Bakery: The Complete NIS2 Guide

NIS2 does not affect every bakery, but many multi-site operations with centralized production are in scope - and don't know it. This guide explains who falls under NIS2, what obligations apply, and what you need to do concretely. It is written for owners, managing directors, and IT managers at bakeries with more than one production site or significant B2B business.

Who is affected?

Bakeries fall under NIS2 Annex II No. 5 (Food) when they exceed the SME thresholds from EU Recommendation 2003/361/EC Art. 2: at least 50 employees or at least EUR 10 million in annual revenue. Craft registration alone does not provide blanket protection. If you operate as a "manufacturer of bakery products" under NACE classification C.10.7 and meet the threshold, you are an Important Entity under § 28 Para. 1 BSIG-new.

Special case: if you supply public institutions (schools, hospitals, canteens) as part of the food supply chain and reach the KRITIS threshold of 434,500 t/a in food production (grain equivalent), you qualify as Essential Entity.

A multi-site operation with 80 employees and EUR 15 million in revenue that produces centrally and delivers B2B to canteens is very likely an Important Entity.

Obligations under § 30 BSIG-new

§ 30 BSIG-new lists seven technical and organizational measures you must implement:

1. Risk analysis and management: You must systematically assess IT risks across your central production and branch network. This includes ERP systems, point-of-sale, ordering platforms, and oven control systems.
2. Incident handling: Security incidents must be detected, documented, and handled through a defined process. A failure of the central system must be classifiable as an incident.
3. Business continuity: A contingency plan must define how production continues during IT failure. Manual fallback processes for ordering and delivery planning must be documented.
4. Supply chain security: Your suppliers (flour, packaging, logistics software) must be assessed for their security standards. Contractual clauses on minimum requirements are required under § 30 Para. 2 No. 4 BSIG-new.
5. Access control and MFA: Access to business applications and networks must be secured by strong authentication. Branch access via password alone is no longer sufficient.
6. Encryption: Customer data, order data, and supplier communications must be encrypted in transit and at rest.
7. Training and awareness: Employees who operate IT systems must be regularly trained on cybersecurity. This applies to branch managers as well.

Deadlines and reporting obligations

Registration with the BSI must occur within three months of becoming aware of your own obligations (§ 33 BSIG-new). The BSI has announced an online portal; until it launches, manual notification applies.

For security incidents, the reporting chain under § 32 BSIG-new applies: an initial report ("early warning") within 24 hours, a full report within 72 hours, and a final report within 30 days. A ransomware attack that takes down the point-of-sale system and affects more than 10% of branch capacity must be reported within 24 hours.

NIS2 obligations under BSIG-new are binding once the German transposition law enters into force. The law is currently in the legislative process; entry into force is expected in 2025.

Fines and personal liability

NIS2 violations carry significant penalties. For Important Entities (Annex II): up to EUR 7 million or 1.4% of global annual turnover, whichever is higher. For Essential Entities (Annex I): up to EUR 10 million or 2% of turnover.

Critically: § 38 BSIG-new introduces personal liability for management. Managing directors are personally liable if they negligently fail to fulfill NIS2 obligations. Delegation only protects if documented in writing and if the delegated person is technically qualified.

KRITIS threshold for bakeries: who actually reaches 434,500 t/a?

The KRITIS threshold in food supply is set at 434,500 t/a of processed food in grain equivalents under BSI-KritisV Annex 6. This threshold is relevant for industrial bakery manufacturers, not craft businesses.

If you produce frozen raw doughs, bakery goods for retail chains, or large B2B volumes centrally, you should compare your production volume against this figure. A mid-sized industrial bakery with 300 employees and 2-3 production lines can reach this threshold.

B2B supply chains also count: if you supply schools, hospitals, or company canteens, you are part of the critical supply chain. The BSI evaluates the total volume across all buyers, not per customer.

First steps

1. Check your headcount and annual revenue against the SME thresholds. If you have more than 50 employees or EUR 10 million in revenue, you are likely in scope.
2. Clarify your NACE code: are you classified as a manufacturer (C.10.7) or as a craft business? Craft registration alone does not protect you if you operate centralized industrial production.
3. Calculate your annual production volume in tonnes. If it is near 434,500 t/a, seek legal advice on KRITIS classification.
4. Create an inventory of all IT systems: ERP, point-of-sale, oven controls, ordering portals, warehouse logistics.
5. Conduct an initial risk analysis. Which systems are business-critical? What happens if they fail?
6. Identify your most important IT supplier and review their security certifications.
7. Register with the BSI as soon as the online portal is available.

Common pitfalls

"Craft registration protects us from NIS2": This is only true for micro-businesses without centralized industrial production. If you operate one or more fully automated production lines, you are not a craft business in the NIS2 sense.

B2B delivery to schools and hospitals is overlooked: These buyers count toward the KRITIS threshold calculation. If 30% of your revenue comes from public institutions, you are potentially part of critical supply infrastructure.

IT security is reduced to office IT only: Oven controls, cold storage monitoring, and production line software are equally relevant. The OT/IT boundary must be addressed in your risk analysis.

Deadlines are underestimated: Many companies only start implementation once deadlines are already running. The 3-month BSI registration period starts from when you become aware of your obligations, not from when the law enters into force.

Use the industry-specific NIS2 calculator for bakeries to determine your individual obligations in a few minutes.