NIS2: Germany's BSI registration grace period has ended
What applies
Affected entities were required to register with the BSI — the grace period ended on 31 July 2026. Anyone still not registered is in breach of an ongoing duty: it doesn't expire, it just gets more urgent every day.
Important: nobody issues you a formal finding of applicability. You're obliged to check for yourself whether your company falls under Section 28 BSIG — and to register belatedly if it does (Section 33 BSIG). A late, voluntary registration is, in every realistic scenario, better than one the supervisory authority forces.
Who it affects
Companies from roughly 50 employees or €10 million turnover in the regulated sectors — from IT and energy through transport and health to manufacturing and chemicals.
Example (fictional): The supplier the customer reported
A machine builder with 120 employees doesn't consider itself affected — “we're not critical infrastructure.” Its largest customer, an energy utility, runs a supply-chain audit under Section 30 BSIG in 2026 and asks for the NIS2 registration number.
There isn't one. The energy utility duly reports the gap in its own risk report; the machine builder registers under time pressure — and now works through its list of measures under the eyes of both customer and authority, instead of at its own pace.
The risks, plainly stated
Fine for the missing registration
Failure to register is a regulatory offence. The range is set by Section 65 BSIG: up to €10 million or 2% of worldwide annual turnover for especially important entities, up to €7 million or 1.4% for important entities — in each case whichever is higher.
Personal liability for management
Section 38 BSIG puts managing directors personally on the hook — approval, oversight, and their own training. There's no fallback on “I didn't know.”
Visibility through the supply chain
Registered customers have to vet their suppliers — your gap surfaces in someone else's audit before the authority finds it.
Your next steps
- 01Assess applicability under Section 28 BSIG (sector plus size) and document it
- 02Register belatedly via the BSI portal and designate a contact point
- 03Start on the core measures in parallel — the 24-hour reporting duty already applies
In Compliverse
The compass turns exactly these steps into measures in your plan automatically — with deadlines, owners, and evidence.
Plain-language product content, not legal advice · Case studies are fictional · Fine amounts as stated in the legal act (“up to”)