Legal position and jurisdiction
Germany’s implementation generally applies from 6 December 2025. The implementing act was promulgated on 5 December 2025. The obligations discussed here are governed by the current BSI Act (BSIG), rather than by the text of the EU Directive alone. Federal Law Gazette 2025 I No. 301, Article 30; BSIG.
A German customer or a .de domain does not automatically establish German supervision. For the digital providers listed in section 60(1), the main EU establishment is particularly relevant; providers without an EU establishment must examine representative rules. General jurisdiction, special jurisdiction and sectoral exceptions must be considered for the entity. § 59, § 60 BSIG.
Which entities are in scope?
Section 28 distinguishes particularly important and important entities. The general size rules require the relevant entity type in Annex 1 or 2 and an offering for remuneration. The shorthand “50 employees or more” is insufficient: turnover and balance sheet total form an additional combined route, and different thresholds apply to particularly important entities.
Cases covered irrespective of size, links between undertakings, negligible activities and sectoral exceptions can affect classification. Critical installations, DNS and trust services, and telecommunications need separate consideration. Public administration cannot simply be treated as an ordinary company. § 28 BSIG, Annex 1, Annex 2.
Distinguish obligations and deadlines
- Registration: Section 33(1) requires registration within three months of first or renewed inclusion in scope. For entities already in scope on 6 December 2025, this was 6 March 2026. Certain digital providers, critical installations and transitional cases have additional rules (sections 34 and 66).
- Measures and management: Section 30 requires appropriate, proportionate and effective measures and documentation. Section 38 governs implementation, oversight and regular management training.
- Incidents: For significant incidents, section 32 generally requires early notification within 24 hours and an incident notification within 72 hours of awareness of the same incident. Follow-up and final reports have their own requirements. Trust services and other reporting laws need separate examination.
§ 30, § 32, § 33, § 38 BSIG. An ongoing security project does not postpone obligations already in force.
Useful next steps
Open the Germany and Austria scope check. Choose the legal context explicitly. The classification is based on your answers; unresolved prerequisites remain unresolved. It is not an authority decision.
- Checklist: measures and evidence
- Incident reporting: triggers, deadlines and channels
- Management: responsibility and liability
- ISO 27001: benefits and limits of a certificate
- Readiness check: seven self-reported answers on German duties
Our free technical checks provide selected external findings. They assess neither the entire organisation nor fulfilment of national obligations. An ISO certificate, a self-assessment and a technical report each have a distinct scope. View technical checks.