NIS2 has greatly expanded the group of EU companies carrying statutory cybersecurity duties. Not only classic critical infrastructure operators are covered, but also medium-sized companies in sectors such as waste management, food, manufacturing, digital services and managed ICT services.
Who is affected
Sector and size decide. Roughly: from 50 employees or more than EUR 10 million turnover and balance sheet in a covered sector, a company can be an important entity; large companies in highly critical sectors and critical facility operators are essential entities. In Germany the NIS2 implementing act entered into force on 6 December 2025, covering around 29,500 entities.
The duties
Entities must implement appropriate technical and organisational risk management measures, from policies and backups to crisis management and supply chain security. Significant incidents must be reported in stages: an early warning within 24 hours, a notification within 72 hours and a final report within one month. Management must approve the measures, oversee their implementation and undergo training. In Germany, entities already covered had to register with the BSI by 6 March 2026.
Sanctions
In Germany fines reach EUR 10 million or 2 percent of worldwide annual turnover for essential entities, and EUR 7 million or 1.4 percent for important entities. Management bodies also carry personal responsibility for implementation.
Relevance for Switzerland
NIS2 does not apply in Switzerland. Swiss companies are still affected in three ways: through subsidiaries in the EU, through certain digital services they provide in the EU, for which an EU representative may be required, and through the supply chain, because covered customers pass security requirements on to suppliers by contract. In Switzerland itself the ISA reporting obligation applies to critical infrastructure. For manufacturers of digital products the Cyber Resilience Act comes on top.