Wire Bund replaces Signal in the Bundestag – why the BSI VS-NfD approval of 2026 becomes the new standard for sovereign government communication

When the Federal Office for Information Security (BSI) published its approval of Wire Bund for classified information at the VS – for official use only (VS-NfD) level on 27 April 2026, the news was initially picked up only in trade publications. Five months later, in September 2026, Wire Bund has become the political centrepiece of a structural rebuild of German government communication. The trigger was a large-scale phishing operation against roughly 300 political Signal accounts – among them those of Bundestag President Julia Klöckner and two federal ministers – widely attributed to Russian state-adjacent actors. The Bundestag administration has drawn the consequence and is replacing Signal as the standard messenger with Wire. For the first time at scale, German federal politics runs on a BSI-approved, European messenger platform. For municipal administrations, schools, law firms and SME IT directors, this is more than a Berlin personnel matter – it is the reference decision that will set the direction for the next twelve months.

What actually happened in 2026 – and what is technically new about it

The Signal incident in spring 2026 was not an attack on the cryptographic foundation of the messenger. The Signal protocol and end-to-end encryption held up. The process was attacked – specifically the "linked-device" flow in which users pair their chat history to an additional device. Attackers compromised around 300 accounts through fake support messages and manipulated QR codes. The real problem: Signal is cryptographically strong, but not a BSI-approved solution, is run as an open-source app from a private-sector foundation, and provides no German contracting party, no German operating model and no formalised update chain. Wire Bund provides exactly that: hardened client builds, German operation, clear responsibilities, formal audits and – with approval in place – BSI clearance for VS-NfD. For federal bodies Wire Bund is currently the only messenger solution with this clearance.

Why this matters for municipalities, clinics, schools and SMEs – not just federal ministries

VS-NfD is formally assigned to the federal and state level. But the technical requirements behind it – end-to-end encryption, a German contracting party, an audited update chain, controlled client distribution, separation of metadata and content, defined operating processes – are the reference architecture for any communication layer that carries personal or particularly sensitive data. For a law firm handling client data covered by §203 of the German Criminal Code (professional secrecy), a clinic subject to §22 KHG, a school administration with staff council data, a municipality with critical-infrastructure duties or a manufacturing SME with design data, using Microsoft Teams or WhatsApp Business is not just a matter of convenience but a structural compliance gap. The detailed argument is in our post on Copilot in law firms and tax advisor offices; the underlying US legal problem is set out in the post on the US CLOUD Act.

What Wire Bund covers technically – and what it does not

Wire fully covers the classic messenger functions: encrypted 1:1 chats, group chats, voice and video calls, screen sharing, file exchange into the two-digit gigabyte range, calendar integration and federated rooms across separate Wire instances. In the VS-Bund variant, metadata is separated, server logs are kept auditable and client builds are delivered through a controlled deployment channel. What Wire does not replace is the collaboration layer inside documents – for that the established target stack of Nextcloud with Collabora Online, OpenDesk or LibreOffice remains the answer; the underlying structure is described in our comparison of Nextcloud versus OneDrive and SharePoint. Wire and Nextcloud are complementary, not redundant. Together they form the sovereign replacement of a classic Microsoft Teams deployment; the systematics are covered in depth in Microsoft Teams alternative.

The NIS2 and BSI Grundschutz frame in 2026

The NIS2 transposition (NIS2UmsuCG) has been in force since 6 December 2025 and requires documented security measures from roughly 29,500 companies in Germany. The 2026 update to the BSI Grundschutz building blocks sharpened building block APP.5 (Groupware and Messenger): end-to-end encryption, a German contracting party, verifiable client provenance and a documented update process are the standard candidates for satisfying the building block for every organisation under NIS2. Wire Bund meets all criteria; Microsoft Teams structurally fails the "German contracting party" and "verifiable client provenance" criteria from a BSI perspective. The contradiction between NIS2 and Microsoft 365 is worked out in detail in our post on NIS2, GDPR and the Microsoft paradox.

The post-quantum deadline – end of 2028 as a hard date

The BSI approval of Wire Bund runs until the end of 2028. The reason for the time limit is the missing post-quantum cryptography. The current X3DH and Double-Ratchet based protocols are secure against classical adversaries but not against a future cryptographically relevant quantum computer. Wire has communicated a concrete post-quantum roadmap; BSI will only renew the approval if hybrid procedures (classical plus PQ) are in production by the end of 2028. For IT leadership that means: the switch to Wire Bund is not a terminal station but an intermediate stage with a defined next milestone. For WhatsApp and Teams no comparable public PQ roadmap is available for the same period.

What to do in autumn 2026 in concrete terms

For SME IT directors, school administrations, law firms and municipalities, we recommend three steps. First, the structured inventory along the seven-step guide above – experience shows it delivers a solid picture in less than two weeks and the basis for the paper to the executive board, university presidium or municipal council committee. Second, an analysis of Microsoft and WhatsApp data flows via /microsoft to make the specific access and metadata situation from your own network visible – this is regularly the decisive body of evidence in front of data protection officers and supervisory authorities. Third, a structured provider selection via the categorised alternatives matrix and a first conversation via /contact on migration planning. Anyone with a running Wire pilot by the turn of 2026/2027 and the BSI Grundschutz argumentation documented in-house is not only NIS2-compliant, but closes a compliance gap that supervisory authorities are likely to start actively checking from 2027.