DORA vs NIS2: precedence, BSIG exemptions and what remains

This page is for financial entities that want to know whether NIS2 applies in addition to DORA, and for readers from the NIS2 side who need to classify a financial client or a group company. Whether and under which framework DORA itself applies is explained on the page on DORA applicability. How organisations outside the financial sector implement NIS2, register and report is explained by NIS2-Readiness: implementing NIS2.

Why does DORA take precedence over the NIS2 Directive?

Because both acts say so. Under Article 4(1) of the NIS2 Directive (EU) 2022/2555, its relevant provisions, including those on supervision and enforcement in Chapter VII, give way where a sector-specific Union legal act requires the entity to adopt risk-management measures or to notify significant incidents and those requirements are at least equivalent in effect. Article 1(2) DORA declares itself to be such an act for financial entities that are essential or important entities under NIS2. Recital 28 of the NIS2 Directive names the DORA areas that take their place: ICT risk management, incident management and reporting, testing, information sharing and ICT third-party risk. In recital 16, DORA describes itself as lex specialis to the NIS2 Directive. That is the level of the Directive. The German implementation in the BSI Act exempts less: Section 28(6) BSIG lists seven provisions, and the BSI’s supervisory and enforcement measures under Sections 61 and 62 are not among them (details below).

BaFin sums this up in FAQ 12: the DORA requirements take “precedence of application over the NIS2 requirements on cybersecurity risk management and on reporting significant security incidents” (our translation) and override them to that extent. The German NIS2 Implementation Act has been in force since 6 December 2025.

Who is actually both?

Fewer financial entities than you might expect. In the financial sector, Annex 1 to the BSI Act names only three types of entity: credit institutions whose business is to take deposits or other repayable funds from the public and to grant credits for their own account, trading venues and central counterparties. In addition there are the size thresholds under Section 28(1) and (2) BSIG. An entity is particularly important (the German term for an essential entity) from 250 employees or with turnover above EUR 50 million and a balance sheet total above EUR 43 million. It is important from 50 employees or with turnover and balance sheet total each above EUR 10 million. Under Section 28(4) BSIG, partner and linked enterprises are counted in line with the Commission’s SME recommendation, unless the company is independent of them in the nature and operation of its IT. An IT subsidiary therefore often reaches the thresholds through the group’s figures alone.

Annex 1 does not list insurers, fund management companies, payment institutions, investment firms, IORPs or factoring and leasing firms in the financial sector. On our reading they are NIS2 entities only if they also meet another entity type in Annex 1 or 2, for example if they provide data centre services to third parties. You can check this under Section 28 BSIG with the applicability check on NIS2-Readiness.

What does Section 28(6) BSIG exempt, and what remains?

Section 28(6) no. 1 BSIG exempts seven provisions, for financial entities under Article 2(2) DORA and for undertakings to which DORA applies through Section 1a(2) and (2a) of the German Banking Act (KWG) or Section 293(5) of the Insurance Supervision Act (VAG). Registration under Section 33 and the supervisory and enforcement measures under Sections 61 and 62 are not on the list.

The BSI takes the same view: DORA entities that are also NIS2 entities must register but are exempt from the further obligations. If the details change, the BSI must be informed within two weeks (Section 33(5)). A special rule concerns operators of critical facilities: anyone operating a facility for such a financial entity is exempt from reporting under Section 32 to that extent (Section 28(7)). The wording covers only this case and does not rule out double reporting in general.

From when does this apply to the KWG group?

On the wording, certainly from 1 January 2027. Before that it is open. Section 28(6) BSIG covers undertakings to which DORA applies “on the basis of Section 1a(2) and (2a)” KWG. For factoring and leasing firms, guarantee banks and the other institutions under Section 1a(2a) KWG (the KWG group), DORA applies in full only from 1 January 2027, and until then only incident reporting under Chapter III (Section 65a(3) KWG). The wording leaves open whether the reporting obligation alone is enough for the exemption. In practice the question arises only if such an institution is an NIS2 entity at all through another activity. Anyone in this position should have the period up to the end of 2026 clarified by a lawyer. Insurance holding companies under Section 293(5) VAG are also named in Section 28(6), and the VAG sets no transition period for them.

What about the KRITIS umbrella act?

The German KRITIS umbrella act (KRITIS-Dachgesetz, Federal Law Gazette 2026 I No. 66, in force since 17 March 2026) governs the physical resilience of operators of critical facilities, and finance is one of its sectors. For financial entities under Article 2(2) DORA and for entities to which DORA applies via Section 1a(2a) KWG or Section 293(5) VAG, Section 4(2) no. 1 of the act exempts most obligations, including risk analysis, resilience measures and incident reporting. For the KWG group, Section 1a(2a) KWG applies only from 1 January 2027, and as with Section 28(6) BSIG it is not expressly settled whether the exemption applies before then. Among the provisions not exempted is registration under Section 8. It only takes effect once a facility counts as critical under the implementing ordinance, and according to the BBK this ordinance is still being drafted, so there is currently no obligation to register (as of 6 November 2026). Our sister site NIS2-Readiness covers the act and how it relates to NIS2.

Does precedence also apply to subsidiaries in a group?

No, it applies per legal entity. Article 4(1) of the NIS2 Directive provides that its provisions continue to apply to entities not covered by the sector-specific act. Section 28(6) BSIG names only financial entities and the undertakings brought in through the KWG and the VAG. An IT subsidiary, a group-owned data centre or a service company is not a financial entity under Article 2(2) DORA. If it meets an entity type in the annexes and the size thresholds, counted with the group as described above, it has the full obligations under the BSI Act, including reporting under Section 32. The BSI considers group-internal IT service providers that are not themselves DORA financial entities, where they are NIS2 entities in the group, to be subject to the reporting obligation under Section 32 BSIG (BSI FAQ on NIS-2, registration no. 14). For the bank, the same subsidiary is an ICT third-party service provider under DORA, with a contract under Article 30 and an entry in the register of information.

What applies to ICT providers of financial entities?

Two separate questions. Under DORA, the obligations fall primarily on financial entities. DORA reaches providers through the contracts of their financial clients, and directly only if the supervisory authorities designate them as critical ICT third-party service providers (Article 31). What clients require under DORA is set out on the page on DORA for ICT providers. A provider has NIS2 obligations of its own if it reaches the size thresholds as, for example, a provider of cloud computing or data centre services, a managed service provider or a managed security service provider under Annex 1 BSIG. The BSI Act then applies to it without the exemption under Section 28(6), because it is not a financial entity. How it implements this is explained by NIS2-Readiness. Manufacturers of products with digital elements also have obligations under the Cyber Resilience Act. The distinction is covered under CRA-Readiness: CRA, NIS2 and DORA compared (in German).

Decision table: which regime for which obligation

The table assigns the main obligations to three types of legal entity. Column A is a financial entity that is also an NIS2 entity, column B a financial entity without NIS2 status, column C a company without DORA status but with NIS2 status, such as an IT subsidiary or a provider.

For testing, TLPT under Articles 26 and 27 does not apply to Article 16 entities or the KWG group. For the testing programme under the simplified framework, see DORA Article 16. Before 2027, column A applies to the KWG group only with the caveat from the section above. The table is our professional assessment of the wording.

Example: a banking group with three legal entities

Fictitious example, not a client. Muster-Volksbank eG has two majority-owned subsidiaries, an IT company and a leasing company. The group classifies each legal entity separately:

If the data centre fails, the bank reports a major incident to BaFin under DORA, and Muster-IT GmbH checks for itself whether there is a significant security incident under Section 32 BSIG (the exemption under Section 28(7) BSIG applies only if the data centre is a critical facility, which the example does not assume). Both reporting channels run in parallel and should be aligned in a joint playbook. The classification of Muster-IT GmbH as a data centre and managed services provider and its dependence on the bank’s IT are assumptions of the example and must be checked case by case. Counted on its own, with 120 employees it would be below the threshold for particularly important entities.

Three typical gaps where DORA and NIS2 meet

Gaps and remedies are our professional assessment based on the wording of DORA, the NIS2 Directive and the BSI Act. The example is entirely fictitious. This assessment is general information and does not replace legal advice in an individual case.

How we support you

We classify the legal entities of a group using the decision table and show where DORA documents can be reused for the subsidiaries’ NIS2 implementation. For financial entities the DORA gap analysis is the right starting point. For the NIS2 side of a subsidiary or a provider, see NIS2-Readiness.