Automotive: The Complete NIS2 Guide

Companies in the automotive sector - from OEMs to Tier 1 and Tier 2 suppliers - are in scope under NIS2 Annex II No. 5 (Manufacturing) when they exceed 50 employees or EUR 10 million in annual revenue. Those already fulfilling TISAX obligations have a significant head start on NIS2 - but not all TISAX requirements cover NIS2. This guide is written for IT security managers, CISOs, and compliance managers in the automotive environment.

Who is affected?

Automotive manufacturers (OEMs), Tier 1 and Tier 2 suppliers, software developers for vehicle systems, and vehicle inspection service providers fall under NIS2 Annex II No. 5 (Manufacturing, NACE C.29) when they exceed the SME thresholds: at least 50 employees or at least EUR 10 million in annual revenue (EU Recommendation 2003/361/EC Art. 2).

Large OEMs (VW, BMW, Mercedes, Stellantis) with more than 250 employees and >EUR 50 million in revenue are Essential Entities under NIS2 Annex I, provided their production capacity represents a critical national economic function.

A Tier 1 supplier with 200 employees and EUR 50 million in revenue producing ECUs for multiple OEMs is an Important Entity under NIS2 Annex II.

Obligations under § 30 BSIG-new

§ 30 BSIG-new lists seven obligation areas that are especially relevant for the automotive sector because of the tight integration of development IT, production OT, and OEM requirements:

1. Risk analysis and management: Development IT (CAD, PLM, test infrastructure), production OT (MES, robotics controls), and connections to OEM portals must all be assessed.
2. Incident handling: An attack on the PLM system can jeopardize the entire model development. Escalation and crisis communication must account for OEM notification obligations.
3. Business continuity: Automotive suppliers are JIT/JIS suppliers. An IT outage of more than 4 hours can trigger line shutdowns at the OEM.
4. Supply chain security: OEMs will already require security certifications from suppliers under § 30 Para. 2 No. 4 BSIG-new. Contract adjustments are expected.
5. Access control and MFA: Access to development environments, OEM portals, and production systems must be secured by MFA.
6. Encryption: Development data, vehicle development plans (NDA-protected), and customer data must be stored and transmitted encrypted.
7. Training and awareness: Engineers, production staff, and administrative employees must receive regular cybersecurity training.

Deadlines and reporting obligations

BSI registration under § 33 BSIG-new within three months. For security incidents under § 32 BSIG-new: initial report within 24 hours, full report within 72 hours, final report within 30 days.

An incident that impairs delivery capability to an OEM customer must simultaneously satisfy NIS2 reporting obligations (to the BSI) and OEM notification obligations under supply contract clauses.

Fines and personal liability

Important Entity (Annex II): up to EUR 7 million or 1.4% of turnover. Essential Entity (Annex I): up to EUR 10 million or 2% of turnover.

§ 38 BSIG-new: personal liability for management. OEM contracts add penalty clauses for line shutdowns - NIS2 fines plus OEM contract penalties can accumulate simultaneously.

TISAX Level 3 and NIS2: managing dual regulation intelligently

TISAX (Trusted Information Security Assessment Exchange) is the automotive industry standard for information security. TISAX is based on VDA ISA (Information Security Assessment), which is strongly aligned with ISO 27001.

TISAX Level 3 (protection of prototypes and highly sensitive data) covers many requirements that § 30 BSIG-new also demands: risk analysis, access control, encryption, incident management. Those certified to TISAX Level 3 already fulfill core parts of NIS2.

What NIS2 additionally requires: BSI reporting obligations (TISAX assessments do not report to authorities), personal management liability, and the explicit supply chain obligation. A gap analysis between TISAX compliance and NIS2 is recommended to avoid duplication.

First steps

1. Check headcount and revenue. Over 50 employees or EUR 10 million: Important Entity.
2. Conduct a gap analysis between your existing TISAX status and NIS2 requirements.
3. Review all OEM portal access points and connections to development platforms.
4. Map dependencies between development IT and production OT.
5. Review current supplier contracts for NIS2-specific security clauses.
6. Develop a BCP that explicitly models OEM line shutdown scenarios.
7. Register with the BSI.

Common pitfalls

TISAX = NIS2 compliance: TISAX fulfills many NIS2 requirements but not all. Reporting obligations, management liability, and supply chain obligations are NIS2-specific.

OEM portal access without MFA: Access to OEM development platforms (e.g., VW Group Supplier Portal) with password alone is not NIS2-compliant.

PLM system excluded from risk analysis: The PLM system contains sensitive development data. An attack on it is a significant security incident.

JIT/JIS dependencies not reflected in the BCP: An 8-hour IT outage can shut down multiple OEM production lines and trigger contract penalties.

Use the industry-specific NIS2 calculator for automotive to verify your obligations.