NIS2 is an EU directive on cybersecurity that has been in effect in Germany since December 2025. It requires companies with 50 or more employees in 18 sectors to implement specific IT security measures—with personal liability for management.