NIS2 and telecom infrastructure: obligations, deadlines and implementation

Your company is affected by NIS2 if it operates in one of the 18 covered sectors and has at least 50 employees and at least 10 million euros in annual turnover or balance sheet total. The sectors include, among others, digital infrastructure, ICT services, energy, transport, health and finance. Operators of critical facilities are considered affected regardless of their size. Classification is done through a self-assessment. If the assignment remains unclear, you should have your sector, size class and activity assessed in a structured way.

The registration deadline with the BSI expired on 6 March 2026. It began when the law came into force on 6 December 2025 and ran for three months. Registration is done through the BSI reporting and information portal, which has been online since 6 January 2026. A prerequisite is an ELSTER organisation certificate. Anyone who missed the deadline must register immediately, since even late registration can be penalised with a fine.

Anyone who does not implement NIS2 risks substantial fines and personal liability of management. For essential entities, penalties are up to 10 million euros or 2 percent of global annual turnover, whichever is higher. On top of this come the BSI’s enforcement and supervisory powers, up to the temporary prohibition of activities. Late registration or missing incident reports are also sanctionable. Reputational damage and loss of customer trust often follow as well.

Under NIS2, management bears direct responsibility and is personally liable. It must approve the risk management measures, oversee their implementation and undergo regular cybersecurity training. This duty cannot be fully delegated. Breaches can lead to personal liability of the governing bodies. NIS2 thus makes cybersecurity a matter for top management and anchors it at board and management level. Documented involvement of management in decisions is therefore a central proof of compliance.

As a supplier, you can be indirectly affected by NIS2, even if you do not reach the thresholds yourself. NIS2 explicitly obliges affected companies to secure their supply chain. Your customers will therefore pass security requirements on to you contractually and demand evidence. Anyone who fails to meet these requirements risks losing contracts. It is therefore worth aligning your own security organisation with NIS2, even if the law does not formally apply to you directly.

NIS2 and your telecom infrastructure are closely connected, because networks and communication services are among the central audited risk areas. The minimum requirements under Section 30 BSIG include supply chain security, network segmentation, multi-factor authentication and secured communication, among others. These very points directly concern your connections, carriers and internal networks. A secure, documented telecom infrastructure covers a large part of the obligations. It is therefore not a sideshow but a foundation of the entire NIS2 implementation.