NIS2 registration: how it works.

Every essential and important entity under §28 BSIG, plus domain name registration service providers. Settle first whether you belong, with the scope check. If you only receive requirements as a supplier to an entity in scope, you do not need to register.

You must register no later than three months after you first or again qualify as an entity (§33(1) BSIG). For everyone in scope since entry into force on 06.12.2025, the deadline ended on 06.03.2026. The portal has been open since 06.01.2026. The grace period the BSI had signalled to industry associations until 31.07.2026 has also passed.

If you later grow past the threshold or launch a new covered service, you again have three months from that point.

1. Check scope and document the result.
2. Set up Mein Unternehmenskonto (MUK). It is based on ELSTER, the German tax portal. You need the tax number of the legal entity. The activation code is sent by letter to the company's ELSTER contact address, often accounting, not to the person registering. Allow for postal delays.
3. Log into the BSI portal with MUK and submit the data. Whoever creates the first registration later manages permissions. Settle internally who that is and who holds the ELSTER credentials.

§33(1) BSIG lists:

• Name, where applicable legal form and commercial register number.
• Address and current contact details, including email address, public IP address ranges and phone numbers.
• The sector or industry under Annex 1 or 2.
• The EU member states in which you provide covered services.
• The responsible federal and state supervisory authorities.

Any change must be reported without delay, at the latest two weeks after you learn of it (§33(5) BSIG). Public IP ranges and contact details change more often than you think. Decide who maintains them.

• The BSI may register you itself, in agreement with the competent supervisory authority (§33(3) BSIG) and request documents if it has indications of a missing registration (§33(4)).
• Fines for breaching the registration duty go up to €500,000 (§65 BSIG).
• No fine proceedings have been publicly documented so far. That is no reason to wait: registration takes little effort and is the precondition for everything else.

Registration fulfils no other duty. Next you need a working reporting channel for significant incidents (24 hours, 72 hours, one month), the risk management measures under §30 BSIG and trained management that implements the measures and oversees them.