In brief: The BSI has granted non-compliant companies until 31 July 2026 as a final deadline for NIS2 registration, signaling an end to previous non-enforcement.
The BSI has informed business associations that registration under the NIS2 Directive must be completed by 31 July 2026. The authority is thus signaling an end to the previously absent enforcement.
The registration obligation under the NIS2 Directive has existed since March 2025. The Directive itself has been in force in Germany since December 2024 and requires an estimated more than 29,000 companies and critical infrastructures to register with the authority. However, the BSI had not factually enforced the deadline, which is why a large number of affected organizations had not met the requirement.
By the expiration of the statutory deadline in March 2025, only around 11,500 companies had registered. This means that more than half of the estimated obligated entities ignored the requirement. Although over 4,000 additional organizations registered in the final week before the deadline, the recorded shortfall was substantial. The BSI at that time assessed this rush as a sign of fundamental compliance readiness.
According to the BSI, a considerable number of affected companies have not even examined whether they are subject to the registration obligation. The BSI offers these cases a goodwill pathway: those who submit bundled outstanding questions receive an additional six weeks for registration after the authority responds.
The NIS2 Act provides for fines of up to 500,000 euros for failure to register. The BSI is currently not emphasizing these sanctions, but is signaling through the extension deadline that the grace period is ending. Companies that have not yet verified their obligation should complete this by 31 July 2026.
Source: www.it-daily.net · Published 17 June 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.1.