NIS2 registration: how to register your company with the BSI
Companies in scope register in the BSI's portal (§ 33 BSIG). First you need an organisation certificate from ELSTER, which is activated by letter. For companies in scope since December 2025, the deadline ended on 6 March 2026. If you missed it, register now: the duty still applies.
Programmes and memberships
Who has to register
Every essential and every important entity (§ 33(1) BSIG). That is what the law calls the companies NIS 2 applies to.
Whether your company is one depends on its sector and size (§ 28 BSIG). The sectors are listed in Annexes 1 and 2 of the BSIG. In those sectors, a company is an important entity if it has at least 50 employees, or an annual turnover and a balance sheet total of more than EUR 10 million each.
The BSI offers a scope check that takes you through the questions. According to the BSI, its result is not legally binding.
The deadline
You register at the latest three months after your company first counts as an entity (§ 33(1) BSIG).
The BSIG has applied since 6 December 2025. For companies in scope since then, the deadline ended on 6 March 2026.
If your company only comes into scope later, for example because it grows, the three months run from that point.
How to register, step by step
Registration has two stages: first an account with ELSTER, then registration in the BSI's portal.
Check whether you are in scope
Clarify your sector, headcount and turnover (§ 28 BSIG). The BSI's scope check helps. For borderline cases, a legal review helps.
Apply for an organisation certificate from ELSTER
You do this through "Mein Unternehmenskonto" (mein-unternehmenskonto.de). You need a German tax number. The access details come by email, the activation code by letter to the address stored with the tax number. According to the BSI, delivery regularly takes at least five working days.
Get the details ready
The portal takes your name, address, legal form and register details from your company account. Under § 33(1) BSIG you add: email and phone numbers, your public IP address ranges, your sector, the EU countries where you provide such services, and your competent supervisory authorities.
Register in the BSI's portal
You sign in to the BSI's portal (portal.bsi.bund.de) with the certificate and fill in the form. Whoever registers the entity automatically becomes its administrator and can invite colleagues.
Record it and hand out access
Note on which day and with which certificate you registered. Give access to the people who will report incidents in an emergency. Each person needs their own certificate and must be assigned to your entity in the portal.
How the walkthrough does this
Registration is the first step in the walkthrough at nisd2.eu.
The step explains in plain words what registration is for and how you get into the BSI's portal through ELSTER.
It shows in which EU country you register, with the authority and its portal.
You record two details: the ID of your user account and the day of registration.
If the letter from ELSTER has not arrived yet, you choose "Not possible yet" and carry on with the next step.
A later step shows which of your details can change.
What comes after registration
§ 33 BSIG provides for no decision and no further step by the BSI after registration. So do not expect to be told to start.
The other duties apply anyway. They apply because your company is an entity. Registration does not change that.
- Put security measures in place in ten areas and write them down (§ 30 BSIG).
- Report significant security incidents, the first report within 24 hours (§ 32 BSIG).
- Management implements the measures, oversees them and takes part in training regularly (§ 38 BSIG).
- If your details change, you report this to the BSI within two weeks (§ 33(5) BSIG).
Missed the deadline? Do this now
- 1Register now. The duty does not end with the deadline.
- 2Note when you learned of the duty and when you registered.
- 3Did your company have a significant security incident before registering? Report it anyway, through a form in the BSI's reporting and information portal (MIP).
- 4Start on the measures. They apply regardless of registration.
Common questions
Can I still register after 6 March 2026?
Yes. The deadline says by when you had to register. The duty itself does not end. You register through the same BSI portal.
Do I get a decision or a registration number?
§ 33 BSIG provides for no decision. Record yourself when and with which certificate you registered. Incident reports are different: there, the BSI confirms receipt, within 24 hours where possible (§ 36(1) BSIG).
Do the other duties only apply after registration?
No. Measures (§ 30 BSIG), the reporting duty (§ 32 BSIG) and management's duties (§ 38 BSIG) apply as soon as your company is an entity. Registration is one duty next to the others.
We are not sure whether we are in scope. What now?
Use the BSI's scope check and have borderline cases reviewed legally. Borderline cases are, for example, a size close to the threshold, a business that could fit several sectors, or a group with linked companies (§ 28(3) and (4) BSIG).
We have sites in other EU countries. Where do we register?
In principle, the country where your company is established is responsible (Art. 26(1) NIS 2). For certain digital providers, the main establishment counts. The authorities of all EU countries are in our overview of registration bodies.
Sources
- BSI Act (BSIG), §§ 28, 30, 32, 33, 36 and 38, Annexes 1 and 2, in force since 6 December 2025 (gesetze-im-internet.de/bsig_2025)
- Directive (EU) 2022/2555 (NIS 2), Art. 3(4) and Art. 26 (eur-lex.europa.eu)
- BSI, details of the registration procedure under § 33(6) BSIG, version 1.0 of 26.06.2026 (bsi.bund.de/dok/registrierungspflicht)
- BSI, Mein Unternehmenskonto (bsi.bund.de/dok/muk)
- BSI, NIS 2 reporting duty: reporting before registration (bsi.bund.de/dok/nis-2-meldepflicht)
- BSI, scope check (betroffenheitspruefung-nis-2.bsi.de)
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Registration & Reporting
Register with your authority
Your company registers once with your authority.
Registration & Reporting
Keep the registration up to date
When something changes, update it with your authority.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.