NIS2

NIS2 registration in Germany: who, by when and how it works with the BSI

By Lucas Weber, CyberSec42 · Updated 28 Oct 2026

In Germany, every particularly important entity, every important entity and every domain name registration service provider must register with the Federal Office for Information Security (BSI) no later than three months after falling into that category (Section 33 BSIG). For organisations already in scope when the German NIS2 implementation act took effect on 6 December 2025, that deadline expired on 6 March 2026. Registration runs through the BSI portal and requires an ELSTER organisation certificate from the "Mein Unternehmenskonto" service. If you have missed it, register now: a missing or incorrect registration can be fined up to EUR 500,000.

This article reflects the situation as of 28 October 2026 and is not legal advice. Whether your organisation falls under the BSIG and how a deadline applies in your case is a question for your legal counsel.

Who has to register with the BSI

The registration duty is set out in Section 33 of the BSI Act (BSIG) as amended by the German NIS2 implementation act. It covers three groups: particularly important entities, important entities and domain name registration service providers. "Particularly important" (besonders wichtig) is the German legal term for what the EU directive calls an "essential entity".

Whether your company belongs to one of these categories depends on sector, entity type and size under Section 28 BSIG. That assessment comes before registration, and we cover it in NIS2: who is affected and what to do next. For a first indication, the BSI offers an official scope check (in German). Its result is not legally binding, but it is a useful starting point.

Two points are often missed in practice. First, the BSI registers each entity separately. The certificate of one company cannot be used to register another. In a group, every company in scope needs its own registration, although a central team can handle them all if it holds each company's certificate. Second, getting access to the BSI portal is not the same as the NIS-2 registration. You start that separately in the portal's NIS-2 area.

By when: the registration deadline

Section 33(1) BSIG requires registration "no later than three months" after an organisation is considered a particularly important or important entity "for the first time or again". The deadline is therefore not a fixed calendar date but depends on when your company came into scope.

• In scope since the act took effect. The German NIS2 implementation act was promulgated in the Federal Law Gazette on 5 December 2025 (BGBl. 2025 I No. 301) and has applied since 6 December 2025, without a transition period. Organisations that met the criteria on that day had to register by 6 March 2026. On its NIS-2 page the BSI states that the statutory registration deadline has passed and asks organisations in scope to register immediately.
• In scope later. If a company grows past the thresholds, starts an activity in a regulated sector or is newly founded, its own three-month period starts from the point it qualifies as an entity. The law says so explicitly with the words "for the first time or again".
• Changes. If registered details change, for example contact data, IP address ranges or sectors, Section 33(5) BSIG requires an update without undue delay and within two weeks of becoming aware of the change. For the entity types under Section 34 BSIG, changes must be reported within three months at most.

Before you register: preparing access

You can only log in to the BSI portal with an ELSTER organisation certificate, which you apply for through the government service "Mein Unternehmenskonto" (MUK). The BSI made this binding in its specification of the registration procedure under Section 33(6) BSIG. Because this step involves a letter in the post, it is the real bottleneck.

• You need a German tax number, for any type of tax. MUK does not require a registered office in Germany.
• Activation comes in two parts. The user name and activation ID are sent by email to the address given in the application. The activation code is sent by letter to the address registered for the tax number. According to the BSI, delivery regularly takes at least five working days. You then download the certificate file within a limited period.
• It is not a personal ELSTER certificate. The organisation certificate belongs to the company, not to an individual. Creating it is free of charge.
• One certificate per person. Each certificate is linked to exactly one user account, and the BSI recommends giving each person their own. Whoever registers the entity first in the BSI portal becomes its administrator and can invite further users.
• Service providers can act on your behalf with their own, appropriately authorised certificates without registering themselves.

For companies with a central mailroom or a group structure, this matters: the letter goes to the address held by the tax authority. Decide in advance who receives it there and forwards it. Otherwise the registration ends up waiting for a letter sitting in the wrong inbox.

The BSI portal process step by step

The steps below follow the BSI's own guide. The interface may change, so the current BSI registration guide (in German) is authoritative.

1. Log in. On portal.bsi.bund.de, choose "Mit MUK anmelden", upload the organisation certificate and enter its password. You need the certificate for every login.
2. Confirm the data transfer. The master data from "Mein Unternehmenskonto" is shown: name, address, legal form, register type, register number and register court. If anything is wrong, correct it in "Mein ELSTER", not in the BSI portal.
3. Open the NIS-2 area and choose "Zur NIS-2-Registrierung".
4. Classify the entity. State whether it is a federal body, whether it is registered as an operator of a critical facility (if so, with the ID from that registration) and which NIS-2 category applies.
5. Sector, branch and entity type are selected from drop-down lists. If you have several activities, add them with "Weitere Einrichtungsart hinzufügen".
6. Member states and supervisory authorities. List every EU member state where you provide services, and every competent federal and state supervisory authority by its full name. This means any authority supervising the activity concerned, not only the one responsible for information security.
7. Point of contact. Enter the organisational unit, address, one or two phone numbers in international format and a functional mailbox rather than a personal email address.
8. Contact persons with their role or function, ideally several. You must inform the people you name beforehand and confirm this in the form.
9. Public IP address ranges in CIDR notation, IPv4 and IPv6. If you have no static public ranges, say so.
10. "Registrierung abschließen" completes the registration once all mandatory fields are filled. Later changes are made under the "Ihre Registrierung" tab.

What information is required

The law defines what must be submitted, and the portal asks for it in the order described above. In practice the form is rarely what takes time. Gathering the information is. The table shows what to settle beforehand.

For the entity types under Section 34 BSIG, the address of the main establishment in the EU and of any other establishments is added. Companies without an EU establishment give the address of their designated representative.

A practical note on IP address ranges: for many companies this is the hardest item, because public addresses are spread across providers, cloud accounts and subsidiaries. A clean inventory of your internet-facing systems is worth having anyway. It is the basis of any risk management programme and any penetration test.

Missed the deadline: the risk and what to do now

Anyone who fails to submit the information under Section 33(1) or Section 34(1) BSIG, or submits it incorrectly, incompletely or late, commits an administrative offence (Section 65(2) no. 6 BSIG). The fine for this is up to EUR 500,000 (Section 65(5) sentence 1 no. 5 BSIG). Negligence is enough; intent is not required. The higher amounts of up to EUR 10 million or EUR 7 million often quoted in connection with NIS2 relate to other breaches, mainly missing risk management measures and failures to report incidents.

The BSI also has two powers aimed directly at registration. It can register an entity that fails to do so itself, in agreement with the competent supervisory authority (Section 33(3)). And where facts suggest an entity has not met its duty, it can demand the documents and information it needs to assess the case (Section 33(4)).

For late registrants this means:

1. Document your scope assessment. Record the result with date and reasoning, even if the answer is "not in scope".
2. Apply for the certificate now. The postal delivery is the longest part; everything else can be prepared in parallel.
3. Gather the information using the table above, particularly IP address ranges and supervisory authorities.
4. Complete the registration and file the confirmation with its date.
5. Keep it current from then on. Report every change within two weeks, ideally with a named owner for the task.

How the authorities handle late registrations in an individual case cannot be predicted in general terms. What is certain: the BSI explicitly asks organisations to register without delay, and a completed registration is the precondition for meeting the other duties at all.

After registration: what comes next

Registration is the formal entry point, not the goal. It tells the BSI about your entity and your contacts. The substantive duties have applied independently of it since the act took effect:

• Incident reporting (Section 32 BSIG). Significant security incidents are reported in stages: an early warning within 24 hours of becoming aware, a notification with an initial assessment within 72 hours and a final report one month later at the latest. The point of contact you registered is the channel through which the BSI reaches you.
• Risk management (Section 30 BSIG). Appropriate technical and organisational measures in line with the state of the art, from access control and backup to supply chain security, and their documentation.
• Management body (Section 38 BSIG). Management must approve the measures, oversee their implementation and take part in training regularly.

What these duties mean in practice and in which order to tackle them is covered in NIS2: who is affected and what to do next. If you are a software or SaaS manufacturer also covered by the Cyber Resilience Act, our article on CRA reporting obligations explains how the reporting channels differ.

The NIS2 registration checklist

How CyberSec42 can help

Registration itself is manageable once the groundwork is done. The demanding part comes afterwards: the measures under Section 30 BSIG have to be effective and evidenced, and a significant incident has to be detected quickly enough for the 24-hour deadline to be realistic. We offer two ways in, within a scope agreed in writing and with an individual offer.

If you are also preparing for ISO 27001 or for customer security questionnaires, see our page on compliance readiness.

Frequently asked questions

Further reading

• NIS2: who is affected and what to do next
• ISO 27001 for SaaS and startups: what really counts
• Penetration Testing: Process, Duration and What It Costs
• Service: NIS2 readiness through to evidence

Sources

• BSIG Section 33: registration duty (German)
• BSIG Section 34: special registration duty for certain entity types (German)
• BSIG Section 65: fines (German)
• BSIG Section 32: reporting obligations (German)
• BGBl. 2025 I No. 301: German NIS2 implementation act
• BSI: NIS-2 regulated companies (German)
• BSI: guide to NIS-2 registration in the BSI portal (German)
• BSI: Mein Unternehmenskonto and the ELSTER organisation certificate (German)
• BSI: specification of the registration procedure under Section 33(6) BSIG (German)
• BSI: NIS-2 scope check (German)