NIS2 guide

NIS2 registration: deadlines and what to submit

NIS2, Directive (EU) 2022/2555, makes every EU country keep a list of the organisations it covers, and it makes those organisations give their national authority the details for that list. A smaller group of digital service providers also goes into a registry kept by ENISA, the EU's cybersecurity agency. Registering is a short form, but it has its own deadline and has to be kept up to date. This guide explains the two registration duties, what you submit, which dates apply, and how Germany and Belgium have set their own deadlines.

Article numbers refer to the Directive unless the text says otherwise. The Directive binds countries, not businesses: your actual deadline and the place you register come from the national law of the country that supervises you.

Last checked 9 November 2026 against the Directive's text on EUR-Lex, the German BSI Act as published on gesetze‑im‑internet.de, and the Belgian law of 26 April 2024 on ejustice.just.fgov.be. This is general information, not legal advice.

1. The short answer

2. Two registration duties: Articles 3 and 27

The national list (Article 3). "By 17 April 2025, Member States shall establish a list of essential and important entities as well as entities providing domain name registration services" and must review it "at least every two years thereafter" (Article 3(3)). To build the list, each country must require those entities to submit a minimum set of details, and it "may establish national mechanisms for entities to register themselves" (Article 3(4)). Germany and Belgium, the two laws covered below, both make entities register themselves through a route the authority sets, rather than waiting for the authority to find them. Every two years the authorities report the number of entities per sector to the Commission (Article 3(5)); the names stay at national level.

The ENISA registry (Article 27). ENISA keeps a registry of "DNS service providers, TLD name registries, entities providing domain name registration services, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, as well as providers of online marketplaces, of online search engines and of social networking services platforms" (Article 27(1)). These providers still submit their details to a national authority, and its single point of contact forwards them to ENISA (Article 27(4)). Where a country has a national registration mechanism, the Article 27 details go in through it too (Article 27(5)), so in practice it is one registration with extra fields.

Which country. Most entities register in the country where they are established. The eleven digital types are the exception: they fall under the country of their "main establishment in the Union", which is where decisions on cybersecurity risk-management measures are "predominantly taken" (Article 26(1)(b) and (2)). A provider of those services that is not established in the EU must name a representative in an EU country where it offers services (Article 26(3)). Our guide NIS2 for managed service providers works through the main-establishment test.

3. What every entity submits

Article 3(4) sets the minimum each country must ask for. Countries can ask for more, and both Germany and Belgium do.

Article 3(4) itemWhat to have ready
(a) the name of the entityYour registered legal name. Germany also asks for the legal form and commercial register number; Belgium for your company number (BCE/KBO) or the equivalent registration in another EU country.
(b) the address and up-to-date contact details, "including email addresses, IP ranges and telephone numbers"A registered address, a shared mailbox and phone number that someone answers (not one person's own), and the public IP address ranges you hold or use. Ask your internet provider or hosting company if you are not sure which ranges are yours.
(c) where applicable, the sector and subsector in Annex I or IIThe sector and subsector your activity falls under, for example "Digital infrastructure" or "Manufacturing: computer, electronic and optical products". Our scope guide lists them.
(d) where applicable, the Member States where you provide services in scopeEvery EU country where you provide the service that brings you into scope, not just where you have an office.

The duty does not end with the first submission. Entities "shall notify any changes to the details submitted ... without delay, and, in any event, within two weeks of the date of the change" (Article 3(4), second subparagraph). A new phone number, an office move or a change of internet provider that changes your IP ranges all count.

4. What the digital providers submit

The eleven types listed in Article 27(1) submit these six items (Article 27(2)):

  1. the name of the entity;
  2. the relevant sector, subsector and type of entity in Annex I or II;
  3. the address of its main establishment and its other legal establishments in the EU or, if it is not established in the EU, of its representative;
  4. up-to-date contact details, including email addresses and telephone numbers of the entity and, where applicable, its representative;
  5. the Member States where it provides services; and
  6. its IP ranges.

The difference from Article 3 is the list of establishments and the representative. The IP ranges stay with the national authority: everything except point (f) is forwarded to ENISA (Article 27(4)). Changes must be notified "without delay and in any event within three months of the date of the change" (Article 27(3)). Most of these providers are also essential or important entities on their country's Article 3 list, and the two-week rule applies to the details given for that list.

5. The deadlines

The Directive set the dates by which countries had to have their law in place and their lists ready. Countries had to adopt their law by 17 October 2024 and apply it from 18 October 2024 (Article 41(1)). Many were late, so the registration deadline in each country's law often runs from that law's own start date.

WhoFirst registrationChanges
Directive, Article 3 listCountries establish the list by 17 April 2025 (Article 3(3))Within two weeks (Article 3(4))
Directive, Article 27 digital providersEntities submit to their authority by 17 January 2025 (Article 27(2))Within three months (Article 27(3))
Germany, essential and important entitiesWithin three months of first coming into scope (§ 33(1) BSIG); the law came into force on 6 December 2025Within two weeks of learning of the change (§ 33(5))
Germany, digital providersWithin three months of coming into scope (§ 34(1) BSIG)Within three months (§ 34(2))
Belgium, essential and important entitiesWithin five months of the law's entry into force on 18 October 2024, so by 18 March 2025, or of being identified later (Article 13 § 1)Within two weeks (Article 13 § 3)
Belgium, digital providersWithin two months of entry into force, so by 18 December 2024 (Article 14 § 1)Within three months (Article 14 § 2)

For any other country, look up its transposition law and its authority's registration page; our guide for UK businesses covers organisations outside the EU that still fall under NIS2 through an EU establishment or a representative.

6. Germany: §§ 33 and 34 BSIG

Germany's NIS2 law, the NIS2UmsuCG, rewrote the BSI Act (BSIG) and came into force on 6 December 2025. § 33(1) requires particularly important entities, important entities and domain name registry service providers to register with the Federal Office for Information Security (BSI) "spätestens drei Monate" (no later than three months) after they first, or again, count as such an entity. Registration goes through a facility set up jointly by the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK), and the BSI publishes the details of the procedure on its website (§ 33(6)). The five items are the Directive's four plus one: the name with legal form and, where there is one, the commercial register number; the address and contact details including email, public IP address ranges and telephone numbers; the sector or branch in Annex 1 or 2; the EU countries where the entity provides services of the listed types; and the federal and state supervisory authorities responsible for the activities it registers for.

Changes go to the BSI "unverzüglich" (without undue delay) and at the latest within two weeks of the entity learning of the change (§ 33(5)). If an entity does not register, the BSI can register it itself, in agreement with the supervisory authorities concerned (§ 33(3)), and where facts suggest an entity has not met the duty, it must hand over the records and information the BSI asks for (§ 33(4)). § 34 adds the Article 27 details for the digital provider types, with three months to register and three months to report changes; the BSI forwards everything except the IP ranges to ENISA (§ 34(3)).

Failing to submit the § 33(1) or § 34(1) details, or submitting them wrongly, incompletely or late, is an administrative offence, whether intentional or negligent (§ 65(2) no. 6). The fine is up to €500,000 (§ 65(5) no. 5). Failing to report a change to the § 34 details carries the same ceiling (§ 65(2) no. 8).

7. Belgium: Articles 13 and 14

Belgium's law of 26 April 2024 came into force on 18 October 2024, the day the Directive required. Article 13 § 1 gave essential entities, important entities and domain name registration providers five months from then, or from being identified later under Article 11, to register with the national cybersecurity authority, the Centre for Cybersecurity Belgium (CCB), "selon les modalités pratiques fixées par cette autorité" (under the practical arrangements the authority sets). They give their name with their number at the Crossroads Bank for Enterprises (BCE/KBO) or an equivalent EU registration, their address and contact details including email address, IP ranges and telephone number, their sector and subsector, and the EU countries where they provide services in scope. Where an entity already reports some of these details to a sector authority under another law, it completes them with that sector authority instead (Article 13 § 2). Changes go in within two weeks (Article 13 § 3).

Article 14 gave the eleven digital provider types two months from entry into force to send the CCB the Article 27 details, and three months to report any change. Qualified trust service providers whose details the eIDAS supervisory body already holds have them passed on to the CCB by that body (Article 14 § 3).

8. If the date has passed

Most of the dates above are behind us, but the duty does not lapse. Germany counts the three months from the moment an entity first, or again, comes into scope (§ 33(1)), so a business that grows past the size thresholds or starts a new activity in an Annex I or II sector gets its own deadline from that point. Belgium counts from the law's start or from an identification under Article 11 and names no separate date for a business that comes into scope later; register as soon as you do. An entity that should have registered and has not should do it now: authorities have ways to find the gap (in Germany the BSI can demand records and register an entity itself), and an unregistered entity is one the authority has no contact details for when it needs to send a warning. Registering does not itself make you essential or important; the size and sector tests do that. If you are unsure whether you are in scope, settle that first with our guide Does NIS2 apply to your business?, and see NIS2 fines and management liability for how authorities treat late compliance.

9. What a small entity should do

  1. Confirm you are in scope and whether you are essential or important. Note which Annex I or II sector and subsector applies.
  2. Work out the country. Usually where you are established; for the eleven digital types, where cybersecurity decisions are predominantly taken (Article 26(2)).
  3. Find that country's registration route and deadline. Read the transposition law's registration article, then the authority's registration page.
  4. Gather the details: legal name and company number, address, a shared security mailbox and phone number, your public IP ranges, sector, and the EU countries you serve. Digital providers add every EU establishment.
  5. Register and keep the receipt. Save the confirmation and a dated copy of what you submitted. Auditors and customers may ask to see it.
  6. Make changes someone's job. A two-week deadline is easy to miss. Add "update the NIS2 registration" to the checklist for office moves, new internet contracts and changes of security contact.

Our NIS2 Small-Entity Compliance Kit has a place for each of these: its information security policy records your entity status, sector, authority and registration date, and its incident notification templates carry your registration reference, so the details you registered are the ones you report with.

Related guides: Does NIS2 apply to your business? · NIS2 incident reporting: 24 hours, 72 hours, one month · NIS2 fines and management liability · NIS2 for managed service providers

10. Sources