European Sovereignty Monitor

Policy and law

Germany's NIS2 cybersecurity law enters into force, covering 29,500 firms

Germany's NIS2 Umsetzungsgesetz entered into force on 6 December 2025, recasting the BSI Act. It brings about 29,500 firms in critical sectors under EU cyber duties, including BSI registration, incident reporting and curbs on untrusted critical components.

Verified Editor-read Bundesregierung (German federal government), 6 December 2025

What it does not test. This does not establish how the newly covered 29,500 firms are complying with the law in practice.

How this item counts. This item is dated before the index starts on 1 January 2026, so it does not count in the European Sovereignty Index.

How this item was made. Drafted by an AI system (Claude (Anthropic)) from the source cited above; read and approved by the editor on 2026-10-07. How the record is made

What the tags mean: VerifiedReportedAI-draftedAI-drafted, editor-readHuman-writtenWhat the tags mean

Previously in Policy and law

VerifiedOpinionAI-drafted DIGITALEUROPE's Bonefeld-Dahl: sovereignty rules need high fences only for sensitive fields ReportedOpinionAbroadAI-drafted FFO says Ofcom cannot enforce Online Safety Act fines on US websites VerifiedAI-drafted EU-backed OSOR report finds national open source policy now a sovereignty tool

All Policy and law news →