The German Federal Office for Information Security (BSI) has extended the registration deadline for organizations required to comply with the EU’s Network and Information Security (NIS2) Directive from October 17, 2024, to January 18, 2025. The directive, which strengthens cybersecurity obligations for critical infrastructure and digital service providers, now requires affected entities to register with the BSI—though the exact scope of who must comply remains a subject of debate among legal experts and industry groups.
With the deadline now pushed back by nearly three months, businesses face a critical window to assess their exposure, determine whether they fall under NIS2’s expanded definition of “essential entities,” and prepare for potential audits or enforcement actions. Failure to register—or to meet the directive’s security requirements—could result in fines of up to €10 million or 2% of global annual turnover, whichever is higher, according to the European Commission’s implementing regulations.
This extension comes as the BSI continues to refine its guidance on which sectors and organizations are covered. Unlike the original NIS Directive, which focused narrowly on operators of essential services, NIS2 broadens the net to include digital service providers (e.g., cloud computing, online marketplaces) and public administration bodies, alongside traditional critical infrastructure like energy, transport, and healthcare. The ambiguity over who qualifies has left some mid-sized firms uncertain about their obligations.
Why the Deadline Was Extended—and What It Means for Compliance
The BSI cited “operational challenges” in processing registrations as the primary reason for the delay, a move that aligns with similar extensions granted in other EU member states still transposing NIS2 into national law. However, industry observers warn the delay could mask deeper issues: inconsistent enforcement across EU countries, a lack of clarity in the BSI’s registration portal, and ongoing disputes over which entities are truly “in scope.”
For example, while the BSI’s registration guidance lists 18 critical sectors, it does not explicitly address whether supply chain vendors or third-party service providers handling sensitive data for covered entities must also register. Legal firms specializing in cybersecurity law report that clients are scrambling to clarify their status before the new deadline.
One key change under NIS2 is the introduction of mandatory reporting obligations for incidents, even if they do not directly disrupt services. Previously, only “significant” incidents had to be reported; now, entities must notify the BSI within 24 hours of becoming aware of a breach, with additional details due within 72 hours. The BSI has emphasized that this applies to all registered entities, not just those in high-risk sectors.
Who Must Register Under NIS2—and How to Check Your Status
The BSI’s registration process is now open, but determining eligibility remains a hurdle. The directive defines two categories of entities:
- Essential entities: Operators of critical infrastructure in sectors like energy, transport, banking, digital infrastructure, and public health. These face the strictest obligations, including regular risk assessments and incident response testing.
- Important entities: Digital service providers (e.g., online platforms, cloud services) and other organizations deemed vital to market integrity or public safety. These must still register but may have slightly less onerous compliance requirements.
To verify whether your organization is affected, the BSI recommends consulting its sector classification list, which maps out which activities trigger registration. For instance, a cloud provider hosting government data would likely qualify as an essential entity, while a small e-commerce platform might fall under the “important entities” category—or not at all, depending on its transaction volume and data handling practices.
Complicating matters further, the BSI has not yet published a final list of registered entities, meaning some organizations may only discover their obligations after the fact. “We’re advising clients to err on the side of caution,” says Dr. Anna Weber, a partner at DLA Piper’s cybersecurity practice. “If you’re unsure, register now. The penalties for non-compliance are severe, and the BSI is unlikely to grant further extensions.”
What Happens If You Miss the January 18, 2025 Deadline?
While the BSI has not publicly stated what actions it will take against late registrants, European Commission guidelines suggest a phased approach:
- First 6 months after the deadline: The BSI may issue warnings or require corrective plans, particularly for entities that demonstrate good-faith efforts to comply.
- After 6 months: Fines can be imposed, starting at €10,000 per day for repeated non-compliance, scaling up to the maximum €10 million or 2% of turnover for willful violations.
- Ongoing enforcement: The BSI has signaled it will conduct unannounced audits of registered entities, focusing first on sectors with the highest risk profiles (e.g., energy, financial services).
One recent example underscores the stakes: In September 2024, the Dutch National Cyber Security Centre (NCSC) fined a major Dutch energy provider €1.2 million for failing to report a cyber incident within the original NIS Directive’s 72-hour window. While NIS2’s reporting thresholds are slightly different, the case serves as a warning of how strictly regulators are interpreting compliance.
Step-by-Step: How to Register with the BSI Under NIS2
Organizations that determine they must register can do so through the BSI’s online portal. The process involves:
- Confirm your entity type: Select whether you are an essential or important entity.
- Provide legal and operational details: This includes your business registration number, sector classification, and a description of your critical functions.
- Designate a contact person: The BSI requires a named representative responsible for cybersecurity compliance.
- Submit supporting documentation: Depending on your sector, this may include risk assessment reports, incident response plans, or evidence of third-party audits.
- Await confirmation: The BSI aims to process registrations within 10 business days, though delays are possible during peak periods.
For entities struggling with the technical requirements, the BSI offers guidance on cybersecurity measures, including:
- Implementing multi-factor authentication (MFA) for all critical systems.
- Conducting penetration testing at least annually.
- Establishing incident response teams with clear escalation protocols.
- Ensuring supply chain security, including vendor risk assessments.
Beyond Registration: What NIS2 Requires Long-Term
Registration is just the first step. NIS2 introduces several ongoing obligations:
- Risk management: Entities must conduct annual risk assessments and update their cybersecurity strategies accordingly.
- Incident reporting: Breaches must be reported within 24 hours of detection, with follow-up details due within 72 hours.
- Third-party oversight: Organizations using external providers (e.g., cloud services, IT vendors) must ensure those vendors also meet NIS2 standards.
- Supervisory reviews: The BSI or designated national authorities can conduct unannounced audits to verify compliance.
For smaller businesses, these requirements may seem daunting. However, the BSI has emphasized that proportionality applies: while essential entities face stricter scrutiny, important entities can adopt scaled-down measures. “The key is to start now,” advises Markus Schneider, head of cybersecurity at Deutsche Bundesbank. “Even if you’re not sure you’re in scope, documenting your cybersecurity posture will put you ahead if the BSI comes knocking.”
What’s Next: Key Dates and Upcoming Actions
The BSI has not announced further extensions, but several deadlines and developments remain on the horizon:
- January 18, 2025: Final deadline for initial NIS2 registrations in Germany.
- Q2 2025: Expected publication of the BSI’s first list of registered entities, which will clarify which organizations are actively complying.
- Late 2025: Anticipated start of enforcement actions, including potential fines for non-compliant entities.
- 2026: First full cycle of supervisory reviews, where the BSI will audit registered entities’ cybersecurity practices.
The European Commission has also signaled that it will monitor cross-border compliance, meaning entities operating in multiple EU countries may face coordinated inspections. “This is not just a German issue,” notes Dr. Weber. “If you’re doing business across the EU, you need to align with NIS2’s requirements wherever you operate.”
FAQ: Common Questions About NIS2 Registration
Q: My business is small—do I need to register?
A: It depends. If you operate in a critical sector (e.g., energy, finance, healthcare) or provide digital services to a large user base, you likely qualify as an “important entity” and must register. The BSI’s small business guidance provides exemptions for very low-risk operations.
Q: What if I register but later realize I shouldn’t have?
A: The BSI allows for de-registration if an entity determines it was incorrectly classified. However, you must provide evidence (e.g., updated risk assessments) to justify the change.
Q: Are there any exemptions for startups or SMEs?
A: No formal exemptions exist, but the BSI encourages proportional compliance. Startups can focus on basic cyber hygiene (e.g., MFA, encryption) while scaling up their security programs as they grow.
Q: How will the BSI verify my registration?
A: The BSI may request additional documentation, such as ISO 27001 certifications, penetration test reports, or incident response plans. Some sectors (e.g., energy, finance) will face more rigorous scrutiny.
Q: What should I do if I experience a cyber incident before registering?
A: Report it immediately to the BSI using their incident reporting form. Even if you’re not yet registered, NIS2’s reporting obligations apply to entities that should have been registered.
For organizations still unsure about their obligations, the BSI recommends consulting with a cybersecurity legal expert or reviewing the full text of the NIS2 Directive.
Final Checklist: Are You Ready for NIS2?
- ✅ Determine your entity type (essential or important) using the BSI’s sector list.
- ✅ Register by January 18, 2025, even if you’re uncertain about your status.
- ✅ Document your cybersecurity measures (risk assessments, incident response plans).
- ✅ Train employees on NIS2’s reporting requirements.
- ✅ Monitor BSI updates for sector-specific guidance or enforcement actions.
The January 18 deadline is fast approaching, but the BSI’s extension offers a critical opportunity to get compliance right. For businesses that act now, NIS2 can serve as a catalyst for stronger cybersecurity—not just a regulatory hurdle. As Dr. Schneider of the Bundesbank puts it: “This is your chance to future-proof your organization. The entities that thrive under NIS2 will be those that treat cybersecurity as a strategic priority, not just a checkbox.”
Have questions about your NIS2 obligations? Share your concerns in the comments below—or reach out to the BSI directly via their contact form. For ongoing updates, bookmark the BSI’s NIS2 news section.