# What does the BSI do after we submit an incident report?

It confirms receipt and can help, and in some cases it can require you or itself to inform the public. Under section 36(1) of the BSIG, the BSI sends the reporting entity a confirmation of receipt without undue delay and, where possible, within 24 hours, and on request provides guidance or operational advice on remedial measures; it can also offer additional technical support on request. Under section 36(2), if public awareness is needed to prevent or handle a significant incident, or disclosure is otherwise in the public interest, the BSI can, after hearing the entity, oblige it to inform the public, or inform the public itself. The BSI also uses reports to warn others and to build the national picture. Reporting does not create new obligations that would not apply otherwise: section 30(7) says so for voluntary reports and information exchange. Keep your own copy of everything you submitted.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [Germany: BSIG](https://netsenx.com/en/faq/germany) · https://netsenx.com/en/faq/what-does-the-bsi-do-after-we-submit-a-report

## Read next

- https://netsenx.com/en/blog/2026-11-07_nis2-germany-bsig
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Do banks and other DORA financial entities in Germany follow the BSIG duties?](https://netsenx.com/en/faq/do-dora-financial-entities-follow-the-bsig-duties)
- [Can the BSI audit our company?](https://netsenx.com/en/faq/can-the-bsi-audit-our-company)
- [Where are NIS2 incidents reported in Germany?](https://netsenx.com/en/faq/where-are-nis2-incidents-reported-in-germany)
- [When must German companies register with the BSI?](https://netsenx.com/en/faq/when-must-german-companies-register-with-the-bsi)
- [Which German companies fall under the new BSIG?](https://netsenx.com/en/faq/which-german-companies-fall-under-the-bsig)