# Do banks and other DORA financial entities in Germany follow the BSIG duties?

Largely not, for the core NIS2 duties: they follow DORA instead. Section 28(6) of the BSIG states that sections 30, 31, 32, 35, 36, 38 and 39, covering risk-management measures, attack detection, incident reporting, information duties, management duties and evidence, do not apply to financial entities under Article 2(2) of Regulation (EU) 2022/2554 (DORA) and to companies for which DORA's requirements apply through the German Banking Act or Insurance Supervision Act. Their ICT risk management and incident reporting are governed by DORA and supervised by the financial supervisor. Other BSIG provisions, such as registration under section 33, are not in that list, so check them separately. ICT providers to these financial entities are not exempted by this rule: if they are in scope of the BSIG themselves, they follow it, and DORA reaches them through their contracts.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [Germany: BSIG](https://netsenx.com/en/faq/germany) · https://netsenx.com/en/faq/do-dora-financial-entities-follow-the-bsig-duties

## Read next

- https://netsenx.com/en/blog/2026-11-07_nis2-germany-bsig
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Can the BSI audit our company?](https://netsenx.com/en/faq/can-the-bsi-audit-our-company)
- [Where are NIS2 incidents reported in Germany?](https://netsenx.com/en/faq/where-are-nis2-incidents-reported-in-germany)
- [When must German companies register with the BSI?](https://netsenx.com/en/faq/when-must-german-companies-register-with-the-bsi)
- [Which German companies fall under the new BSIG?](https://netsenx.com/en/faq/which-german-companies-fall-under-the-bsig)
- [What is the difference between a particularly important and an important entity in Germany?](https://netsenx.com/en/faq/what-is-a-particularly-important-entity-in-germany)