On October 28, 2026, the German Federal Office for Information Security (BSI) introduced a model curriculum for mandatory management training under section 38 of the BSI Act (BSIG).
The rules under section 38 of the BSIG place leadership teams of important and essential entities directly into responsibility. Members of the executive board are legally required to independently implement cybersecurity risk management measures and continuously monitor compliance. The regulations also mandate regular attendance at relevant training sessions. In the event of a breach of duty, management is held personally liable for damages caused culpably.
Violations of these organizational requirements can trigger substantial financial consequences. According to section 65 of the BSIG, fines reach up to 10 million euros for essential entities and up to 7 million euros for important entities. If a company’s total worldwide turnover exceeds 500 million euros, the potential fine amounts to up to 2 percent or up to 1.4 percent of that figure.
Alongside qualification and monitoring duties, affected organizations face a registration requirement that the BSI states is already overdue. A regular grace period had been granted until July 31, 2026. By the reporting deadline on September 30, 2026, the BSI reported that 20,141 of roughly 29,500 expected entities had registered in the system. This total comprised 6,837 essential entities and 13,252 important entities. For missed registrations, the law provides for fines of up to 500,000 euros.
The BSI urges unregistered companies to complete their registration immediately in the authority portal using an ELSTER organization certificate. To enforce statutory requirements, the BSI announced an administrative enforcement initiative for the fourth quarter of 2026. Starting in the first quarter of 2027, the authority intends to issue orders for IT security audits to individual entities and demand corresponding verification.
Registered and regulated organizations must also adhere to strict reporting obligations for significant security incidents. As soon as such an incident becomes known, an initial report must be submitted within 24 hours. A detailed follow-up report is due within 72 hours, followed by a formal final report no later than one month after the initial notification. By the end of September 2026, a total of 1,272 initial reports regarding security incidents had been recorded.
