA: who is affected?

NIS2 in Germany: the key obligations

The NIS2 Implementation Act (NIS2UmsuCG) recast the Act on the Federal Office for Information Security (BSIG) and entered into force on 6 December 2025. Entities in scope must register with the Federal Office for Information Security (BSI) (Section 33 BSIG). The original deadline was 6 March 2026; in practice the BSI allowed registration until 30 September 2026. Anyone who has not yet registered should do so now and document why registration is late.

• Risk management under Section 30 BSIG: including risk analysis, incident handling, backup and crisis management, supply chain security, cryptography, access control and multi-factor authentication.
• Reporting under Section 32 BSIG: initial report of significant incidents within 24 hours, report with assessment within 72 hours, final report within one month.
• Management under Section 38 BSIG: approval and oversight of measures, regular training, liability towards the entity.
• Fines: up to EUR 10 million or 2 per cent of worldwide turnover for essential entities, up to EUR 7 million or 1.4 per cent for important entities.

IT security in contracts and liability

Outside the specific statutes, IT security is still a legal question. Art. 32 GDPR requires appropriate technical and organisational measures, and data breaches can trigger damages claims under Art. 82 GDPR. In IT contracts, the agreed level of security determines whether a service is defective. Towards consumers, update obligations apply under Sections 327f and 475b of the German Civil Code (BGB). From 9 December 2026, manufacturers will also be liable for software and for failing to provide security updates under the new Product Liability Act.

We draft cybersecurity SLAs and clauses on penetration tests, audits and reporting channels in service contracts, and review cyber insurance policies for obligations that become a problem when a claim arises.

Criminal law: when systems are attacked

Attacks on IT systems are criminal offences under Sections 202a et seq. of the German Criminal Code (StGB) (data espionage and interception), Section 303a StGB (data tampering) and Section 303b StGB (computer sabotage); ransomware extortion is also covered by Section 253 StGB. We support companies in filing criminal complaints and working with the specialist cybercrime units.

How we work

• Scope assessment for NIS2, CRA and DORA with written reasons, including where you are not in scope.
• Gap analysis with your IT team or security provider; we translate legal duties into verifiable measures.
• A reporting plan that brings together the BSIG, GDPR and, where relevant, DORA.
• Management training under Section 38(3) BSIG.
• Support during incidents and BSI audits.

Frequently asked questions

How do I find out whether my company falls under NIS2?

What matters is activity, size and the sectors listed in Annexes 1 and 2 to the BSIG. In groups, staff and turnover of affiliated companies are usually counted. The BSI offers a self-assessment; in borderline cases the assessment should be documented by a lawyer.

We supply an NIS2 company. Does it affect us?

Indirectly, yes. Your customers must manage the security of their supply chain and pass requirements on by contract. Expect questionnaires, audit rights and reporting clauses.

Must a ransomware attack be reported?

For NIS2 entities almost always, within 24 hours to the BSI. If personal data is affected, the 72-hour notification to the data protection authority is added.

Related topics

• NIS2 and BSIG (in German)
• Cyber Resilience Act (in German)
• DORA (in German)
• Cyber attack
• Reporting a data breach