NIS2 missed? What machine builders have to catch up on

If you have not registered with the BSI, the short answer is: do it now. The statutory deadline passed on 6 March 2026, and the extension the BSI granted ran out on 31 July 2026. A missed deadline does not end the obligation — it turns non-registration into a fineable offence in its own right. And the reporting duties apply whether you are registered or not.

You are not alone in this. Of roughly 29,500 affected companies in Germany, about 11,500 had registered by the March cut-off. The gap was still there after the extension.

Does this even apply to my company?

The German NIS2 implementation act (NIS2UmsuCG) has been in force since 6 December 2025, with no transition period. It reaches far beyond classic critical-infrastructure operators.

As a rule of thumb: companies in one of the sectors listed in Annexes 1 and 2 of the BSIG — which include manufacturing, machine building among it — with at least 50 employees or more than €10 million in revenue or balance sheet total are frequently in scope.

The rule of thumb does not replace the check. The BSI provides a free, anonymous scope assessment; it takes a few minutes and is the right first step before anyone sets up a project.

NIS2 and the CRA are two different things

These get mixed up regularly, which costs time and puts effort in the wrong place. Both affect machine builders, but at different points:

In short: NIS2 asks how safely you work. The CRA asks how safe what you sell is. Plan them together and you do the work once. What the CRA requires in concrete terms is on our Cyber Resilience Act page.

What to do now, in this order

1. Check whether you are in scope. The BSI self-test, a few minutes. Document the result — even a “not in scope” needs to be evidenced later.
2. Register. Through the BSI’s reporting and notification portal (muk.bsi.bund.de). It needs an ELSTER organisation certificate, and getting one takes time, so start that first.
3. Become able to report. Section 32 BSIG requires, for a significant security incident, an early warning within 24 hours, a qualified notification within 72 hours and a final report within one month. These clocks start when you learn of the incident — not when you fix it.
4. Document your risk management. Section 30 BSIG names ten areas of measures, from risk analysis through incident handling and business continuity to access control and supply chain security. What matters is evidence: a decision that exists only in someone’s head cannot be defended afterwards.
5. Involve the management board. Section 38 BSIG makes this a board matter: management must approve the measures, monitor their implementation and attend training. This one cannot be delegated.

And what does this have to do with the controller?

More than it first looks. Three of the ten areas of measures come down to being able to say the same things about your own OT that you can say about your IT:

• Which software runs where? A plant whose software version nobody knows cannot be written into a risk analysis.
• How does a security update get there? If the answer is “somebody drives out”, the 24-hour clock has run out before the first measure takes effect.
• Who changed what, and when? Without roles, permissions and a log there is no evidence, only recollection.

Those three questions are exactly what logiccloud ORCHESTRATE answers: record devices and software versions centrally, roll out updates in a controlled way — with rollback when something goes wrong — govern access through roles, and log changes. The building blocks are IDENTIFY, CONTROL, UPDATE, MONITOR and AUDIT, and they work with existing systems too, not only with controllers from logiccloud.

That does not make you NIS2-compliant by itself — compliance is an organisational achievement, not a product feature. It does answer the questions where technical evidence otherwise falls apart.

The next step

If you cannot say with confidence which software version is running on which plant in the field right now, start there. Everything else in NIS2 builds on that answer.

Talk to us about your installed base — we will look together at which evidence your current setup can actually produce.

Sources, checked on 12 September 2026

• Statutory text of sections 30, 32, 33 and 38 BSIG: https://nis2-umsetzung.com/bsig/32-bsig
• BSI registration, deadlines and the extension to 31 July 2026: https://www.secjur.com/blog/nis2-umsetzung
• Registration status (approx. 29,500 affected, approx. 11,500 registered): https://locaterisk.com/de/nis2-bsi-registrierung-frist-2026
• What applies when registration was missed: https://itmr-legal.de/blog/nis2-registrierung-verpasst

This article is a technical explainer, not legal advice.