Chemical Industry: The Complete NIS2 Guide

Chemical companies with 50 or more employees or EUR 10 million in annual revenue are in scope under NIS2 Annex II No. 5 (Manufacturing). Operators of facilities with hazardous substances under the Seveso III Directive face a regulatory overlap that requires a coordinated compliance strategy. This guide is written for plant managers, safety officers, and IT managers in the chemical industry.

Who is affected?

Chemical companies (NACE C.20) fall under NIS2 Annex II No. 5 when they exceed the SME thresholds: at least 50 employees or at least EUR 10 million in annual revenue (EU Recommendation 2003/361/EC Art. 2).

Large chemical groups (BASF, Bayer, Evonik, etc.) are generally Essential Entities under Annex I if their production capacity fulfills critical supply functions. Operators of Seveso III upper-tier establishments are additionally required to conduct safety analyses under § 3 of the 12th BImSchV.

A specialty chemical company with 200 employees, a production facility with hazardous substances, and a laboratory network is clearly subject to NIS2 and is an Important Entity.

Obligations under § 30 BSIG-new

§ 30 BSIG-new requires seven obligation categories that are especially relevant for chemical companies because of the combination of IT, process control, and Seveso safety requirements:

1. Risk analysis and management: Process control systems (DCS/PLC), laboratory information systems (LIMS), ERP, and customer portal connections must all be assessed. IT systems relevant to hazardous incidents must be treated with priority.
2. Incident handling: A cyberattack on the process control system is simultaneously an IT security incident (NIS2) and potentially a hazardous incident under BImSchG. Both escalation paths must be coordinated.
3. Business continuity: Plant shutdowns initiated for IT reasons can be dangerous (exothermic processes, pressure buildup). BCPs must describe safe shutdown procedures and manual control options.
4. Supply chain security: Suppliers of process control technology, LIMS software, and logistics service providers must be reviewed for security standards.
5. Access control and MFA: Access to process control systems and corporate networks must be secured by MFA. Maintenance access from equipment manufacturers is particularly critical.
6. Encryption: Recipe data, research data, and customer data must be encrypted. Patent-critical research results warrant special protection.
7. Training and awareness: Operations staff, laboratory employees, and administrative personnel must receive regular cybersecurity training.

Deadlines and reporting obligations

BSI registration under § 33 BSIG-new within three months. For security incidents under § 32 BSIG-new: initial report within 24 hours, full report within 72 hours, final report within 30 days.

A cyberattack on the process control system of a chemical plant must be reported to the BSI within 24 hours. At the same time, reporting obligations under § 19 BImSchG (significant accidents) may be triggered.

Fines and personal liability

Important Entity (Annex II): up to EUR 7 million or 1.4% of turnover. Essential Entity (Annex I): up to EUR 10 million or 2% of turnover.

§ 38 BSIG-new: personal liability for management. Combined with environmental liability (UmwHG) and Hazardous Incidents Ordinance sanctions, the risk for managing directors of chemical companies is significant.

Seveso III and NIS2: harmonizing safety concepts instead of duplicating them

The Seveso III Directive (2012/18/EU, transposed as 12th BImSchV) requires operators of facilities with hazardous substances to implement comprehensive safety management systems. The overlap with NIS2 is substantial:

Seveso III Art. 8 requires a "Major Accident Prevention Policy" (MAPP) with systematic hazard analysis. NIS2 § 30 BSIG-new requires a risk analysis for IT systems. Both obligations intersect in chemical companies: IT failures can trigger hazardous incidents, and hazardous incidents can damage IT infrastructure.

Harmonization potential: the MAPP can integrate the NIS2 IT security risk analysis. Emergency plans under Seveso III Art. 12 can encompass NIS2 contingency plans. This avoids duplication and allows building an integrated safety management system.

First steps

1. Clarify headcount and revenue. Important or Essential Entity?
2. Check: is the facility subject to Seveso III obligations? If so, conduct a gap analysis between MAPP and NIS2.
3. Map all IT systems that influence production processes.
4. Identify all remote maintenance access points for process control technology.
5. Ensure network segmentation separates the OT network from office IT.
6. Develop an incident response plan that coordinates NIS2 reporting and BImSchG escalation.
7. Register with the BSI.

Common pitfalls

NIS2 and Hazardous Incidents Ordinance treated separately: Both frameworks address the safety of chemical facilities. An integrated approach is more efficient and reduces compliance costs.

Process control system treated as a "closed system": Modern DCS and PLC systems are reachable over networks. The attack path "from office network to process control system" is the most common technique used against chemical companies.

Patent-critical research data not specially protected: Theft of recipes and research data through industrial espionage is an underestimated risk.

Maintenance access from equipment manufacturers not assessed: External service providers with access to process control technology are critical suppliers under § 30 Para. 2 No. 4 BSIG-new.

Use the industry-specific NIS2 calculator for the chemical industry to determine your obligations.