NIS2 Registration Deadline: German Firms Must Register with BSI by March 6, 2026

Germany’s cybersecurity landscape is undergoing a significant shift as approximately 29,000 organizations face an impending deadline. These entities, deemed critical or important under the new NIS2 regulations, must complete their registration with the Federal Office for Information Security (BSI) by March 6, 2026. The registration process began on December 6, 2025, following the implementation of the NIS2 Act.

NIS2 Regulations: A Closer Look

The NIS2 regulations apply to companies with 50 or more employees, or those exceeding 10 million euros in annual revenue, operating within key sectors. These sectors include energy, healthcare, transport, digital infrastructure, and public administration. The regulations aim to strengthen cybersecurity standards and resilience across these vital areas.

The Importance of Timely Registration

According to Richard Skalt, Advocacy Manager Cybersecurity Office at TÜV SÜD, many organizations may be underestimating the scope of these new obligations. The requirements extend beyond simple registration to include ongoing data maintenance and the prompt reporting of security incidents.

Did You Know? The three-month registration window for affected organizations began on December 6, 2025, with a firm deadline of March 6, 2026.

The BSI has established a new portal to facilitate compliance with NIS2. This portal serves as the central hub for initial registration, data updates, and the reporting of significant security breaches.

Navigating the Registration Process

Organizations intending to meet the deadline are advised to initiate the registration process immediately. A crucial first step involves obtaining an ELSTER organizational certificate. The activation ID required for this certificate is delivered by post, a process that can take five to ten business days. Once the certificate is secured, companies must input details regarding their size, legal structure, a designated NIS2 contact, their sector, and the relevant federal authority into the BSI portal.

Expert Insight: The NIS2 regulations represent a significant escalation in cybersecurity expectations for a large segment of the German economy, requiring proactive measures and ongoing vigilance.

TÜV SÜD offers support to companies, including assessments of their current security measures, training for leadership, and assistance in determining their obligations under the new law. More information is available at tuvsud.com/en/topics/cybersecurity/nis2-services.

Frequently Asked Questions

What is the deadline for NIS2 registration?

The deadline for NIS2-obligated entities to register with the BSI is March 6, 2026.

Which companies are affected by NIS2?

Companies with 50 or more employees or an annual revenue exceeding 10 million euros, operating in sectors like energy, health, transport, digital infrastructure, and public administration are affected.

What is the role of the BSI portal?

The BSI portal serves as the central platform for NIS2-obligated entities to register, update their data, and report significant security incidents.

How will the implementation of NIS2 impact the overall cybersecurity posture of German organizations in the long term?