Germany turned NIS2 on with no grace period, and device makers are in scope

Germany transposition law, the NIS2UmsuCG, entered into force in early December 2025 after Bundesrat approval. Immediate effect, no general transition period.

Manufacture of medical devices and IVDs is a NIS2 Annex II sector, so mid-size and large device manufacturers with German operations became important entities overnight: BSI registration, risk-management measures, management accountability, and three-stage incident reporting with a 24-hour early warning, a 72-hour notification, and a final report. This is corporate obligation, separate from anything MDR asks of the product. Two reporting regimes, two owners, and they do not substitute for each other.

If you have German operations over the size threshold, registration and an incident-reporting process were due when the law switched on, not on a roadmap.