Germany: NIS2-regulated entities must register with the BSI
Opmerking bij de datum: The NIS2UmsuCG (rewriting the BSI-Gesetz) was published in the Bundesgesetzblatt on 2025-12-05 and entered into force on 2025-12-06; §33 BSIG then gave affected entities 3 months to register, i.e. by 2026-03-06. The BSI subsequently allowed late registration up to 2026-07-31 as a grace period. Both dates have passed as of lastVerified; kept for reference and because the same 3-month registration clock also applies to any entity that newly falls into scope later.
Wat verandert er
Since the NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (NIS2UmsuCG) entered into force, 'particularly important' and 'important' entities under the rewritten BSIG (energy, transport, health, digital infrastructure, manufacturing of critical products, and other listed sectors, generally 50+ employees or >€10m turnover, some sub-sectors regardless of size) must self-assess their status and register with the BSI within 3 months, providing name/legal form, contact details, IP ranges and the relevant sectors.
Voor wie geldt dit
Medium and large companies (and some smaller companies in specific sectors such as trust services, DNS or public electronic communications) operating in the 18 NIS2 sectors listed in BSIG Annex 1/2.
Groottes: middelgroot, groot · Sectoren: Energie, Transport / logistiek, Zorg, Industrie / productie, Zakelijke dienstverlening, Financiën / verzekeringen · Geldt als: Wij zijn actief in een kritieke sector (NIS2); Wij verwerken persoonsgegevens
Wat u moet doen
Determine whether your company falls into a regulated sector and size band. If it does and you have not yet registered, register with the BSI immediately via the BSI registration portal; then begin implementing the risk-management measures required under §30 BSIG.
Sanctie
Fines up to €500,000 for failing to register (§65 Abs. 5 Nr. 5 BSIG, referencing §33); substantially higher fines (up to €10m or 2% of global annual turnover) apply for breaches of the underlying risk-management and reporting duties themselves.
Bronnen
- BSI – NIS-2-regulierte Unternehmen (registration status and portal) (www.bsi.bund.de)
- gesetze-im-internet.de – BSIG §33 (Registrierungspflicht) (www.gesetze-im-internet.de)
- gesetze-im-internet.de – BSIG §65 (Bußgeldvorschriften) (www.gesetze-im-internet.de)
Laatst geverifieerd op 8 september 2026. Uitsluitend ter informatie, geen juridisch advies.