In a nutshell: The NIS2 registration deadline of 31 July is an administrative step; actual technical implementation requires planning to begin significantly earlier.
The NIS2 registration deadline of 31 July does not give companies enough time for the required implementation. Compliance officers must begin preparations now, as further requirements will follow.
Registration as a KRITIS operator or essential service provider (EDSA) by 31 July 2024 pursuant to the NIS2 Directive represents only the first step. This is followed by requirements for the implementation of cybersecurity measures and governance structures, which consume considerable internal resources.
For compliance officers, this means in concrete terms: while the registration deadline must be met in the short term, the actual security measures require advanced planning in parallel during this phase. This includes risk analyses, process adjustments and the establishment of incident response procedures.
Companies that do not begin registration or implementation of measures until after 31 July risk not only regulatory consequences but also postpone necessary security investments to an unrealistic timeframe. An early stocktaking and roadmap creation is therefore required to avoid implementation gaps.
Source: news.google.com · Published 8 July 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrase and classification via Lumi News Pipeline v1.7.3.