Germany's July 31 NIS2 Deadline Arrives Amid Lopsided Battle Over Working Time Compliance

Businesses that track employee hours using digital systems must register under the NIS2 cybersecurity directive by July 31, 2026 — or face fines of up to €10 million or 2% of global annual turnover. The requirement applies to a broad range of companies in critical and important sectors and forces employers to rethink how they handle time recording, data protection, and IT security.

The looming deadline highlights a stark asymmetry in German labor law. While employees can lose their jobs for even minor time-recording infractions, employers face almost no enforcement of the rules they are supposed to follow.

While German enforcement may be lax, UK companies face active HSE inspections and real penalties when compliance documents are missing. A free toolkit provides the risk assessments, checklists, and toolbox talks you need to close those gaps before an inspector arrives. Download the free Health & Safety Toolkit and join over 37,000 UK businesses already protecting their workforce.

One Slow Leak: The Costly Coffee Break

The Landesarbeitsgericht (LAG) Hamm upheld the summary dismissal of a cleaning woman who stamped in, then took a ten-minute coffee break before starting work. The court classified the act as intentional time fraud (Case No. 13 Sa 1007/22). Particularly damaging: the employee initially denied the incident and only confessed later. Such a breach of trust, the judges ruled, justifies termination without any prior warning — even when the worker is severely disabled and has been with the company for years.

Employment lawyers stress that deliberately falsifying working hours strikes at the very foundation of the employment relationship. Yet the same precision is not demanded of employers.

Millions in Free Overtime

In 2024, German employees worked an estimated 638 million unpaid overtime hours — 53.6% of all extra hours performed. The value of that unpaid labor totals €6.27 billion. Roughly 44% of workers regularly clock more than their contracts require. The contrast with the strict sanctioning of employee mistakes could hardly be sharper.

Reform Stalled, Enforcement Meager

The European Court of Justice called for mandatory recording of work start, end, and duration as early as 2019. Germany’s Federal Labor Court (BAG) affirmed the obligation in September 2022. But the legislative implementation has stalled. The coalition committee pushed back the reform on July 1, 2026 — postponing it again to autumn. Meanwhile, the inspection rate by the responsible authorities sits at just 0.8%, meaning companies can largely operate unchecked.

Further Rulings Shaping HR Practice in 2026

Sick notes under scrutiny: The LAG Cologne decided (Case No. 7 SLa 54/25) that the evidentiary weight of a medical certificate can be called into question if there is a suspicious temporal link with workplace conflicts — for example, the return of work equipment. In such cases, an employer may refuse to continue paying sick leave.

Proof of delivery for reintegration invitations: The BAG clarified on May 7, 2026 that a digital registered letter alone does not provide reliable proof of receipt for an invitation to a company’s return-to-work process (betriebliches Eingliederungsmanagement, bEM).

Severe-disability protection during probation: A dismissal during the probationary period can be invalid if the representative body for severely disabled employees was not properly involved. A simple “noted” stamp is insufficient (BAG, January 29, 2026, Case No. 2 AZR 128/25).

Regulations are tightening across Europe — and UK employers must ensure their health and safety compliance is watertight. A free toolkit built around the Health & Safety at Work Act 1974 gives you nine ready-to-use tools, including risk assessments, checklists, and a director liability guide. Download the free Health & Safety at Work Act Toolkit and protect your business from costly penalties.

Pay transparency shifting the burden of proof: The EU Pay Transparency Directive must be transposed by June 2026. The BAG already ruled in October 2025 (Case No. 8 AZR 300/24) that mere knowledge of a single male colleague’s higher salary can raise a presumption of pay discrimination. The employer then carries the burden of proof.

For companies, the message is clear: working time, data protection, and IT infrastructure must be reviewed holistically. Failure to do so risks not only dismissal lawsuits from employees but also multimillion-euro fines — a price that, unlike a ten-minute coffee break, will be hard to shrug off.

en | boerse | 69767025 |