The statutory registration window for organisations in scope of the German NIS2 transposition has been closed since March 2026. By the end of May only about two thirds of affected organisations were in the BSI portal. The BSI is tolerating late filings until 31 July 2026. After that, leniency is unlikely.
Why this is urgent now
Registration is the entry point for supervision, incident reporting, and evidence. An organisation that is an essential or important entity and is still unregistered is already late. The grace period is an administrative tolerance, not a change to the duty itself.
If you have not finished the scope check, do that first: KRITIS operator, size thresholds, and Annex 1 or Annex 2 sectors decide whether you must register at all.
What to finish by 31 July
- Confirm whether you are an essential entity, an important entity, or out of direct scope.
- Collect the data the BSI portal asks for: legal entity, sector, contacts, and sites.
- Name the people who will receive incident notices.
- Document the ten risk-management areas under § 30 BSIG, even if implementation is still in progress.
- Keep the registration receipt and the date with the rest of your compliance evidence.
What further delay costs
After the grace period the BSI can treat missing registration as a breach. Fines sit on top of the operational duties: early warning in 24 hours, notification in 72 hours, and a final report within a month once you are in scope. Customers that are themselves regulated will ask for the registration status in supplier reviews.
Conclusion
31 July 2026 is the practical end of the tolerance. Register if you are in scope, and keep the evidence next to the duties that follow.
Document scope, registration status, and NIS2 measures in deveca GRC