Obligations at a glance

What management should know now.

NIS2, the German KRITIS umbrella act and the EU AI Act apply side by side. This page summarises the key duties in one place, checked against the statutory text and in plain language.

As of October 2026. Orientation, not legal advice.

Three duties that stay with management.

The German BSI Act holds the management of essential and important entities accountable. The operational work can be delegated, the responsibility cannot.

  1. 01 · Implement

    Implement the measures

    The risk management measures across ten areas are implemented, and management makes sure they are. Taking note is not enough.

    Sec. 38(1) BSIG (opens in a new window)Sec. 30 BSIG (opens in a new window)
  2. 02 · Oversee

    Oversee implementation

    Fixed reporting lines and measurable indicators show whether the measures work. A fixed slot every quarter is a good rhythm.

    Sec. 38(1) BSIG (opens in a new window)
  3. 03 · Train

    Undergo regular training

    Management takes part in regular training to recognise and assess risks itself. The BSI can have compliance audited.

    Sec. 38(3) BSIG (opens in a new window)Sec. 61 BSIG (opens in a new window)

If management culpably breaches these duties, it is liable to its own entity under the company law of its legal form. Well documented decisions are therefore the most effective protection: they show that decisions were taken on an appropriate basis.

Sec. 38(2) BSIG (opens in a new window)

Who is affected.

Sector and size decide. Whether your company is in scope can usually be settled in one conversation.

Essential entities

Companies in the sectors of Annex 1 of the BSI Act with 250 employees or more, or more than EUR 50 million turnover and more than EUR 43 million balance sheet total, plus all operators of critical facilities.

Sec. 28(1) BSIG (opens in a new window)Annex 1 BSIG (opens in a new window)

Important entities

Companies in the sectors of Annexes 1 and 2 with 50 employees or more, or more than EUR 10 million turnover and balance sheet total, including many manufacturers in chemicals, food, medical technology and machinery.

Sec. 28(2) BSIG (opens in a new window)Annex 2 BSIG (opens in a new window)

Operators of critical facilities

Anyone operating facilities above defined thresholds has additional duties under the BSI Act and the KRITIS umbrella act, such as attack detection, evidence every three years and a resilience plan.

Sec. 31 BSIG (opens in a new window)Sec. 39 BSIG (opens in a new window)Sec. 8 KRITISDachG (opens in a new window)Secs. 12, 13 KRITISDachG (opens in a new window)

For groups of companies, the group can matter. We check this case by case.

Reporting: the clock starts when you know.

A significant security incident is reported in stages to the joint reporting office of the BSI and the BBK. The deadline starts as soon as someone in the company becomes aware of it, not once it is confirmed.

Sec. 32 BSIG (opens in a new window)BSI: NIS2 reporting (German) (opens in a new window)
  1. 24 hours

    Early warning

    Suspected attack, possible impact in other EU member states. Speed comes before completeness.

  2. 72 hours

    Notification

    First assessment of severity and impact, indicators of compromise where available.

  3. On request

    Intermediate report

    If the BSI asks, the status is updated.

  4. One month

    Final report

    Cause, remediation and impact. If the incident is still ongoing, a progress report follows.

Data protection in parallel

If personal data is affected, a separate notification goes to the data protection authority within 72 hours.

Art. 33 GDPR (opens in a new window)

Critical facilities in addition

Incidents affecting a critical facility are also reported under the KRITIS umbrella act, likewise within 24 hours.

Sec. 18 KRITISDachG (opens in a new window)

Be prepared

Name the people responsible for reporting and their deputies, set up access to the BSI portal and rehearse the process once.

BSI: NIS2 reporting (German) (opens in a new window)

What is often overlooked.

Basic technical protection is usually in place. The gaps tend to appear in organisation, evidence and cooperation.

What applies when.

  1. 2 Feb 2025EU AI Act: prohibited practices and AI literacyArt. 113 AI Act (opens in a new window)
  2. 6 Dec 2025BSI Act in its NIS2 versionBSI Act (German) (opens in a new window)
  3. 17 Mar 2026KRITIS umbrella actKRITISDachG (German) (opens in a new window)
  4. 2 Aug 2026EU AI Act: transparency dutiesArts. 50, 113 AI Act (opens in a new window)
  5. 11 Sep 2026Cyber Resilience Act: reporting duties for manufacturersArt. 71 Cyber Resilience Act (opens in a new window)
  6. 2 Dec 2027EU AI Act: high-risk duties under Annex III, such as recruitment and safety components of critical infrastructureRegulation (EU) 2026/1744 (opens in a new window)
  7. 2 Aug 2028EU AI Act: high-risk duties for AI in regulated products (Annex I)Regulation (EU) 2026/1744 (opens in a new window)
  8. 6 Dec 2028BSI may request evidence from all essential entitiesSec. 61(3) BSIG (opens in a new window)

Evidence you should be able to show.

Not for the drawer, but as the basis for decisions. Much of it emerges anyway when a management system runs well.

Foundations

  • Scope assessment and registration
  • Policy, risk analysis and risk treatment plan
  • Documentation of measures across the ten areas of Sec. 30

Operations

  • Incident and reporting procedure with availability
  • Emergency, backup and recovery concept, rehearsed
  • Assessment of suppliers and service providers

Management

  • Resolutions and reports on oversight
  • Training records
  • Annual report as the basis for decisions

Critical facilities

  • Attack detection concept
  • Evidence of implementation every three years
  • Risk analysis and resilience plan under the KRITIS umbrella act

AI

  • AI inventory with classification
  • Measures for AI literacy
  • Labelling of AI content

Where do you stand?

In 30 minutes we work out together which duties really apply to your company and what can be left out.

Suitable first steps

Book a first conversation

Sources

All statements refer to the official texts. The current version applies in each case.

This overview is for orientation and does not replace legal advice. It is based on the German BSI Act, the KRITIS umbrella act and the EU AI Act as of October 2026.