NIS-2 Deadline Missed: A Catch-Up Plan for Late Entities

The NIS-2 grace period in Germany is over. The national implementation act has been in force since 6 December 2025, the statutory registration deadline with the BSI, Germany’s federal cybersecurity authority, passed on 6 March 2026, and the leniency the agency granted until 31 July has expired as well. Around 29,500 entities fall under the law according to the estimate in the government’s bill, and a substantial share has still not registered. Those companies are in default, but not out of options. This piece sorts out what applies legally since 1 August and in which order late entities should catch up.

What applies since 1 August

The end of the grace period changed nothing about the duties, but it changed the starting position. The registration obligation persists, it does not lapse with the deadline. What has been added is exposure to fines: section 65 of the new BSI Act scales them by entity category, up to 10 million euros or 2 percent of worldwide annual turnover for especially important entities, up to 7 million euros or 1.4 percent for important entities, whichever is higher. The turnover component only kicks in above 500 million euros in annual revenue, so for a typical mid-sized company the absolute figures are what count.

The second point concerns management personally. Section 38 obliges the management body to approve the risk management measures and oversee their implementation. Managers who fail to do so are liable to their own company for resulting damage, with their private assets. That is why NIS-2 is only now becoming a board-level topic in many organizations.

Realistically, the BSI will not send out 29,500 penalty notices. The agency prioritizes, and a company that can demonstrate it has started stands very differently from one that keeps waiting. That is precisely the late entity’s opportunity: every documented step improves the position, and the first steps are not large projects.

Step 1: Assess scope honestly

Before registering comes the question of whether the company is covered at all. The law ties scope to sector and size: an organization active in one of the annex sectors, such as energy, transport, health, digital infrastructure, waste, chemicals, food or manufacturing, with at least 50 employees or 10 million euros in annual turnover, is generally in scope. The BSI provides an online scope check that delivers a result within minutes.

Two traps come up regularly. First, the sector: many industrial companies assume they are unaffected, although manufacturing, including machinery, electrical equipment and vehicles, is explicitly covered. Second, the supply chain: a company outside the law’s scope that supplies important entities receives the requirements contractually, because its customers have to secure their suppliers. For this group the question is not whether the BSI will come knocking, but when the next customer questionnaire arrives.

Step 2: Complete the registration

Registration runs through the BSI reporting portal, open since 6 January 2026. It asks for master data, sector and entity category, public IP ranges and a reachable contact point for security incidents. With the information at hand, the effort is a few hours. The contact point deserves the most care: it has to be reachable outside office hours, because reporting deadlines run from the moment an incident becomes known, not from Monday morning.

Companies that missed the deadline should register now rather than wait to be asked. A late registration is a documented step toward compliance; a missing one remains an open violation.

Step 3: The three duties that count first

After registration, three duties can be set up in a manageable timeframe and cover most of the risk.

The incident reporting chain follows a fixed cascade: early warning within 24 hours, notification within 72 hours, final report within one month. It is the same pattern the Cyber Resilience Act has required from product manufacturers since September, as described in our article on the CRA reporting obligation. A company that has built a reporting chain with named roles for one of the two laws extends it for the other by changing the subject: NIS-2 reports incidents affecting the organization, the CRA reports vulnerabilities in its products.

Risk management under section 30 requires measures in ten areas, from access control through backup and encryption to supply chain security. Nobody needs all ten complete on day one. What works is starting with multi-factor authentication, tested backups and central logging, because these three stop the majority of real attacks and can be implemented in weeks rather than months. Which tools and architectures fit mid-sized companies is covered in our piece on implementing NIS-2 technically.

The management training duty under section 38 is the fastest to fulfil and the most often overlooked. In its guidance on management training the BSI defines three competence areas a course has to cover; a seminar addressing only one of them does not meet the requirement in the BSI’s reading. Participation should be documented, because that record is also the evidence that counts in a liability case.

What late entities should not do

Three reflexes cost time and money without lowering the risk. The first is the certification reflex: NIS-2 does not require ISO 27001 certification, and a certification project ties up months before the first effective measure is in place. The second is the paper ISMS, a binder full of policies nobody implements; the BSI audits effectiveness, not page count. The third is waiting for an audit or another extension. There was a grace period, it is over, and nothing points to a second one. For the full catalogue of obligations beyond the late-entity perspective, see our foundational article on NIS-2 compliance for mid-sized companies.

Conclusion

The expired grace period does not change the duties, it changes the risk of waiting. Assess scope, register, set up the reporting chain and three core measures, train management and document everything: in that order, a late entity moves from “in default” to “demonstrably on the way” within a few weeks. For the technical side, from multi-factor authentication through backup architecture to central logging, our cloud and infrastructure consulting helps hands-on; the legal assessment of an individual case belongs with a law firm.

Frequently Asked Questions

What happens if the NIS-2 registration deadline was missed?

The registration obligation continues, it does not expire with the deadline. Since the BSI grace period ended on 31 July 2026, fines are possible, up to 10 million euros for especially important entities and 7 million euros for important ones. Registering now and documenting first measures clearly improves a company’s position compared with further waiting.

Does a company still have to register with the BSI now?

Yes, if it falls under the law. Registration runs through the BSI reporting portal, open since January 2026, and requires master data, sector, IP ranges and a contact point reachable around the clock. A late registration is a documented compliance step; a missing one remains an ongoing violation.

What fines apply for NIS-2 violations in Germany?

Section 65 of the BSI Act scales by category: up to 10 million euros or 2 percent of worldwide annual turnover for especially important entities, up to 7 million euros or 1.4 percent for important entities, whichever is higher. On top comes the personal liability of management toward their own company.

Does management have to complete NIS-2 training?

Yes. Section 38 obliges the management body to attend training regularly in order to assess risks and risk management practices. The BSI’s guidance requires coverage of three competence areas; a seminar on just one is not sufficient. Participation should be documented, as it serves as evidence in a liability case.