5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026
Implement NIS2 with an applicability check
Covered, registered, documented?
Are we covered by the BSI Act (BSIG), did we have to register with the BSI and what must be decided internally now? We check applicability, entity type, group and supply chain links and the registration in the BSI portal.
Please enter a short description first.
Initial contact is free of charge. We will inform you expressly in advance about any costs.
Response within 24 hours on working days
As of: 23 October 2026
NIS2 status1 of 5
- Available
Sector and service Digital infrastructure - Thresholds per companyCheck
- Internal IT service providerMissing
- BSI registrationDeadline passedMissing
- Management memoCheck
Checkpoint: Registration open, responsibility unclear
- 1Assess the situationCompanies and services
- 2Assess statusEntity type
- 3Finalise the memoRegistration, steps
Schematic illustration of a NIS2 review. Simplified example.
We check NIS2 applicability for
- SMEs
- Corporate groups
- IT service providers
- Utilities
Key points at a glance
- Since 6
- December 2025, the German NIS2 Implementation Act has applied.
- For entities already covered, the first practical three-month registration limit passed on 6
- March 2026.
- The question is whether your company is an important or essential entity and which implementation and evidence track follows from that.
- ITMR provides a robust basis for decisions for management, compliance, security and the next implementation steps.
- Your contact is Dr. Alexander Pleh and his team. He is a specialist lawyer for IT law and family law. Response within 24 hours on working days.
- NIS2
- EU directive on cybersecurity. It obliges many companies to carry out risk management and reporting.
- DSGVO
- The EU General Data Protection Regulation. It governs how companies may process personal data.
Legal status
Why is NIS2 now a management issue?
If purchasing, security, compliance or management have no robust answer, NIS2 turns into a real management problem.
Since entry into force, a documented implementation line counts, not observation.
The EU transposition deadline for the NIS-2 Directive expired on 17 October 2024. In Germany, the implementation act entered into force on 6 December 2025. For entities concerned, NIS2 is therefore an ongoing task of classification, registration, reporting and governance.
Anyone who had not made a robust classification by March 2026 should make up for the decision, document responsibility and put open registration steps in a traceable order. For companies whose applicability only arises later or whose structure changes, the review remains just as relevant.
You can use the NIS-2 check in advance to see whether your company is covered and which obligations fall on management. If your case is still open, a short description in the form is enough.
For the broad classification of IT law and adjacent regulation, our main IT law page is the right starting point. This page deals with the narrower NIS2 question of applicability, registration obligation, missed deadlines and the management decision.
- In force since
- 6 December 2025
- Registration
- 3 months, until 6 March 2026
- Sectors
- 18 according to the European Commission
- Result
- Management memo and registration
NIS2 is not a pure IT security project. Companies concerned must review sector, size, role, group structure, criticality, supply chain, reporting channel, responsibilities, security measures and evidence together.
For legal practice, it matters that NIS2 requires organisation as well as technical safeguards. Companies must assign responsibilities, document security concepts, manage suppliers, classify incidents quickly, test reporting chains and involve management and business units.
According to the European Commission, risk management measures, reporting obligations, supervision, enforcement and the responsibility of top management are the core elements. In Germany, around 29,850 organisations are estimated to be covered. By the end of the registration period, around 11,500 companies and institutions had registered with the BSI according to a report.
Describe your case using the form. We will get back to you within 24 hours on working days.
How it works
How do we clarify your NIS2 status?
Three steps to a robust decision.
01
Assess the situation We record companies, services, sector and company size.
02
Assess status We assess applicability, entity type, registration obligation and obligations from a legal perspective.
03
Finalise the memo You receive a management memo, registration steps and robust next steps.
What the mandate must produce
- 1
Basis for analysis Companies, services, sector, thresholds, outsourcing, group and platform roles. We work with your existing documents and ask targeted questions where information is missing.
- 2
Legal classification Important or essential entity, registration obligation, reporting and internal responsibilities. We substantiate the classification so that it holds up to questions from the BSI, customers or auditors.
- 3
Management track Decision memo, draft resolution, responsibility map, documentation and catch-up needs. The documents are structured so that management and supervisory bodies can adopt them directly.
How long does it take? Most work steps are completed within a few working days. How quickly it goes depends on the scope and on your feedback. Do you have a fixed date, such as a launch? Tell us when you send your enquiry and we will plan for it.
Service package
What does the NIS2 review do for you?
Service package NIS2 applicability
Applicability first Without a robust classification, registration, reporting obligations and the action plan remain vague.
Trace the registration Open, stalled or late steps belong in a documented catch-up and approval track.
Operationalise obligations Risk management, reporting channels, supply chain links and management responsibility must be reflected in the organisation.
Basis for decisions Not a loose memo, but a documented basis for audits, customers, insurers and the authority.
- For whom
- Management, compliance, security
- First response
- within 24 hours on working days
- Costs
- We tell you the costs transparently before you instruct us.
- Not included
- Technical security audits. Available through partners on request.
Who delivers what and who decides
- Companies and organisation chart
- Services and turnover
- Headcount
- Registration status
- Applicability check
- Management memo
- Registration preparation
- Communication with the BSI on request
- Management
- The BSI as supervisory authority
How does instructing us work?
- 1
Initial assessment You describe your case using the form. We assess where you stand. Initial contact is free of charge.
- 2
Quote Before work begins, we tell you the scope and costs transparently.
- 3
Court proceedings separately Court proceedings and representation before authorities are agreed separately.
Typical company situations
When is an external applicability check worthwhile?
Four situations in which companies contact us.
Management does not want slides, but a documented decision on whether a company or group is to be classified as an important or essential entity.
Enterprise customers, the parent company, insurers or investors ask about status, registration, responsibilities and evidence, although there is no clear internal line yet.
Whether an operating unit, holding company, internal IT service provider or several companies are covered cannot be read from an industry label. What matters is the actual service and organisational structure.
In our experience, the process fails less because of the law and more because of ELSTER, roles, responsibilities, missing management approval or because nobody wants to take responsibility for the classification.
What must be decided
What determines NIS2 applicability?
In our experience, the classification, less a single provision.
Sector and service An industry label is not enough. What matters is which services are actually provided, which sector they belong to and whether exceptions, special roles or sector-specific rules apply.- Size and unit In our experience, thresholds are applied at the wrong level. Besides turnover and headcount, what counts is which company or group structure the review must refer to.
- Group and supply chain Shared services, central platforms, subsidiaries and outsourced operating models create borderline cases. In our experience, these are decided internally too roughly or too hastily.
- Evidence and resolution Anyone who does not document applicability, registration or non-applicability in a traceable way creates unnecessary friction with auditors, customers, insurers or the authority.
Checkpoints
Which checkpoints apply to your company?
The status block does not replace a detailed review of the entity concept, sector allocation and special cases.
Sector or special case Does the company fall within a NIS2 sector or a special case?Thresholds and group Are thresholds, affiliated companies, shared services or group roles classified correctly?Scope of obligations Which systems, services, sites, supply chains and service providers determine the scope of obligations?
Reporting channels and responsibility Are reporting channels, responsibilities and management responsibility documented?Risk management Are there traceable risk management measures and a robust evidence trail?Next decision If applicability, registration or implementation status are open, first clarify the set of obligations. Which unit is covered, what has been done, what still needs to follow?
Catch-up track
What to do if the registration is still open?
Playing it down does not help. Decide on applicability quickly, document the state of knowledge and organise the registration. It becomes critical if applicability is suspected but was never formally decided.
Which company must act? Who is covered, who may register, which representation and access rights exist and which data must be provided to the BSI?
Decision memo, contact persons, company data, responsibility map, escalation paths and traceable evidence of how the situation was assessed internally.
In our experience, an open or stalled registration shows that scope, responsibility, representation or management approval were not clarified beforehand. This is where the legal classification comes in.
Even after registration, evidence, risk management measures, supply chain and service provider links, incident response, governance, reporting processes and documentation remain relevant.
Data basis
Which key figures and deadlines shape NIS2?
The overview replaces the former interactive monitor. Editorial classifications are not official measurements.
| Dimension | Core value or obligation | Source | Classification |
|---|---|---|---|
| NIS2 sectors | 18 critical sectors | European Commission | First applicability filter |
| Organisations covered | around 29,850 in Germany | Reports citing the Federal Government and the BSI | Broad relevance for companies |
| Registrations by the deadline | around 11,500 | Report citing the BSI | Compliance gap visible |
| Entry into force in Germany | 6 December 2025 | NIS2UmsuCG | Start of national obligations |
| Registration deadline | 3 months, until 6 March 2026 | Act and BSI | BSI registration |
| Early warning | within one day (24 hrs) | Section 32 BSIG | Significant security incident, immediate classification |
| Follow-up report | 72 hours | Reporting obligations | Technical and legal assessment |
| Final report | 1 month | Reporting obligations | Evidence and lessons learned from the incident |
| Management responsibility | Responsibility of top management | European Commission | A topic for management |
| Supply chain | Supply chain security | European Commission | Service providers and critical components |
Interfaces
When does the focus shift to another mandate?
Once applicability has been clarified in principle, these services take you further.
When security organisation, measures under Section 30 BSIG, incident response, the supply chain or crisis response shape the mandate.
When role models, governance, auditability, legal registers and overarching management of obligations are the focus.
When the focus is on personal data, communication with authorities or a parallel GDPR situation. In the case of an acute breach, data breach assistance takes you further.
Legal framework
Which deadlines and sources apply to NIS2?
Already expired. The EU transposition deadline ended on 17 October 2024. For entities covered when the German act entered into force, the three-month registration limit passed on 6 March 2026.
Since 6 December 2025. The German implementation act is in force. Companies concerned must reflect applicability, classification, registration, reporting channels and risk management robustly.
To be clarified now under Section 28 BSIG. Sector, thresholds, special cases, group structure, entity type, BSI registration, internal responsibility and management approval.
Under the German implementation framework, significant security incidents are handled under Section 32 BSIG with an early warning within one day, a follow-up report within three days and a final report after one month. The registration obligation follows from Section 33 BSIG, management responsibility from Section 38 BSIG. Anyone who breaches management duties risks personal liability towards the entity.
- Federal Law Gazette Act implementing the NIS-2 Directive.
- BSI applicability check Initial orientation, no substitute for legal classification in borderline cases.
- BSI-Registrierung Portal and procedural notes.
- Directive (EU) 2022/2555 NIS-2 Directive on EUR-Lex.
- European Commission on NIS2 Sectors and core elements.
- BSI on the entry into force Press release of 5 December 2025.
- Federal Government on NIS2 Implementation act and applicability.
- Report on BSI registrations Figures on registrations and estimated applicability.
Limits
What does the NIS2 review not cover?
We clarify status, registration and the management track. Some points remain with you.
- 1
No security audit You review technical measures with your security team or service providers.
- 2
Status of the review We check authority practice and key figures as of the date of the review; this page reflects the status of 1 May 2026.
- 3
The decision remains yours Management responsibility cannot be shifted to us or to IT.
What you should prepare
- Overview of companies and services.
- Turnover and headcount per unit.
- Status of the BSI registration and ELSTER access.
- Previous internal assessments.
Your contact
Lawyer · Partner · Specialist lawyer for IT law and family law · AI officer [DEKRA]
Pleh profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124
ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.
What clients say
5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026
“I needed advice by phone. Prompt call-back, clear statement, immediate help. Excellent on a personal level, I would turn to Dr. Pleh again at any time. Many thanks” (translated from German)
“I had a trademark application filed and am very satisfied. Thanks to the flat fee, I knew in advance what it would cost and what I would get. Gladly again at any time!” (translated from German)
“Mr Pleh advised us excellently, was very attentive and took a lot of time for us. That is how legal support should be.” (translated from German)
FAQ
What do companies ask about NIS2?
Is the BSI applicability check enough?
It can be very helpful for initial orientation. In borderline cases, group structures, internal IT service providers, mixed activities or a management decision that needs documenting, a pure self-assessment is in our experience not enough.
Do we still have to register if the deadline has passed?
If your company is required to register, the obligation does not lapse when the deadline passes. This applies in particular if applicability already existed at entry into force. Prepare the catch-up process in a structured way and document the internal decision.
If the BSI registration has already been missed, we describe the next steps in the article NIS-2 registration missed.
Can we be covered without a classic critical infrastructure (KRITIS) link?
Yes, that is possible. NIS2 covers far more companies than the former KRITIS regime. What matters are the sector, the services provided, company size and the specific organisational structure.
Who must take responsibility for the decision internally?
Legal and organisational responsibility cannot effectively be hidden in IT. Applicability, registration and the resulting set of obligations belong in a traceable management and governance track.
Which documents do we need for registration?
That depends on the structure and the type of entity. In practice, company data, contact persons, representation and access questions and internal responsibility must be prepared. In our experience, this is where many processes stall.
When is cybersecurity or IT compliance the right starting point?
When applicability has been clarified in principle and security measures, auditability, supply chain management or incident response now have to be built. These areas then shape the mandate more than the pure NIS2 classification.
Next step
Do you want to classify your NIS2 status now?
If it is still open within the company whether a company is covered, who has to register or how management documents the situation, the classification should not be postponed any further. In our experience, a clear scope memo saves more time and friction than any internal round without clear responsibility. Your contacts are Dr. Alexander Pleh, Jean Paul P. Bohne and Dominik Skornia with their team. Dr. Alexander Pleh and Jean Paul P. Bohne are specialist lawyers for IT law, Dominik Skornia is a lawyer and external data protection officer.
Helpful for your enquiry
- Sector and services
- Companies and group role
- Registration status
- Previous decisions
You can also submit documents after our first response.
Briefly describe your NIS2 case
For companies that need to decide and document their NIS2 situation robustly.
Useful if applicability, registration, group role or a missed deadline have not been decided robustly internally.
Related services
NIS-2-Check Initial self-assessment.Cybersecurity Security organisation and incident response.IT-Compliance Governance and auditability.Data protection law GDPR situations.Data breach assistance Acute breach.IT-Recht IT law overview.TK-Anbieter-Compliance TKG obligations for providers.
From our blog: NIS-2 registration missed · Report a cyber incident