If your organisation falls under NIS2 and has not registered with the BSI, register now. Both dates have passed: the legal three-month deadline that ended in March 2026 and the BSI's own extension to 31 July 2026. The BSI's NIS2 page now says it plainly: "Die gesetzliche Registrierungsfrist ist bereits abgelaufen", the statutory deadline has expired, register immediately. Registration takes two steps: an ELSTER organisation certificate, then the form in the BSI portal. The certificate is the slow part, because its activation letter comes by post. Missing or late registration can be fined up to €500,000.
I work as an independent firewall and network-security consultant inside German enterprises, so I see NIS2 from the side that has to supply the technical data. This is a field guide, not legal advice. Your own scope question belongs with a lawyer if it is not clear-cut.
Does your organisation have to register?
You have to register if the BSI Act (BSIG) classifies you as a besonders wichtige Einrichtung (particularly important entity) or a wichtige Einrichtung (important entity). That depends on two things: whether your business matches one of the entity types listed in the law's annexes, and your size. The thresholds in § 28 BSIG are these:
| Category | Who | Size threshold |
|---|---|---|
| Particularly important | Operators of critical installations, qualified trust service providers, top-level domain registries, DNS service providers | None |
| Particularly important | Entity types in Annex 1 (energy, transport, finance, health, water, digital infrastructure and others) | At least 250 employees, or turnover over €50 million and a balance sheet over €43 million |
| Important | Entity types in Annex 1 or Annex 2 (Annex 2 adds waste, chemicals, food, manufacturing, digital providers, research and others) | At least 50 employees, or turnover and balance sheet each over €10 million |
Employees and turnover are counted under the EU SME recommendation 2003/361/EC. A group subsidiary does not add its partner or linked companies' figures if its IT systems are independent of theirs, which § 28(4) sets out in detail. If you are unsure, the BSI runs a free NIS-2 Betroffenheitsprüfung (scope check). Its result is guidance, not a ruling.
You missed 31 July 2026. What happens now?
Late registration is still possible, and the BSI is asking for it. The German NIS2 implementation law came into force on 6 December 2025. § 33(1) BSIG gives an entity three months from the date it first qualifies to submit its details. For most organisations that window closed on 6 March 2026.
The 31 July date was an extension on top of that. In June, heise reported a BSI letter to industry associations admitting that "significantly fewer companies have registered than expected", with the expectation that outstanding registrations would be done by 31 July. After that date passed, the municipal-utilities trade paper ZfK quoted the BSI: "Die gesetzlichen Fristen gelten unabhängig vom individuellen Umsetzungsaufwand" (the statutory deadlines apply regardless of individual implementation effort). It also reserved the right to take steps backed by fines.
The numbers show why the BSI keeps pushing. By 30 September 2026, 20,141 entities had registered under NIS2: 13,252 important and 6,837 particularly important. Earlier Destatis estimates put the total at about 29,500, and the BSI has asked Destatis to check whether that estimate was too high. In my reading, either several thousand organisations are still missing, or the estimate was wrong. Neither is a reason to wait. Under § 33(3) the BSI may also register an entity itself if it fails to do so, and I would rather file my own data than have the regulator fill it in from outside.
How much is the fine for registering late?
Up to €500,000. § 65(2) No. 6 BSIG makes it an administrative offence to submit the § 33 registration details "nicht, nicht richtig, nicht vollständig oder nicht rechtzeitig" (not at all, incorrectly, incompletely or late). It applies whether you act intentionally or negligently. § 65(5) No. 5 sets the maximum for that offence at €500,000.
The €10 million figure you will see in many articles belongs to other duties. Failing to take or document the risk-management measures of § 30, or to file incident reports under § 32, can cost a particularly important entity up to €10 million and an important entity up to €7 million. Above €500 million in worldwide turnover, the cap becomes 2% or 1.4% of that turnover. Registration carries the lowest cap of the three.
How do you register with the BSI, step by step?
The BSI calls it a two-step process: first Mein Unternehmenskonto (MUK), then the BSI portal. In practice it breaks into four tasks.
1. Apply for an ELSTER organisation certificate. You apply at mein-unternehmenskonto.de/registrierung. The prerequisite is a German tax number, whatever tax it was issued for. A seat in Germany is not needed. The certificate is free. The activation data arrive by email, and a separate activation letter goes by post to the address stored with your tax number. According to the BSI, that letter "regelmäßig mindestens fünf Werktage" takes at least five working days. You can download the certificate file only once you have both.
2. Log in to the BSI portal. On portal.bsi.bund.de choose "Mit MUK anmelden", upload the certificate file, enter its password and confirm that your company data may pass to the portal. Those company details come from the certificate and cannot be changed in the portal. Corrections happen in "Mein ELSTER".
3. Fill in the NIS-2 registration. The BSI's step-by-step guide lists the fields:
- whether you are a federal body, and whether you are registered as a critical-installation operator (with your institution ID if so);
- your NIS2 classification, sector, branch and entity type, and every EU member state where you provide services;
- all federal and state supervisory authorities for the activities that trigger registration, not only those for IT security;
- a NIS2 contact point: the department, one or two phone numbers in international format, and ideally a functional mailbox rather than a personal address;
- one or more contact persons who can speak to NIS2, each told that you are naming them;
- all public static IP address ranges, IPv4 and IPv6 in CIDR notation, or a statement that you have none.
Then click "Registrierung abschließen". The first user to register the organisation becomes its administrator and can invite colleagues.
4. Keep it current. Under § 33(5) BSIG, changes to your registration data must be entered without delay and within two weeks at the latest. New IP ranges and a changed contact person both count.
What should you prepare before you start?
| Item | Where it comes from | Who usually has it |
|---|---|---|
| German tax number | Finanzamt records | Finance or tax adviser |
| Activation letter for the ELSTER certificate | Post to the tax-number address, at least five working days | Whoever opens the company post |
| Classification, sector, entity type | § 28 BSIG, annexes, BSI scope check | Legal or compliance |
| Supervisory authorities | Licences and sector regulators | Legal or compliance |
| Contact point and contact persons | Internal decision | Management |
| Public static IP ranges (IPv4/IPv6, CIDR) | Provider contracts, RIR allocations, firewall and DNS configuration | Network team |
In my view the IP list is the item most likely to be wrong. Ranges belong to providers, branch offices and old projects, and the person filling in the form is rarely the person who knows all of them. Pull the list from provider contracts and from the configuration of your edge firewalls, not from memory. A network that drifted away from its documentation, as I described in the security controls that pass the audit and do nothing, will show it here first.
What does registration not cover?
Registration only tells the BSI you exist. The duties behind it start at the same time and do not wait for the form:
- Risk-management measures under § 30 BSIG: appropriate technical and organisational measures, with documentation that you took them.
- Incident reporting under § 32 BSIG: an early warning within 24 hours of becoming aware of a significant incident, a report within 72 hours, and a final report no later than one month after that report.
- Management duties under § 38 BSIG: management must implement and monitor the measures, attend training regularly, and is liable for culpable breaches under company law.
One practical link between the two: incident reports also go through the BSI portal, and every login needs an ELSTER organisation certificate. The BSI recommends one certificate per person who needs access. If the only certificate sits on one laptop, your 24-hour report depends on that person being reachable. I covered the wider readiness gap in why German SMEs are dangerously unprepared for NIS2, and a staged approach to the technical side in a pragmatic 90-day zero trust plan for the Mittelstand.
What can an external consultant do for a late client?
An external consultant helps most with the data, and very little with the form itself. A consultant cannot register the client under their own certificate. The BSI states that every certificate is bound to the company's tax number, and the activation letter goes to the client's tax address. So the critical path runs through the client's post room.
Where an external specialist helps is the content. That means working out the classification with the client's lawyers, building a correct list of public IP ranges, setting up a functional mailbox for the contact point, and making sure several people hold certificates before the first incident. If you contract into German organisations, as I described in how to become an IT freelancer in Germany, expect that question in scope discussions. Watch the overlap with the public sector too: the federal administration checks its own IT security by questionnaire, which tells you how much the state relies on self-declaration.
My advice for anyone still unregistered in October 2026: apply for the ELSTER certificate today, because the letter is the one step nobody can speed up. Collect the data while the post is on its way, and register the day it arrives.