September 30, 2026 · NIS-2 · Regulatorik · Compliance · Meldepflicht · Mittelstand

NIS-2 Registration: Deadline Passed – What Applies Now

The NIS-2 registration deadline has passed. How to check whether you are affected, register late – and why the real work only begins afterwards.

At the top of the BSI’s page for NIS-2-regulated companies there is currently a sentence that needs no interpretation: “The statutory registration deadline has already expired.” Below it follows the call for anyone who is affected and not yet registered to register in the BSI portal “immediately, now”.

This article is aimed at companies that are not yet certain on this question – either because they never checked whether they are affected, or because they postponed registration. Both can be caught up on. Neither should wait any longer.

The new BSI Act (BSIG) was adopted as Article 1 of the Act of 2 December 2025 (BGBl. 2025 I No. 301) and entered into force on 6 December 2025. § 33(1) BSIG obliges essential and important entities to register with the BSI no later than three months after they qualify as such “for the first time or again” („erstmals oder erneut“). For everyone who has fallen under the act since its entry into force, this deadline passed months ago.

The wording “for the first time or again” deserves a second look. The deadline is not a one-off cut-off date that lies behind us. A company that crosses a threshold through growth, an acquisition or a new line of business has three months again from that point on. Checking whether you are affected is therefore not a one-time exercise but belongs in annual planning.

Am I affected? The self-check

§ 28 BSIG is decisive. Two questions must both be answered with yes.

First: does your activity belong to one of the types of entity in Annexes 1 and 2 of the act? The distinction between the two annexes matters because it decides the possible classification. Annex 1 covers the sectors energy, transport, finance, health, water, digital infrastructure and space. Annex 2 reaches far beyond the classic KRITIS sectors and names, for example, postal and courier services, waste management, food businesses in wholesale and industrial production, and, in manufacturing, among others mechanical engineering, the manufacture of electrical equipment and the manufacture of motor vehicles and motor vehicle parts. Business activities that are negligible in relation to the overall business activity can be disregarded under § 28(3).

Second: do you reach the size thresholds? For most companies the following applies:

  • Important entity (types of entity from Annex 1 or 2): at least 50 employees, or annual turnover and annual balance sheet total each of more than EUR 10 million.
  • Essential entity (types of entity from Annex 1 only): at least 250 employees, or annual turnover of more than EUR 50 million and in addition an annual balance sheet total of more than EUR 43 million.

A mechanical engineering company with 300 employees is therefore an important, not an essential entity – mechanical engineering is in Annex 2 – unless it operates a critical facility or additionally carries out an activity from Annex 1. Only with a type of entity from Annex 1 does the same size lead to classification as essential.

For some types of entity – such as trust service providers, DNS service providers and telecommunications providers – different rules apply, up to classification regardless of size. For the calculation, the act refers to the European Commission’s SME recommendation. Data from partner or linked enterprises are not added if your company is independent of them with regard to its IT systems and processes.

For a first assessment, the BSI provides an online check of whether you are affected. It does not replace a legal assessment. But record the result in writing, together with the figures it rests on. A “not affected” is also a statement you should be able to justify if in doubt.

What to do if the deadline has been missed

Register now. The act knows no grace period that one could wait for. Under § 33(3), the BSI can also carry out the registration itself, in agreement with the competent supervisory authority, if a company does not meet its obligation. And under paragraph 4: “If facts justify the assumption” („Rechtfertigen Tatsachen die Annahme“) that an entity is not meeting its registration obligation, it must submit documents to the BSI and provide information on request. Anyone who waits is therefore leaving the first step to the authority.

Registration runs in two steps:

  1. Apply for an ELSTER organisation certificate via the “Mein Unternehmenskonto” service. A German tax number is required. Part of the activation data arrives by post; the BSI regularly cites at least five working days for this. Anyone who starts today will therefore be in the portal next week at the earliest.
  2. Register in the BSI portal with this certificate. The information requested includes sector and type of entity, the EU member states in which you operate, the competent supervisory authorities and a NIS-2 point of contact. § 33(1) also requires the public IP address ranges.

Two practical notes. The BSI recommends one ELSTER organisation certificate per person who is to have access to the portal; whoever registers first automatically becomes administrator. So plan for at least one deputy – not only when the sole certificate holder is on holiday and an incident has to be reported. And: if the information changes later, the changes must be reported under § 33(5) without undue delay, but no later than two weeks after becoming aware of them.

What a failure can cost. Anyone who does not submit, or does not submit in time, information under § 33 commits an administrative offence under § 65 BSIG; fines range up to EUR 500,000. The range is considerably higher for the substantive obligations: for breaches of the risk management or reporting obligations, the act provides for up to EUR 10 million for essential and up to EUR 7 million for important entities. With a total turnover of more than EUR 500 million, it can instead be up to 2 or 1.4 percent of worldwide turnover respectively.

Registration is only the first step

With registration you sign up with the BSI. None of the obligations that actually matter has been fulfilled by it.

Risk management under § 30. Affected entities must take appropriate, proportionate and effective technical and organisational measures – and document compliance with them. The minimum catalogue comprises ten points, including risk analysis, handling of security incidents, backup management and recovery, supply chain security, vulnerability management, training, cryptography, access control and multi-factor authentication.

Reporting obligations under § 32. Significant security incidents must be reported in stages: an early warning no later than 24 hours after becoming aware, a notification with an initial assessment no later than after 72 hours, and a final report one month after the 72-hour notification (for an ongoing incident, a progress report first). The BSI makes clear that these are maximum times that should not be exhausted. Important for latecomers: according to the BSI, anyone not yet registered who suffers a significant incident reports it via an online form in the reporting and information portal. The missing registration does not release you from the reporting obligation.

Obligations of management under § 38. Management must implement the risk management measures, monitor their implementation and take part in training regularly. For culpably caused damage it is liable under the company-law rules of its legal form. The work can be delegated, the responsibility cannot.

A realistic order

For a company that finds today that it is affected, we recommend this sequence: this week, apply for the ELSTER certificate and document that you are affected; register once the certificate has arrived; in parallel, define a reporting process that also holds on a Friday evening – who notices, who assesses, who reports, with deputies. After that comes a structured review against the catalogue of § 30 with a prioritised action plan. The BSI roadmap “#nis2know” divides this approach into six phases and is a usable framework.

How sector7 supports you

Registration itself is done in a few steps. We support you with what comes after: with a structured review of your measures, a prioritised roadmap and the technical implementation – more under regulatory compliance. As an external information security officer, we can also maintain your reporting channels for an emergency on request; you will find the technical measures under cyber security.

This article is a professional assessment and does not replace legal advice in individual cases.

Sources

Let's talk about your situation.

Arrange a call+49 212 240915 0