Germany: NIS2-regulated entities must register with the BSI
Anmärkning om datumet: The NIS2UmsuCG (rewriting the BSI-Gesetz) was published in the Bundesgesetzblatt on 2025-12-05 and entered into force on 2025-12-06; §33 BSIG then gave affected entities 3 months to register, i.e. by 2026-03-06. The BSI subsequently allowed late registration up to 2026-07-31 as a grace period. Both dates have passed as of lastVerified; kept for reference and because the same 3-month registration clock also applies to any entity that newly falls into scope later.
Vad som ändras
Since the NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (NIS2UmsuCG) entered into force, 'particularly important' and 'important' entities under the rewritten BSIG (energy, transport, health, digital infrastructure, manufacturing of critical products, and other listed sectors, generally 50+ employees or >€10m turnover, some sub-sectors regardless of size) must self-assess their status and register with the BSI within 3 months, providing name/legal form, contact details, IP ranges and the relevant sectors.
Vem som berörs
Medium and large companies (and some smaller companies in specific sectors such as trust services, DNS or public electronic communications) operating in the 18 NIS2 sectors listed in BSIG Annex 1/2.
Storlekar: medelstort företag, stort företag · Branscher: Energi, Transport / logistik, Hälso- och sjukvård, Tillverkning, Konsult- och tjänsteföretag, Finans / försäkring · Gäller om: Vi är verksamma i en kritisk sektor (NIS2); Vi behandlar personuppgifter
Vad du ska göra
Determine whether your company falls into a regulated sector and size band. If it does and you have not yet registered, register with the BSI immediately via the BSI registration portal; then begin implementing the risk-management measures required under §30 BSIG.
Sanktion
Fines up to €500,000 for failing to register (§65 Abs. 5 Nr. 5 BSIG, referencing §33); substantially higher fines (up to €10m or 2% of global annual turnover) apply for breaches of the underlying risk-management and reporting duties themselves.
Källor
- BSI – NIS-2-regulierte Unternehmen (registration status and portal) (www.bsi.bund.de)
- gesetze-im-internet.de – BSIG §33 (Registrierungspflicht) (www.gesetze-im-internet.de)
- gesetze-im-internet.de – BSIG §65 (Bußgeldvorschriften) (www.gesetze-im-internet.de)
Senast verifierad 8 september 2026. Endast information, inte juridisk rådgivning.