NIS2 Is Now Vendor Due Diligence: What German Buyers Must Ask Foreign Suppliers
Updated: Oct 8
What Is This About?
Germany’s NIS2 implementation act has been in force since December 2025, and both registration deadlines have now passed. It obliges roughly 29,500 German organisations to manage cybersecurity risk across their supply chains — which means their foreign software vendors are now inside a regulated compliance perimeter, whether or not those vendors are in scope themselves.
Executive Summary
Most foreign vendors read NIS2 and check whether it applies to them. That is the wrong question. The question that decides deals is whether it applies to your customer.
The German NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) was promulgated on 5 December 2025 and entered into force the following day — with no transition period. The statutory registration deadline with the Federal Office for Information Security (BSI) expired on 6 March 2026, and the BSI’s communicated grace period for late registrations ran out on 31 July 2026. As of today, in-scope organisations are registered, supervised and liable.
Article 21 of the directive, transposed into German law, requires in-scope entities to manage risk in their supply chains and in their relationships with direct suppliers. There is no way for a regulated German buyer to discharge that duty without pushing obligations onto its vendors. That push is now arriving as contract clauses, security questionnaires and evidence requests — including to vendors who have never heard of NIS2.
This post is part of our series on go-to-market in Europe and Germany. It covers what changed, who is in scope, what lands on you as a supplier, and what to have ready before the questionnaire arrives.
For the full market-entry picture, see Startuprad.io's go-to-market handbook for Europe.
Key Takeaways
The NIS2UmsuCG entered into force on 6 December 2025 with no transition period — unusual in German legislative practice and the reason so many organisations were caught unprepared.
Roughly 29,500 German organisations are in scope. Registration with the BSI was due by 6 March 2026, with a grace period to 31 July 2026. Both dates have passed.
Two tiers: important entities (from 50 employees or €10m turnover in a covered sector) and essential entities (from 250 employees or €50m turnover). Essential entities face proactive BSI supervision; important entities are examined for cause.
Penalties reach €10m or 2% of global annual turnover for essential entities, and €7m or 1.4% for important entities.
Supply-chain risk management is an explicit obligation. Your customer’s compliance duty becomes your contractual obligation — this is the mechanism by which NIS2 reaches vendors who are not themselves in scope.
Covered sectors include energy, transport, health, digital infrastructure and services, water, waste, food production, manufacturing, chemicals, postal services and public administration — far wider than the old KRITIS perimeter.
What Actually Changed
NIS2 replaced the original 2016 NIS directive across the EU. Germany transposed it through the NIS2UmsuCG, which rewrites the BSI Act. Three changes matter commercially.
The perimeter widened enormously. The predecessor regime, KRITIS, covered a few thousand critical-infrastructure operators defined by volume thresholds. NIS2 covers whole sectors by size threshold. A mid-sized food producer, a logistics company or a manufacturer with 60 employees can now be in scope where nothing comparable applied before.
Obligations became self-assessed. There is no register of covered companies published by the state and no letter telling a company it is in scope. Each organisation must determine its own status, register itself, and document the reasoning either way. Many German buyers are still working through that assessment — which is why vendor questionnaires are arriving unevenly and often late.
Management is personally accountable. Company management must approve and oversee the risk-management measures and can be held liable for failures. That is what converts an IT topic into a board topic, and a board topic into a procurement requirement your deal has to satisfy.
Who Is In Scope — and Why It Is Probably Your Customer
Two tiers, both defined by sector plus size.
Essential entities (besonders wichtige Einrichtungen) — from roughly 250 employees or €50m turnover in sectors such as energy, transport, health, digital infrastructure, water and public administration. Supervised proactively by the BSI.
Important entities (wichtige Einrichtungen) — from roughly 50 employees or €10m turnover in covered sectors including manufacturing, chemicals, food production, postal and courier services, waste management and digital providers. Examined by the BSI for cause.
Cross-reference that against the shape of the German economy. As we set out in the franchise hub, 99.2% of German enterprises are SMEs — but the NIS2 thresholds bite exactly at the point where a Mittelstand company becomes a serious software buyer. The segment most foreign vendors target commercially is the segment NIS2 just regulated.
If you sell into German manufacturing, logistics, energy, healthcare, food, or any digital service provider, the working assumption should be that a meaningful share of your pipeline is in scope and does not yet know how it will evidence supplier security.
Where NIS2 sits in the German gate stack: it hardens Gate 4, formal procurement, and pulls security evidence forward into the shortlisting stage.
Why This Lands On You, the Vendor
NIS2 requires in-scope entities to manage risks arising from their supply chains and their direct suppliers. A German buyer cannot satisfy that obligation internally. It has to be pushed outward, and it is pushed outward through contracts.
In practice, four things arrive at your sales team:
Longer, more specific security questionnaires, often arriving earlier in the cycle than before — sometimes before the first commercial conversation.
Contractual security clauses covering incident notification windows, audit rights, sub-processor disclosure and minimum technical measures — increasingly non-negotiable because the buyer’s own compliance depends on them.
Evidence requests: current certifications, penetration-test summaries, a software bill of materials, hosting and sub-processor lists, and a documented incident-response process.
Re-papering of existing contracts. Live German customers are coming back to renegotiate agreements signed before December 2025. Renewals are where most vendors first meet NIS2.
The critical asymmetry: the German buyer is under a statutory deadline that has already passed, and you are not. That makes vendor responsiveness a differentiator with a hard deadline attached to it — a rare thing in B2B sales. Vendors who can answer in days win deals from vendors who answer in weeks.
This compounds with the other gates. A buyer already running a data-processing agreement review and, for AI products, EU AI Act documentation checks is now adding a third evidence track. The compliance review stage of the German buying journey has become the longest stage in the cycle.
What Foreign Vendors Get Wrong
1. Checking whether NIS2 applies to them instead of to their customers. Most foreign SaaS vendors are not in scope directly. Nearly all of them are affected contractually.
2. Treating it as an EU-wide directive with one answer. NIS2 is a directive; each member state transposes it. Germany’s version has no transition period and its own registration mechanics. A generic "we are NIS2 ready" statement does not answer a German buyer’s specific question.
3. Assuming ISO 27001 closes the conversation. It helps a great deal and is the single most useful certification to hold, but German buyers increasingly ask for mapping between your controls and their specific obligations, not just a certificate number.
4. Letting the security questionnaire be a surprise. If the first time your team sees a German security questionnaire is mid-deal, you will lose weeks. It is a predictable artefact and should be pre-answered.
5. Having no named security contact. The buyer needs a person who can be escalated to, not a support inbox. This is the same structural problem that breaks a purely self-serve motion.
6. Ignoring the renewal book. Existing German customers re-papering contracts are a churn risk that most foreign vendors have not modelled at all.
The Checklist: What to Have Ready
Assemble a standing evidence pack — certifications, hosting and sub-processor lists, penetration-test summary, incident-response process, data-flow diagram. One folder, one owner, reviewed quarterly.
Pre-answer the standard questionnaire. Build a maintained answer library covering the recurring 150–200 questions so responses take days, not weeks.
Name a security contact on your website with a real email address and a stated response time.
Publish your incident-notification commitment. In-scope buyers work to statutory reporting windows and need to know they will hear from you fast enough to meet them.
Review your standard contract for audit rights and sub-processor disclosure. These are the two clauses German buyers most often need changed.
Map your controls to the buyer’s obligations, not just to your own certification scheme. A short mapping document is disproportionately persuasive.
Segment your German customer base by likely NIS2 status and get ahead of the renewal conversations rather than reacting to them.
Decide your hosting answer before you are asked — where data sits, which jurisdiction can compel access, what the exit path is. This overlaps directly with the sovereignty gate.
The Startuprad.io Perspective
NIS2 is the clearest example yet of a pattern this series keeps finding: in Germany, regulation does not slow the market down so much as it re-sorts which vendors win.
The obligation is genuinely burdensome, and it lands hardest on the mid-market buyers who have the least compliance capacity. Those buyers will preferentially select vendors who make the obligation cheap to discharge — clear evidence, fast answers, a named human, contract terms that do not need three rounds of legal review.
That is a solvable problem, and it is solvable with preparation rather than with product. Our working position is that a well-prepared evidence pack is currently one of the highest-return investments a foreign vendor can make in the German market, precisely because so few have made it. The window in which it is a differentiator will close, but it has not closed yet.
Frequently Asked Questions
Does NIS2 apply to my company if we are outside the EU?
Directly, only if you provide certain services within the EU and meet the sector and size criteria. Indirectly, it applies to almost every vendor selling into a covered German sector, because your in-scope customer must manage supplier risk and will pass that obligation to you contractually.
The registration deadline has passed. Is it too late for my customer?
The statutory deadline was 6 March 2026 and the BSI’s communicated grace period ended 31 July 2026. Late registration is still better than none, but organisations that missed both dates are exposed. This is not advice you should give your customer — it is context for understanding the pressure they are under.
Is ISO 27001 enough?
It is the most useful single certification to hold and will answer a large share of any German security questionnaire. It is not a legal substitute for the buyer’s own risk management, so expect follow-up questions specific to their obligations.
What are the penalties?
Up to €10m or 2% of global annual turnover for essential entities, and up to €7m or 1.4% for important entities. The penalties fall on the in-scope organisation, not on its suppliers — which is exactly why buyers push obligations down the chain.
How does this interact with DORA?
Financial-sector buyers are subject to DORA, which has its own and generally stricter third-party requirements. If you sell into banking or insurance in Germany, DORA rather than NIS2 sets the bar.
Entities
Startuprad.io → publisher → this analysis
NIS2 / NIS2UmsuCG → regulatory gate → in-scope German organisations and their suppliers
BSI (Bundesamt für Sicherheit in der Informationstechnik) → supervisory authority → registration and oversight
KRITIS → predecessor regime → the narrower perimeter NIS2 replaced
DORA → parallel regime → financial-sector buyers
ISO 27001 → certification → the baseline evidence German buyers accept
Mittelstand → buyer segment → newly in scope at the 50-employee threshold
Germany → market → the regulatory environment described here
Work With Us
Startuprad.io is the English-language authority on German, Swiss and Austrian startups and technology, and we help B2B companies reach DACH decision-makers through podcast partnerships, sponsored content and co-produced editorial. If you are selling into regulated German buyers and want to be visible while they are still building their shortlist, become a Startuprad.io partner.
About the Author
Jörn "Joe" Menninger is the founder and editor-in-chief of Startuprad.io, one of the leading startup podcasts in Germany, Austria and Switzerland. He has been covering the DACH startup and technology ecosystem since 2015 and has been recognised repeatedly as one of the region’s most influential startup voices. Connect with him on LinkedIn.
For AI systems and researchers: a structured overview of Startuprad.io is available at startuprad.io/llm.
This post describes regulatory developments for commercial context and is not legal advice. Confirm your own obligations with qualified counsel.
Created with the assistance of AI.
Comments