NIS2 in Germany and Switzerland's cyber reporting duty: tasks for legal and compliance

Short answer: In Germany, NIS2 has applied through the new BSI Act (BSIG) since 6 December 2025, with no transitional period. Around 29,500 companies must register with the Federal Office for Information Security (BSI) under section 33 BSIG, report significant security incidents in three stages (24 hours, 72 hours, one month; section 32 BSIG), and management must approve and oversee the risk management measures and is liable for breaches (section 38 BSIG). Switzerland has no NIS2, but since 1 April 2025 operators of critical infrastructure must report cyber attacks to the Federal Office for Cyber Security (BACS) within 24 hours; fines have been possible since 1 October 2025.

This guide is for heads of legal, compliance leads and information security officers in Germany and Switzerland. It explains what NIS2 obligations in Germany mean in practice, what the Swiss Information Security Act requires and which legal workstreams follow.

Germany: who is covered, registration, duties, liability

The German NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) was promulgated on 5 December 2025 and entered into force on 6 December 2025. The core obligations sit in the new BSIG. Estimates put the number of covered companies and organisations at around 29,500.

Scope

Whether a company is an essential or important entity depends on its sector and size. Essential entities include companies in sectors listed in Annex 1 BSIG with at least 250 employees, or more than EUR 50 million annual turnover and more than EUR 43 million balance sheet total. Important entities are companies in sectors listed in Annex 1 or 2 with at least 50 employees, or more than EUR 10 million annual turnover and balance sheet total (section 28(1) and (2) BSIG). Operators of critical facilities and some digital services are covered regardless of size. The BSI offers an online self-assessment. Legal should document the outcome, even if it is negative.

Registration

Covered entities register in two steps: first an ELSTER organisation certificate via "Mein Unternehmenskonto", then registration in the BSI portal, which has been online since 6 January 2026 (section 33 BSIG). The statutory deadline expired on 6 March 2026. The BSI points out that the deadline has passed and asks covered entities that have not yet registered to do so immediately. The duty to register continues; failure to register can be fined up to EUR 500,000 (section 65(5) BSIG).

Reporting

Significant security incidents are reported to the BSI in stages: an early warning within 24 hours, a notification within 72 hours and a final report within one month at the latest (section 32 BSIG).

Management and fines

Management must approve and oversee the risk management measures and attend training regularly; if it breaches these duties, it is liable to the entity (section 38 BSIG). Fines reach up to EUR 10 million or 2% of worldwide annual turnover for essential entities; for important entities up to EUR 7 million or 1.4%. Failing to register can be fined up to EUR 500,000 (section 65(5) to (7) BSIG).

Switzerland: the reporting duty under the Information Security Act

Since 1 April 2025, operators of critical infrastructure must report cyber attacks to the BACS within 24 hours of discovery (Art. 74a et seq. of the Information Security Act, ISA). Reports are filed via the form on the Cyber Security Hub; missing details can be added within 14 days. The Federal Council brought the rules into force on 7 March 2025; exceptions are set out in Article 74c ISA and the Cybersecurity Ordinance.

• Who reports: operators of critical infrastructure and the authorities and organisations subject to the ISA, according to the BACS for example energy and drinking water suppliers, transport companies, and cantonal and municipal administrations.
• Sanctions: since 1 October 2025, fines of up to CHF 100,000 are possible, but only as a second step: where there are signs of a breach of the reporting duty, the BACS first sets a deadline; if it expires, the BACS issues a ruling with a new deadline and a reference to the penalty (Art. 74g ISA). A fine is imposed on anyone who intentionally fails to comply with that legally binding ruling (Art. 74h ISA).
• Financial sector: FINMA-supervised institutions also report material cyber attacks to FINMA: an initial report within 24 hours and a full report within 72 hours (FINMA Guidance 05/2020).
• Data protection: where an attack is likely to result in a high risk for the persons concerned, the controller notifies the Federal Data Protection and Information Commissioner (FDPIC) "as soon as possible" (Art. 24 FADP).

Germany and Switzerland compared

The two regimes differ mainly in who is covered and how far the duties go. The table sets out the key points.

Legal workstreams: contracts, policies, training

NIS2 in Germany and the Swiss reporting duty create six legal workstreams that can be clearly scoped and staffed on an interim basis.

1. Scope assessment: review sectors, entities and sites, document the reasoned outcome, in groups per entity and country.
2. Register or update registration: file any missing BSI registrations immediately and keep changes up to date.
3. Reporting process: set one workflow for the BSI, BACS, FINMA and data protection authorities, with classification criteria, responsibilities and templates. The 72 hours under Article 33 GDPR often run in parallel.
4. Supplier contracts: build security requirements, supplier reporting duties and audit rights into IT and outsourcing contracts.
5. Policies and evidence: update information security and reporting policies; document management resolutions approving the measures.
6. Management training: plan and record regular training under section 38 BSIG; the BSI published a curriculum for this in 2026.

For contracts and data protection questions, these workstreams link closely with IT and data protection law; see our page on data privacy and IT law. Financial institutions often combine the work with DORA, see DORA workstreams.

Roles and capacity

A NIS2 or ISA project needs legal capacity mainly during set-up and after incidents. Typical roles:

• Senior IT/cyber legal counsel: scope assessment, liability questions, papers for management.
• Contract lawyers: contract review and addenda with suppliers.
• Compliance officer: reporting process, policies, training records.
• Data protection specialist: interface with the GDPR and the Swiss FADP.

Alpinum Solutions provides these roles through staff leasing or freelancing, part-time or full-time, individually or as a team. Under staff leasing, the company directs the work; under freelancing, the professional works independently within the mandate. Selected profiles are usually available within 48 hours; the company and Alpinum agree the start date together.

Limits and risks

The duties under the BSIG and the ISA fall on the entity and, expressly in Germany, on its management. Interim professionals add capacity for analysis, contracts and processes; responsibility stays with the company. Technical security measures belong to IT security, not to legal. Alpinum is not a law firm.

Frequently asked questions about NIS2 and the Swiss reporting duty

Is my Swiss company affected by NIS2?

Not directly as a Swiss entity, because NIS2 is an EU directive. If your group has companies or branches in Germany that fall under the BSIG, registration, reporting and management duties apply there. For the size thresholds, data of linked enterprises is generally counted, unless the German company is independent of the group as regards its IT systems and processes (section 28(4) BSIG). In Switzerland itself, the ISA reporting duty applies if you operate critical infrastructure.

Is management personally liable?

In Germany, yes. Under section 38 BSIG, management must approve and oversee the risk management measures and attend training regularly. If it breaches these duties, it is liable to the entity. Resolutions, reports and training records should therefore be documented in full. The Swiss ISA has no comparable express rule; for companies it mainly sets the reporting duty.

What if we missed the registration deadline?

The statutory deadline expired on 6 March 2026. The duty to register continues, the BSI calls for immediate registration, and failure to register can be fined up to EUR 500,000 (section 65(5) BSIG). Affected companies should register immediately and document the reason for the delay.

How do BSI reporting and data breach notification interact?

Both duties apply side by side. A significant security incident is reported to the BSI under section 32 BSIG. If personal data is affected, the data protection authority must also be notified within 72 hours (Art. 33 GDPR). A single reporting process with clear roles ensures both deadlines are met.

Who must report cyber attacks in Switzerland?

Operators of critical infrastructure and the authorities and organisations subject to the ISA must report, for example energy and drinking water suppliers, transport companies and cantonal or municipal administrations. The report goes to the BACS within 24 hours of discovery. Exceptions are set out in Article 74c ISA and the Cybersecurity Ordinance.

Next step

Tell us where you stand on scope, registration and reporting. We will show you suitable profiles for the open workstreams.

• Regulatory compliance and regulatory change
• Data privacy and IT law project lawyers
• Regulatory calendar for legal and compliance
• Discuss your requirements

Last updated: 30 October 2026.