ITER/DEGermany
What the record establishes for Germany: the bodies an insider event is reported to, the channel each takes, and the act that transposes the NIS2 Directive, Directive (EU) 2022/2555.
Recipients
| Reached under | Body | Channel | Source |
|---|---|---|---|
| Data protection authorityGDPR, article 33 | Die Bundesbeauftragte für den Datenschutz und die Informationsfreiheit reported | — | edpb members |
| CSIRT or competent authorityNIS2, article 23 | Bundesamt für Sicherheit in der Informationstechnik, which is the competent authority, the CSIRT and the single point of contact at once reported | https://portal.bsi.bund.dechecked 2026-09-03 The BSI-Portal, where a registered entity both registers and reports. An entity that suffers a significant incident before it has registered reports instead through an online form in the Melde- und Informationsportal, at https://mip2.bsi.bund.de. Registration itself is never done in the MIP. | bsi nis2 meldepflicht |
| Financial supervisorDORA, article 19 | BaFin, with the Deutsche Bundesbank reported | — | eba competent authorities |
| Market authorityMAR, article 17 | Bundesanstalt für Finanzdienstleistungsaufsicht (BaFIN) reported | — | esma mar nca |
Transposition of NIS2 reported
| Act | Gesetz über das Bundesamt für Sicherheit in der Informationstechnik, BSI-Gesetz vom 2. Dezember 2025, BGBl. 2025 I Nr. 301, as amended |
|---|---|
| In force | 6 December 2025, the day after promulgation on 5 December 2025. The date is the Agency's statement of when the duties apply; the commencement article has not been read. |
| Recipient | Bundesamt für Sicherheit in der Informationstechnik, which is the competent authority, the CSIRT and the single point of contact at once |
| Moves a term | No. None found on the anchor. The early initial report is due within 24 hours nach Kenntniserlangung, and the detailed report within 72 hours on the same footing, so both run from becoming aware as the Directive has them. This is the opposite of the Italian reading, where the 72 hours run from the pre-notification. |
| Standing | This is the BSI's own account of the duty. The BSIG article has not been read. The act has been amended twice since, by the laws of 11 March 2026 and 23 July 2026; neither was read. |
| Source | bsi nis2 meldepflicht |
An event in Germany
The five types, each opened on this jurisdiction: the acts it obliges, the term on each, and where the report goes.