NIS2 in Germany: significant incidents go to the BSI within 24 hours.
Essential and important entities report significant incidents to the BSI in stages, starting with an early warning within 24 hours of becoming aware. Here are the stages at a glance.
Who must report
- Essential and important entities within the meaning of the BSIG; § 28 BSIG determines whether you are one.
- Registration with the BSI under § 33 BSIG: within three months of coming into scope; changes must be notified within two weeks.
- Additional reporting channels apply to energy (§§ 5c, 5d EnWG), public telecommunications (§ 168 TKG) and trust service providers (eIDAS).
The deadlines
| Stage | Deadline |
|---|---|
| Early warning | within 24 hours of becoming aware |
| Notification | within 72 hours of becoming aware |
| Intermediate report | at the BSI’s request |
| Final report | one month after the notification |
| Progress report | instead of the final report, if the incident is still ongoing after one month |
Reports go to the BSI through its reporting portal.
What the Reporting Desk does
The NIS2 (Germany) module runs every stage’s clock and drafts each report following the structure of the recipient’s form; every stage shows its legal source.
NIS2 (Germany)General information on §§ 28, 32 and 33 BSIG, as of October 2026. Not legal advice.