In brief: Of the roughly 29,500 NIS2 registrations originally expected, only 18,845 operators had registered with the BSI by 31 July, prompting the Interior Ministry to commission a recalculation of the number of entities affected.
Even after the extended grace period ended on 31 July, significantly fewer Kritis (critical infrastructure) operators registered with the BSI than the federal government had originally expected. The Federal Ministry of the Interior has since commissioned a recalculation of the number of entities affected.
By 31 July 2025, the end of the extended grace period, 18,845 companies and public authorities had registered with the Federal Office for Information Security (BSI) as being subject to NIS2 obligations, according to a report by heise online. Of these, 6,490 entities classify themselves as “essential entities,” while 12,355 are considered “important entities.” The legislator had originally assumed around 29,500 registrations, based on a calculation by the Federal Statistical Office made in connection with the passage of the NIS2 Implementation Act in December 2025. This leaves a shortfall of roughly 10,000 registrations compared with the original forecast. By the original, first deadline in early March, only about 11,500 operators had registered, meaning the additional grace period only partially closed the gap.
For compliance officers at companies, the registration obligation remains in place regardless of the overall low registration rate. Those who fail to register risk a fine. The BSI states that it has not yet imposed any sanctions, but is monitoring developments “closely.” For companies, this does not amount to an all-clear, but rather a phase in which enforcement could begin at any time, as soon as the BSI deems it appropriate.
According to the report, one key reason for the sluggish registration numbers lies in difficulties determining scope: not every company can easily establish whether it is obligated to register at all. This legal classification proves particularly difficult for nested corporate group structures — a problem the BSI itself acknowledges and one that was also a contributing factor in the decision to extend the registration period. For compliance departments at corporate groups with complex ownership structures, this is a concrete signal to verify their own applicability assessment once more rather than relying on an initial evaluation.
The Federal Ministry of the Interior has since asked the Federal Statistical Office to recalculate its earlier estimate of the number of obligated entities. This emerges from a response by the ministry to Green Party member of the Bundestag Jeanne Dillschneider, which heise online quotes from. Dillschneider criticizes the development and views the passing of the first regular deadline as a warning sign that was not sufficiently heeded. In her assessment, the scale of the threat situation has not yet been fully grasped in parts of the economy and public administration. In practice, the announced recalculation is likely to have medium-term implications for which companies will actually be considered affected going forward.
Source: www.it-daily.net · Published 4 August 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.