In Brief: The actual number of registered NIS2 enterprises fell significantly short of the expected 29,500, prompting the BSI to extend the registration deadline from March to July 2026.
Significantly fewer companies than anticipated had registered with the BSI as NIS2-obligated by March 2026. The deadline was subsequently extended to 31 July 2026.
The Federal Office for Information Security (BSI) identified a massive registration backlog in the implementation of the NIS2 Directive. Approximately 29,500 companies were expected to register as operators of critical or important infrastructure. However, by the original deadline in March 2026, the actual number of registrations fell considerably short of this forecast.
This registration deficit presents CISOs with a compliance problem: companies that have not been identified or have failed to register risk fines and administrative follow-up demands. Moreover, it remains unclear whether all affected organisations actually meet NIS2 requirements or whether systematic gaps in the coverage of the threat landscape are emerging.
As a consequence, the BSI postponed the registration deadline to 31 July 2026. CISOs should verify whether their company falls under NIS2 obligations and, if necessary, register immediately with the BSI to avoid penalties and compliance violations.
Source: borncity.com · Published 30 July 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrasing and classification through Lumi News Pipeline v1.7.3.