NIS2 in Germany: the statutory BSI registration window has passed, and the duty keeps running
Published by Luiz Hogrefe: August 22, 2026
What changed
The German law transposing NIS2 has been in force since 6 December 2025. Section 33(1) BSIG requires entities in scope to register with the BSI within three months of first or again becoming subject to it. For those already in scope at entry into force, that statutory period ended in the first quarter of 2026. The BSI itself reports that around 29,500 companies and institutions are in scope and, on opening the registration portal in June 2026, said it expected the bulk of registrations to be complete over the summer of 2026. The distinction that matters: registering late ends the omission from that point on; not registering leaves the duty open, and it keeps running.
Who is affected
Particularly important entities and important entities within the meaning of the BSIG, including German subsidiaries and branches of Brazilian groups operating in the covered sectors. Registration belongs to the German establishment itself, not to the parent.
What to do
Redo the scope assessment and, if it comes out positive, complete the registration, which runs in two steps: first the account in the Mein Unternehmenskonto service, then registration in the BSI portal. Changes of data have to reach the BSI without undue delay, at the latest within two weeks. A late registration is still better than none.
Primary source
https://www.gesetze-im-internet.de/bsig_2025/__33.html
Checked against the primary source by Luiz Hogrefe on August 22, 2026; source opened: https://www.gesetze-im-internet.de/bsig_2025/__33.html.