In brief: Companies must check whether they fall under NIS2 by 31 July 2026 and register – many have not yet recognised this obligation.
The NIS2 Directive sets a registration deadline of 31 July 2026, but many companies in the DACH region are not yet aware of this requirement. For compliance officers, this creates a substantial risk of missing the deadline.
The European NIS2 Directive requires certain companies to register by 31 July 2026 as operators of critical infrastructure or important digital service providers. A registration gap exists in that the registration process has not yet been launched comprehensively, while many affected organisations have not recognised their registration obligation.
For compliance functions, this means in concrete terms: companies must first check whether they fall under the expanded NIS2 categorisation – for example as operators of critical infrastructure in sectors such as energy, water supply, transport, healthcare or financial services, or as significant digital service providers. The deadline is approaching and the registration process itself typically requires organisational preparation and documentation of security measures.
Compliance teams should immediately undertake a stock-take: Does the company fall under NIS2? What registration obligations result from this? And what technical and organisational security requirements must be met? Early clarification minimises the risk of administrative fines and operational disruptions caused by last-minute requirements.
Source: news.google.com · Published 30 July 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.