Germany's NIS2 implementation law (NIS2UmsuCG) came into force on 6 December 2025. The BSI expects to supervise about 29,500 entities, up from about 4,500 before, and they carry three core duties: register, report significant incidents, and implement and document risk management measures (BSI). Manufacturers of machinery, electrical equipment, electronics and vehicles are among the sectors covered. For them, the production network is not a side issue: it is often where the largest risk sits.
Which manufacturers in Germany fall under NIS2
The EU directive lists manufacturing in Annex II, covering, among others, computer and electronic products (NACE C26), electrical equipment (C27), machinery and equipment n.e.c. (C28), motor vehicles (C29) and other transport equipment (C30) (Directive (EU) 2022/2555, EUR-Lex). Medium-sized and larger companies in these sectors are in scope. In German practice that means roughly 50 or more employees or more than €10 million turnover, as SECJUR summarises the thresholds.
The BSI's own statistics show how far registration has come. As of 30 September 2026 there were 20,373 registrations, of which 4,739 came from manufacturing (BSI, NIS-2 in Zahlen). Set against the 29,500 entities the BSI expects, that leaves a sizeable gap.
| Item | Figure | Date |
|---|---|---|
| Entities expected under BSI supervision | About 29,500 | December 2025 |
| Registrations received | 20,373 | 30 Sep 2026 |
| Of which manufacturing | 4,739 | 30 Sep 2026 |
Registration, reporting and liability
Registration. The BSI portal opened on 6 January 2026 and requires a "Mein Unternehmenskonto" (ELSTER-based) account. Entities must register within three months of first falling under the law, and there is no general transition period (BSI FAQ). SECJUR reports that the BSI granted a grace period until 31 July 2026. If you have not registered, do it now.
Reporting. The directive sets an early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours and a final report within one month (Art. 23). A ransomware attack that stops a production line can easily qualify.
Management liability. Management must approve and oversee the risk management measures and take part in training, which the BSI sums up as making cybersecurity a matter for the boss. Fines reach up to €10 million or 2% of worldwide turnover for essential entities, and up to €7 million or 1.4% for important entities.
NIS2 reaches machine builders through the supply chain
Even a machine builder that is not itself covered will feel NIS2. Article 21 of the directive lists supply chain security among the risk management measures, including the security of relationships with direct suppliers and service providers (EUR-Lex). Covered plants are now writing that into purchase specifications. In practice we see three requests coming back to machine builders: a documented remote service concept, evidence of secure configuration at delivery, and a named contact for security advisories.
If you build machines for German customers, it pays to have those answers ready as a standard document rather than reinventing them in every tender.
Why OT is where NIS2 gets hard for manufacturers
Office IT usually has an asset register, patching and endpoint protection. The production network often has none of these. PLCs running firmware from 2014, HMI PCs on old Windows versions, remote maintenance routers installed by a machine builder years ago, and a flat network where a laptop on the shop floor can reach every controller. The BSI's list of the top ten ICS threats includes intrusion via remote maintenance access and internet-connected control components (BSI-CS 005).
Each of these has a sound operational history. The router was fitted so the machine builder could help at 2 a.m. The old HMI PC stays because the machine software was never ported. Nobody made a bad decision; the risk simply accumulated. NIS2 now requires someone to look at the whole picture and decide.
NIS2 does not prescribe a specific OT standard, but IEC 62443 is the natural reference for industrial systems, and it is what auditors and insurers increasingly expect to see.
Understanding the New NIS2 Directive: Compliance for EU Businesses
SANS Institute
This video is hosted on YouTube. Playing it loads content from Google, which may set cookies.
Watch on YouTubeAn OT plan in four steps
- Inventory. List every controller, HMI, switch, router and engineering PC in production, with firmware, location and owner. Our OT asset inventory guide explains how without disturbing production.
- Zoning. Group assets into zones and define the conduits between them, following IEC 62443-3-2. See IEC 62443 zones and conduits explained.
- Remote access. Replace ad hoc routers with one controlled path, with multi-factor authentication and logging. Our post on secure remote access for PLC support covers the design.
- Gap assessment and roadmap. Compare the current state against your target, price the measures and document the decisions for management.
A word on sequencing. Many companies start with the policy documents because they are easiest to produce. We would start with the inventory and the remote access paths, because they expose the real risk and they make every later document more accurate. A two-day plant walk with the maintenance lead often reveals more than a month of questionnaires.
How Wartens helps
For NIS2-covered manufacturers and the ISO 27001 consultancies that advise them, Wartens provides OT asset inventories, network zoning design and gap assessments based on IEC 62443. We are controls engineers, so we know which changes a running line can tolerate and which need a planned shutdown. More on our automation engineering services and the German market background.
Next step: send us your current production network drawing, however rough, and we will propose the scope of an OT inventory and gap assessment. Get in touch.
