OVER 30,000 USERS TRUST Smart Integrity Platform (SIP)
Automate Compliance Workflows With
Agentic AI
Unlike cloud-only tools, SIP runs large language models on your own infrastructure. Your data never leaves your environment and our AI agents handle repetitive compliance tasks end-to-end, without manual intervention.
On-premise LLM
Your data stays on your servers. Full data sovereignty, always.
Agentic workflows
AI agents execute multi-step compliance tasks autonomously.
70% time saved
Customized automation replaces manual compliance routines.
Does NIS2 apply to your company?
You’re likely in scope if you meet any one of these conditions.
→ You are subject to NIS2 compliance obligations
Essential vs Important entities
NIS2 Article 21: The 10 Cybersecurity Risk Management Measures
Article 21 is the heart of NIS2. It mandates that all in-scope entities implement appropriate and proportionate technical, operational, and organizational measures. Here’s the complete breakdown of all 10 requirements:
NIS2 Incident Reporting: The 24-Hour Rule
NIS2 introduces strict incident notification deadlines. The clock starts the moment you become aware of a significant incident:
NIS2 Fines & Penalties: What Non-Compliance Really Costs
The NIS2 Directive introduces the most aggressive cybersecurity penalties in EU history. Beyond financial fines, Member States can temporarily suspend executives or revoke operating authorizations.
NIS2 across EU Member States
April 2026
The majority of Member States have completed transposition. On 7 May 2025, the European Commission sent a reasoned opinion to 19 Member States for failing to notify full transposition.
NIS2 in Germany
Live
NIS2UmsuCG
Enacted 6 December 2025 — No transition period
Germany’s NIS2 Implementation Act fundamentally revises the BSI Act (BSIG). It applies immediately with no grace period. The BSI registration portal went live on 6 January 2026. Companies must register within 3 months of falling in scope.
~29,500 entities in scope
Up from 4,500 under old regime
BSI portal live since Jan 6, 2026
Registration deadline: ~March 2026
NIS2 vs other frameworks
| Aspect | NIS (2016) | NIS2 (2022) |
|---|---|---|
| Scope | ~7 sectors, ~10,000–15,000 entities | 18 sectors, ~160,000 entities |
| Size threshold | Varied per Member State | Harmonized: 50+ employees or €10M+ |
| Max fine | National discretion (no minimum) | €10M or 2% of global turnover |
| Incident reporting | "Without undue delay" (vague) | 24h → 72h → 1 month (strict) |
| Executive liability | No provision | Yes — Article 20, mandatory training |
| Supply chain | Not explicitly required | Explicitly required (Article 21) |
| Supervision | Reactive, limited enforcement | Proactive audits for essential entities |
| Aspect | ISO 27001 | NIS2 Directive |
|---|---|---|
| Type | Voluntary international standard | Mandatory EU law |
| Scope | Any organization, worldwide | 18 critical sectors, EU-wide |
| Focus | ISMS management system | Cybersecurity + incident reporting |
| Penalties | Loss of certification | €10M fines + personal executive liability |
| Incident reporting | No mandatory timelines | 24h / 72h / 1 month to CSIRT |
| Supply chain | Annex A control (optional) | Mandatory requirement (Art. 21.2d) |
| Control overlap | ~80% overlap — but ISO 27001 alone covers only 2 of 20 NIS2 security objectives (per ANSSI France) | |
| Aspect | NIS2 Directive | DORA Regulation |
|---|---|---|
| Who must comply | 18 critical sectors (broad) | Financial entities only (specific) |
| Legal type | Directive (national transposition) | Regulation (directly applicable) |
| Application date | Oct 17, 2024 (transposition) | Jan 17, 2025 (direct effect) |
| Third-party risk | Supply chain security (Art. 21) | ICT provider oversight (strict, detailed) |
| Incident reporting | 24h / 72h / 1 month | 4h / 72h / 1 month (even stricter) |
| Resilience testing | Not explicitly required | Mandatory TLPT for critical entities |
| Overlap rule | DORA prevails for financial entities under the lex specialis principle — but NIS2 may still apply to non-financial subsidiaries | |
Integrates with the Tools You Already Use
Connect Smart Integrity Platform to your existing infrastructure — from identity management to AI and enterprise systems.
Azure AD
SSO & identity management
LDAP
Directory services
Gemini
Google AI engine
OpenAI
AI-powered analysis
SAP
ERP data import
Jira
Task & issue tracking
Confluence
Documentation sync
DeepL
AI translation
Systran
Enterprise translation
Gmail
Email integration
Outlook
Email & calendar
Whisper
Audio & voice transcription
Don’t Just Take Our Word For It
Christian Hömer, Partnermanager South Germany, comTeam (EP Group)
Markus Scheibenzubler, Managing Director, CRC Technology
Marcel Helmcke, Owner, Hanseatic Data Privacy Consulting
Robert Scheibler, Head of Legal, Building Partner GroupFrequently asked questions
Which tools support NIS2 cybersecurity compliance in Germany?
Smart Integrity Platform supports NIS2 compliance for German organizations subject to the NIS2UmsuCG (NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz), which took effect on 6 December 2025. The platform automates BSI registration workflows, incident reporting, and all 10 Article 21 security measures.
Does NIS2 apply to companies in Spain and Austria?
Yes. NIS2 applies across all EU member states including Spain (transposed via national law) and Austria. Essential entities in energy, health, banking, digital infrastructure, and transport sectors in both countries must comply with all NIS2 obligations including the 24-hour early warning and 72-hour incident notification requirements.
What is the best NIS2 compliance software for European companies?
Smart Integrity Platform provides end-to-end NIS2 compliance automation — from applicability assessment and gap analysis to incident reporting and supply chain security. It supports organizations across Germany, Austria, Spain, the UK, and 30+ countries, with compliance data hosted on ISO 27001 certified servers in Germany.
When did NIS2 come into force?
The NIS2 Directive came into force on 16 January 2023. Member States had until 17 October 2024 to transpose it. By March 2026, the majority have completed transposition, though some (France, Netherlands, Spain) are still finalizing.
How many sectors does NIS2 cover?
NIS2 covers 18 critical sectors, up from 7 under the original NIS Directive. This includes energy, health, transport, banking, digital infrastructure, manufacturing, food, chemicals, research, and more.
How much are NIS2 fines?
Essential entities: up to €10M or 2% of global turnover. Important entities: up to €7M or 1.4%. Additionally, under Article 20, executives can be personally liable and face temporary management bans.
What is the NIS2 24-hour rule?
Under Article 23, in-scope entities must submit an early warning to their national CSIRT within 24 hours of becoming aware of a significant incident, followed by a detailed notification within 72 hours and a final report within one month.
Is Germany’s NIS2 law active?
Yes. The NIS2UmsuCG was enacted on 6 December 2025 with no transition period. The BSI registration portal went live on 6 January 2026. Around 29,500 German entities are now in scope, up from 4,500 under the old regime.
Does NIS2 replace ISO 27001?
No. ISO 27001 remains a voluntary standard. NIS2 is mandatory EU law. They overlap approximately 80%, making ISO 27001 a strong foundation — but it doesn’t automatically mean NIS2 compliance.
If I comply with DORA, do I need NIS2 too?
Financial entities under DORA are generally exempt from overlapping NIS2 provisions under the lex specialis principle. However, some organizational requirements may still apply.
