NIS 2 — what it requires and who it applies to
The NIS 2 Directive (EU 2022/2555) is the EU's mandatory cybersecurity framework for organisations operating in sectors considered essential or important to society and the economy. In Germany, it has been transposed into national law through the NIS2UmsuCG, which entered into force on 6 December 2025 with no transition period.
Organisations with 50 or more employees or annual turnover exceeding EUR 10 million operating in a covered sector are generally in scope. Essential entities — those in high-criticality sectors such as energy, healthcare, water, digital infrastructure, and transport — face stricter obligations and closer regulatory scrutiny. Important entities in sectors including postal services, food, manufacturing, and chemicals face proportional but still binding requirements.
AuditVantage provides entity classification support, helping organisations determine whether they are in scope, which entity category applies, and what specific obligations arise from their sector and operational profile.
Management liability: Under the NIS2UmsuCG, management bodies can be held personally liable for compliance failures. This is not a theoretical risk — it is a statutory obligation that applies to managing directors and senior executives.
Article 21 security measures
NIS 2 requires organisations to implement appropriate and proportionate technical, operational, and organisational measures to manage cybersecurity risks. Article 21 specifies minimum security measures — including risk analysis, incident handling, business continuity, supply chain security, access control, cryptography, and multi-factor authentication.
AuditVantage conducts gap assessments against Article 21 requirements, identifies control deficiencies, and supports implementation of the required measures in a way that is proportionate to the organisation's size, risk exposure, and operational context. For organisations already certified to ISO 27001, the assessment identifies gaps between existing controls and NIS 2 obligations, avoiding duplication of effort.
Incident reporting: NIS 2 requires significant incidents to be notified to competent authorities within 24 hours of awareness (early warning), with a full report within 72 hours. AuditVantage helps organisations build the processes, escalation chains, and documentation needed to meet these timelines.
EU AI Act — obligations and deadlines
The EU AI Act (Regulation 2024/1689) is the world's first comprehensive legal framework for AI. It applies to providers, deployers, importers, and distributors of AI systems used in the EU. Obligations vary by risk category and actor type — with the strictest requirements applying to high-risk AI systems listed in Annexes I and III.
High-risk AI systems — including those used in employment, credit, biometric identification, education, law enforcement, and critical infrastructure — must undergo conformity assessment, maintain technical documentation, implement human oversight measures, and register in the EU database before market placement or deployment.
AuditVantage supports organisations in classifying their AI systems under the Act, identifying applicable obligations, assessing readiness, and preparing the documentation and governance processes required for conformity.
Key dates already in effect: Prohibited AI practice provisions applied from 6 February 2025. GPAI model obligations apply from 2 August 2025. Full high-risk AI system requirements — including conformity assessment — apply from 2 August 2026. Organisations deploying high-risk systems should be in active preparation now.
Germany — NIS2UmsuCG and BSI
Germany's national transposition of NIS 2 introduces specific registration requirements, sector-specific thresholds, and regulatory enforcement by the Bundesamt für Sicherheit in der Informationstechnik (BSI). The NIS2UmsuCG includes provisions beyond the minimum requirements of the directive — including KRITIS rules and sector-specific implementing guidance.
AuditVantage advises organisations on the German regulatory context, including BSI registration procedures, KRITIS-specific obligations, and the relationship between NIS2UmsuCG requirements and existing frameworks such as ISO 27001 and IT-Grundschutz.
Multi-framework integration
Most organisations facing NIS 2 also operate under other compliance obligations — GDPR, ISO 27001, TISAX, SOC 2, or the EU AI Act. AuditVantage designs integrated programs that map common controls across frameworks, reducing duplication and overall compliance costs. A single gap assessment can provide baseline coverage across multiple regulatory obligations, with framework-specific gap analysis conducted from that foundation.