Germany's NIS2 Implementation Act came into force on December 5, 2025. Companies that use QR codes in public spaces face new reporting and security obligations under the law, which provides for fines of up to €10 million and personal liability of management.
What the NIS2 Law Regulates
The NIS2 Implementation Act (Federal Law Gazette 2025 I No. 301) transposes EU Directive 2022/2555 into German law. It expands the range of companies covered and tightens requirements for IT security, incident reporting and executive liability.
The law distinguishes between 'essential entities' and 'important entities'. Both categories are subject to binding obligations.
Companies and Sectors Covered
The law significantly expands the number of companies subject to its requirements:
Essential Entities
From 250 employees OR >€50 million revenue
Energy, Transport, Finance, Health, Water, Digital Infrastructure, Space
Important Entities
From 50 employees OR >€10 million revenue
Postal/Courier, Waste Management, Chemicals, Food, Manufacturing, Digital Services, Research
Typical QR code applications in affected sectors:
- •EV charging station operators (Energy sector)
- •Parking meter providers (Transport)
- •Banks with QR codes in letters (Finance)
- •Hospitals with patient wristbands (Health)
- •Restaurant chains with digital menus (Food)
Key Obligations under § 30 BSI Act
The law mandates comprehensive risk management measures:
Risk Analysis
QR codes must be considered as a potential attack vector in risk analysis
Incident Response
Processes for handling quishing incidents must be established
Supply Chain Security
QR code printing service providers and transport routes must be verified
Training
Employees and customers must be informed about quishing risks
Multi-Factor Authentication
Required for access to QR code management systems
Reporting Deadlines: Initial Report Within 24 Hours
Under § 32, staggered reporting deadlines apply to security incidents such as quishing attacks:
24 Hours: Initial Report
Immediate notification to the Federal Office for Information Security (BSI) including initial indications
72 Hours: Detailed Report
Information on severity, impact and indicators of compromise
1 Month: Final Report
Complete description of the incident, its causes and the measures taken
In the case of the more than 90 manipulated parking meters discovered in Dortmund in 2025, an affected operator would have had to report the incident within 24 hours under the new rules.
Personal Liability of Management
§ 38 of the law sets out the responsibility of board members and managing directors:
Management is required to implement and oversee risk management measures. In case of breach of duty, they are liable to their organization for culpably caused damages.
Board members and managing directors are therefore personally liable in the event of a breach of duty, in addition to the company itself.
Management must also regularly participate in training in order to be able to identify and assess risks.
Fines of Up to 10 Million Euros
§ 65 provides for the following ranges of fines:
Essential Entities
Up to €10 million or 2% of worldwide annual revenue
Important Entities
Up to €7 million or 1.4% of worldwide annual revenue
For a utility company with €800 million in revenue, the maximum fine for an unreported quishing incident is €16 million.
QRTrust: Functions Related to NIS2 Requirements
QRTrust is a German QR code security platform. The following functions relate to requirements of the NIS2 law:
Recommended Steps for NIS2 Implementation
The following steps are recommended for companies using public QR codes:
Immediately (this week)
Check your NIS2 applicability based on the size criteria and sector classification
Short-term (1-3 months)
Create an inventory of all public QR codes and their target URLs
Medium-term (3-6 months)
Set up continuous monitoring of your public QR codes and their target URLs
Long-term
Establish processes for regular audits and documentation
Conclusion: NIS2 Makes QR Code Security Mandatory
Under the NIS2 Implementation Act, public QR codes are part of the IT infrastructure that must be protected. Quishing attacks are reportable security incidents, and management is personally liable.
Affected companies must implement the requirements before a first incident occurs. Violations can result in fines and liability claims against management.
Legal Sources
- • Federal Law Gazette 2025 I No. 301: NIS2 Implementation Act
- • BSI Act 2025 (BSIG) §§ 28-65
- • EU Directive 2022/2555 (NIS2 Directive)
Free Initial NIS2 Consultation
QRTrust offers an initial consultation on NIS2 compliance for companies using public QR codes.
Schedule a Consultation →About QRTrust
QRTrust is Germany's first QR code security platform, developed in Dortmund. AI-powered real-time detection, a local threat database and multi-layered security checks protect citizens, authorities and businesses from quishing attacks. GDPR compliant, hosted in Germany.