{"id":5613,"date":"2026-07-27T15:10:01","date_gmt":"2026-07-27T13:10:01","guid":{"rendered":"https:\/\/weserland.eu\/?p=5613"},"modified":"2026-07-27T15:08:34","modified_gmt":"2026-07-27T13:08:34","slug":"nis2-directive-what-chemical-companies-need-to-know","status":"publish","type":"post","link":"https:\/\/weserland.eu\/en\/2026\/07\/nis2-directive-what-chemical-companies-need-to-know\/","title":{"rendered":"NIS2 Directive: What Chemical Companies Need to Know"},"content":{"rendered":"\ue863<\/span> 3<\/span> min<\/span><\/span>

Cybersecurity in the chemical industry is lagging behind reality. Whilst professional hacker groups have massively stepped up their attacks on chemical plants in recent years, a dangerous complacency still prevails in many production halls and boardrooms. As early as 2020, an industry review by the German Insurance Association (GDV) revealed glaring gaps: particularly among small and medium-sized enterprises, there was all too often a lack of clearly designated security officers and tried-and-tested emergency plans. With the European Union\u2019s NIS2 Directive, the era of voluntary compliance is now definitively over. As chemical companies form the backbone of critical infrastructure, the legislator is now holding the sector strictly to account.<\/p>\n

The End of the Grace Period: From EU Draft to Binding Law<\/h3>\n

The acronym NIS2 (Network and Information Security) refers to the comprehensive overhaul of the first EU Cybersecurity Directive from 2016. Following the official EU launch in early 2023, Member States were originally given until October 2024 to implement the directive at national level. Germany missed this deadline by a considerable margin \u2013 but then pulled off a sprint: the national implementation act (NIS2UmsuCG) passed the Bundestag and Bundesrat in November 2025 and came into force on 6 December 2025. What makes this remarkable is that there was no transition period. These obligations have applied from day one.<\/p>\n

The implications for the German economy are enormous. And: the regulatory protection provided by the Federal Office for Information Security (BSI) has suddenly expanded from 4,500 to around 29,500 companies. Anyone who missed the initial statutory registration deadline is on thin ice: the standard deadline ended on 6 March 2026. Given the current grace period, which expired on 31 July 2026<\/b>, time is running out fast for latecomers. Ignoring the requirements threatens the very existence of the business. Violations carry the risk of fines of up to ten million euros or two per cent of global annual turnover. Particularly critical: in the event of a serious breach, senior management is personally and unlimitedly liable with their private assets.<\/p>\n

Who Must Act? The \u2018Size Cap\u2019 Rule Decides<\/h3>\n

Whether a chemical company falls under the new rules is determined by the so-called \u2018Size Cap\u2019 rule under Section 28 of the BSI Act (BSIG). As the chemical industry is classified as a sector of high criticality, strict thresholds apply here: the full-time equivalents from the most recent annual accounts are used for the calculation. Operators of facilities that are already classified as critical infrastructure (KRITIS) automatically fall into the highest category, regardless of their size. Even small subsidiaries within corporate structures may be covered via the overall economic entity. Only genuine micro-enterprises are excluded.<\/p>\n