KI-Agenten.shopNIS2 readiness starts with ownership, logging, and clear accountability.
If AI agents affect operational processes, governance questions should be answered before rollout.
Short answer: who does NIS2 affect and what must be done?
Germany: NIS2 implementation has applied since 6 December 2025. Section 33(1) BSIG requires registration within three months of first or renewed qualification as a covered entity or commencement of covered registry services. For critical facilities, subsection 2 refers to the KRITIS umbrella act. Applicability and special rules require separate assessment.
The checklist walks through the applicability check, registration, risk management, reporting duties and the role of AI agents in producing evidence.
30 minutes one-to-one — pick your own slot
Instead of a fixed weekly session we talk about your case directly: one concrete bottleneck, 30 minutes on Zoom, free and without obligation.
After booking you receive the confirmation with the Zoom link. Free and non-binding, no purchase required.
Seven checkpoints
These questions should be answered before a production rollout.
- Is the use case clearly described and owned by the business?
- Are data sources, storage locations, and onward transfers documented?
- Are approvals defined for critical decisions?
- Are roles between business, IT, privacy, and management aligned?
- Are relevant actions logged and versioned?
- Is there a fallback and incident path?
- Are involved vendors and subprocessors transparently documented?
Review the checklist together
If you want, we can assess your concrete use case with you in a structured way.
Official sources for German NIS2 implementation
Checked on 16 September 2026. Entity type, special rules and the specific facts determine applicability. A reported grace period is not a statutory deadline extension.
Start potential analysis
If you want to prioritize a real process, a few clear inputs are enough for a strong first assessment.