# What are the fines under the German BSIG?

Up to EUR 10 million for particularly important entities and EUR 7 million for important entities for the main breaches, with turnover-based maximums for large companies. Section 65(5) of the BSIG sets these ceilings for breaches such as not taking the risk-management measures of section 30, not documenting them, not reporting incidents correctly or on time under section 32, and certain information duties under section 35. For entities with a total worldwide turnover of more than EUR 500 million, the maximum rises to 2% of turnover for particularly important and 1.4% for important entities (section 65(6) and (7)). Other breaches carry lower ceilings, for example up to EUR 500,000 for failing to register correctly or on time, and up to EUR 100,000 for some others. These are maximums: the actual amount depends on the case. Managers' liability to the entity under company law comes in addition, through section 38.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [Germany: BSIG](https://netsenx.com/en/faq/germany) · https://netsenx.com/en/faq/what-are-the-fines-under-the-bsig

## Read next

- https://netsenx.com/en/blog/2026-11-07_nis2-germany-bsig
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Are managing directors personally liable under the German BSIG?](https://netsenx.com/en/faq/are-german-managing-directors-liable-under-the-bsig)
- [Must management in Germany attend cyber security training under the BSIG?](https://netsenx.com/en/faq/must-german-management-attend-cyber-security-training)
- [What does the BSI do after we submit an incident report?](https://netsenx.com/en/faq/what-does-the-bsi-do-after-we-submit-a-report)
- [Do banks and other DORA financial entities in Germany follow the BSIG duties?](https://netsenx.com/en/faq/do-dora-financial-entities-follow-the-bsig-duties)
- [Can the BSI audit our company?](https://netsenx.com/en/faq/can-the-bsi-audit-our-company)