NIS2 has been in force in Germany since December 2025. According to the BSI, around 29,500 companies and public bodies fall under the law. For the NIS2 Readiness Study 2026, Kertos surveyed decision-makers and specialists at German companies with 50 to 1,000 employees between August and September 2026, all operating in sectors listed in Annex I of the NIS2 Directive. The report shows where implementation actually stands, who owns it, and why it stalls.
What you will find in the report:
- 49 % of the companies surveyed have not started implementing NIS2 or are still assessing whether they are affected
- Only 4 % say they have fully implemented NIS2 and registered with the BSI
- 37 % knew neither that NIS2 is in force nor the 31 July 2026 registration cut-off
- In 63 % of companies, NIS2 sits with the Head of IT. 84 % have neither an in-house nor an external CISO
- 39 % name overlapping regulations as the biggest constraint, only 6 % the supply chain
- Companies that have not started are waiting above all for more regulatory clarity. Lack of budget comes last on the list
The report contains all results with charts, an overview of the legal requirements under the German BSIG, and an assessment from the Kertos experts on what companies should do now.
Methodology: Online survey, 3 August to 4 September 2026, n = 51, Germany, companies with 50 to 1,000 employees in sectors listed in Annex I of the NIS2 Directive.
