Newsletter April 2026: NIS2, KI-Risiko und Cyber-Versicherungsmarkt

NIS2 Intelligence Digest — BSI Enforcement Activated, Penalty Calculators Updated

Zusammenfassung

Weekly intelligence on NIS2 enforcement, supervisory activity, and cyber insurance market developments across the EU.

BSI has moved from guidance to enforcement. This week’s most significant development: Germany’s BSI has activated formal NIS2 audit procedures under the IT-Sicherheitsgesetz 3.0 framework, conducting its first on-site inspections of essential entities in the energy and transport sectors. This is not a pilot or a consultation exercise — it is operational enforcement with documented audit criteria and defined remediation timelines. Supervisory authorities in France (ANSSI), Spain (INCIBE), and 17 other EU member states have now activated active supervision mechanisms, confirming what ENISA flagged in its January 2026 implementation report: the NIS2 enforcement infrastructure is live across the majority of the EU. If you have clients operating in Germany, France, or Spain who have not yet completed their NIS2 documentation gap analysis, the conversation needs to happen this quarter.One of the most frequently asked questions in broker consultations: what is my client’s actual maximum fine exposure under NIS2? The nominal ceiling is €10M for essential entities and €7M for important entities — but the turnover-based alternative calculation can produce substantially higher figures for large organisations. A €50 billion global turnover entity faces a €1B potential fine at the 2% threshold.

Kernpunkte

• Die Cyber-Bedrohungslandschaft entwickelt sich rasant weiter
• KI-verstärkte Angriffe verändern das Risiko-Profil
• Underwriter und Makler müssen ihre Ansätze anpassen
• NIS2-Compliance wird zum Standard-Kriterium

Praktische Schritte

1. Aktuelle Bedrohungsage verstehen
2. Risikomodelle aktualisieren
3. Deckungskonzepte überprüfen
4. Kunden proaktiv beraten

Weitere Tools: Cyber-Risikorechner | FAIR-Report | NIS2-Checker | Security Scan