What is the NIS2 registration duty?
Registration is a self-declaration. The entity assesses for itself whether it is a particularly important entity (besonders wichtige Einrichtung; "essential entity" in the NIS2 Directive) or an important entity (wichtige Einrichtung) under § 28 of the BSI Act (BSIG). It then registers with the Federal Office for Information Security (BSI). No authority issues a decision confirming scope, so the deadline runs even if nobody asks.
The legal basis is § 33(1) BSIG as amended by the NIS2 Implementation Act. It covers particularly important entities, important entities and domain name registry service providers. For the entity types listed in § 60(1), first sentence, BSIG, § 34 BSIG sets a special registration duty alongside it.
The duty also applies to entities that are exempt from the security and reporting duties. § 28(5) BSIG exempts public telecommunications providers and energy companies subject to §§ 5c to 5e of the Energy Industry Act (EnWG), as a rule, from §§ 30, 31, 32, 35, 36, 38, 39, 61 and 62. § 28(6) BSIG exempts financial entities under DORA from §§ 30, 31, 32, 35, 36, 38 and 39. § 33 appears in neither list.
What is the registration deadline?
Registration must take place no later than three months after an entity first or again qualifies as one of the entities named. For entities already in scope when the act entered into force on 6 December 2025, the deadline expired on 6 March 2026. According to the BSI's FAQ, the act provides no general transition period.
An entity that comes into scope later, through growth, an acquisition or a new activity, has three months from that day. Record the date and how you reached the conclusion in writing; that record shows the deadline was met.
How does registration in the BSI portal work?
The BSI describes registration as two steps: first sign-up with the "Mein Unternehmenskonto" (MUK) service, then registration in the BSI portal. The portal has been available since 6 January 2026. MUK uses ELSTER organisation certificates, and each NIS2-relevant entity needs its own MUK profile. According to the BSI, an entity without a German tax number can apply for one at the Neubrandenburg tax office (RAB) and then apply for the certificate.
The BSI sets the procedural details under § 33(6) BSIG and publishes them on its website. The portal asks for more than § 33(1) BSIG, including a NIS2 contact point and company size with headcount, annual turnover and balance sheet total.
What does § 33 BSIG require, and who keeps it current?
If the details you submitted change, § 33(5) BSIG requires you to notify the BSI without undue delay and at the latest within two weeks of becoming aware of the change. That deadline only holds if each item is assigned to the function that learns of a change first. The assignment below is an example; adapt the roles and sources to your organisation.
| Item under § 33(1) BSIG | Source in the company | Maintained by (example) | Triggers a change notice |
|---|---|---|---|
| No. 1: name, legal form, commercial register number | Commercial register extract | Legal | Change of name or legal form, merger |
| No. 2: address, contact details, email, telephone numbers | Contact directory | CISO | Office move, new contact person |
| No. 2: public IP address ranges | Network documentation, provider contracts | IT operations | New address range, change of provider, new cloud tenant |
| No. 3: sector or sub-sector under Annex 1 or 2 | Scope assessment | Compliance | New or discontinued activity |
| No. 4: Member States in which services of the entity types are provided | Service overview | Compliance | Market entry or exit |
| No. 5: competent federal and Land supervisory authorities | Scope assessment | Legal | Changed activity |
Item 4 asks only for the states in which the entity provides services of the entity types named in Annex 1 or 2, not for every country where it does business. For the IP ranges, check once a quarter that the portal matches your asset inventory and network documentation. Keep every submission with its date.
What does the special registration duty in § 34 BSIG cover?
§ 34 BSIG applies to the entity types in § 60(1), first sentence, BSIG. The deadline is also three months, but six items are required, including the address of the main establishment in the EU or of the designated representative. These entities report changes without undue delay and at the latest three months from the day of the change (§ 34(2) BSIG). The BSI forwards the details, except the IP ranges, to the European Union Agency for Cybersecurity.
What registration does not settle
Registration identifies the entity and makes it reachable. The security measures under § 30 BSIG, the reporting duty under § 32 BSIG and management's duties under § 38 BSIG apply regardless, unless § 28(5) or (6) BSIG exempts the entity. The NIS2 guide gives an overview of all duties.