NIS2 is an IT law. Two of its ten duties still end at your door.
Germany's revised BSI Act has applied since 6 December 2025 with no transition period, and covers over 29,000 companies instead of 4,000. Section 30(1) speaks exclusively of information systems — but two of the ten measures in subsection 2 have a side no IT provider covers.
