Registering with the BSI under NIS2: steps, required data, late registration

This page covers registration under Sections 33 and 34 of the German BSI Act (BSIG): who has to register, by when, what the BSI portal asks for and what to do if the deadline has been missed. Whether your organisation is an essential entity, an important entity or out of scope, you determine beforehand with the NIS2 applicability check; the BSI does not tell you.

Who has to register?

Essential and important entities as well as domain name registration service providers (Section 33(1) BSIG). Organisations classify themselves. These cases are easy to overlook:

• Telecoms and energy: Section 28(5) exempts operators of public telecoms networks and services and energy installations subject to Sections 5c to 5e of the Energy Industry Act (EnWG) from most obligations, for example Sections 30, 32 and 38. Section 33 is not among them, so registration remains (for telecoms providers: telecoms providers under NIS2 and the TKG). According to the BSI, operators of energy supply networks that are not themselves essential or important entities also register, with the data under Section 33(1) nos. 1 to 4.
• Financial entities under DORA: According to the BSI, they must register even though the further BSIG obligations do not apply to them; this is part of the dividing line between NIS2 and DORA.
• Operators of critical facilities: Their registration as operators of critical facilities continues for now through the BSI’s reporting and information portal (Melde- und Informationsportal, MIP). In addition, they register in the BSI portal as essential entities and enter their KRITIS operator ID.

What is the registration deadline?

No later than three months after an organisation first or again qualifies as essential or important. For organisations already in scope when the act entered into force on 6 December 2025, this gives 6 March 2026. The date is our own calculation; the BSI states on its NIS‑2 page that the deadline has passed.

On Section 33(5): under Section 66 BSIG, this subsection continues to apply in its version up to 28 July 2026 until the ordinance under the German KRITIS umbrella act (KRITIS-Dachgesetz) is in place. That version also requires the data under subsection 1 to be submitted without undue delay, at the latest within two weeks, and contains additional rules for operators of critical facilities (wording according to Federal Law Gazette 2025 I No. 301 and the comparison of versions at buzer.de). What else Section 66 means is explained on the page on the NIS2 implementation act.

How does registration in the BSI portal work?

In two stages: first the ELSTER organisation certificate, then registration in the BSI portal. The BSI has laid down the details in a binding specification under Section 33(6) (version 1.0 of 26 June 2026).

1. Apply for an ELSTER organisation certificate. Login to the BSI portal runs through “Mein Unternehmenskonto” (MUK), the German federal business account. It requires an ELSTER organisation certificate from the German tax administration’s online service, and that certificate requires a German tax number. Foreign entities without a German tax number can apply to the Neubrandenburg tax office (Finanzamt Neubrandenburg) for an identifier in the form of a tax number (Ordnungskriterium).
2. Log in to the BSI portal. “Mit MUK anmelden” (log in with MUK) takes you to ELSTER: upload the certificate, enter the password, confirm the transfer of data. The portal takes name, address, legal form, register type, register number and register court from MUK. These cannot be changed in the portal; corrections are made in “Mein ELSTER”.
3. Fill in the NIS‑2 registration. In the “NIS‑2” area, “Zur NIS‑2-Registrierung” leads through the data: whether the entity is a federal body, whether it is registered as an operator of a critical facility, the NIS‑2 classification, sector, branch and entity type, the EU member states, the supervisory authorities, contact point, contact persons and IP address ranges. Organisations active in several sectors add further entity types.
4. Submit and maintain. “Registrierung abschließen” (complete registration) submits it. Later changes are made in the “Ihre Registrierung” (your registration) tab.

Checklist: the data to prepare

The checklist combines what Section 33(1) requires with what the portal asks for according to the BSI guide. The “Example” column is filled in for the fictitious company described further down.

Our recommendation: file the completed checklist, dated, with your classification documentation. It is also your basis for reporting changes on time.

What if registration is late?

Register as soon as possible. The BSI writes on its NIS‑2 page (our translation): “The statutory registration deadline has already expired. Affected by NIS‑2 and not yet registered? Then register in the BSI portal immediately!” The process is the same as for a registration on time.

• Fine: Failing to submit data under Section 33(1) or Section 34(1), or submitting it incorrectly, incompletely or late, is an administrative offence, whether intentional or negligent (Section 65(2) no. 6). The maximum fine is €500,000 (Section 65(5) sentence 1 no. 5). The maximum amounts for the other offences are listed in the overview of NIS2 requirements.
• Registration by the BSI: If an entity does not meet its obligation, the BSI can register it itself in agreement with the competent supervisory authorities (Section 33(3)). If it suspects a missing registration, it can request documents and information (Section 33(4)).
• Other obligations: Risk management under Section 30, incident reporting under Section 32 and the duties of the management body have applied since entry into force, regardless of registration. According to the BSI, a significant incident that occurs before registration is reported through an online form in the MIP; more on the page on NIS2 incident reporting.

We cannot predict whether and how an authority will pursue a breach; clarify the legal consequences in your case with a lawyer. In practice, we recommend recording internally since when the organisation has classified itself as in scope and when it registered; how best to document a late registration is a point to agree with your legal adviser.

What applies additionally to digital entity types under Section 34?

Certain digital entity types also have a special registration under Section 34, likewise within three months. It covers the entity types listed in Section 60(1) sentence 1, for example providers of cloud computing and data centre services, managed service providers and online marketplaces. This group largely matches the digital entity types for which Implementing Regulation (EU) 2024/2690 takes precedence (full list in the sector directory), with one difference: domain name registration service providers are covered by Section 34, trust service providers are not.

Section 34(1) requires six items: name; sector, branch and entity type under Annex 1; the address of the main establishment in the EU and of other establishments in the EU or, where there is no establishment in the EU, of the designated representative; current contact details; the member states in which services are provided; the public IP address ranges. Changes must be reported within three months. The BSI forwards the data, except the IP ranges, to the EU Agency for Cybersecurity (ENISA).

The BSI is only competent for these entity types if their main establishment in the EU is in Germany, but then for the whole EU. The main establishment is in the member state in which decisions on cybersecurity risk management are predominantly taken.

And registration under the KRITIS umbrella act?

That is not due at present. The KRITIS umbrella act provides for a separate registration of critical facilities with the BBK, the Federal Office of Civil Protection and Disaster Assistance, within three months of a facility qualifying as critical. Which facilities these are will only be determined by an ordinance that, according to the BBK, is still being drafted; according to the BBK there is therefore currently no registration obligation under the KRITIS umbrella act. Registration under Section 33(1) BSIG is independent of this.

Example: catching up on a missed registration

Fictitious example, not a client. A machinery manufacturer with 180 employees and two sites has had more than 50 employees for years and falls under Annex 2 with its machinery business. It has therefore been an important entity since 6 December 2025. In October 2026, a customer enquiry reveals that the registration is missing. The company proceeds as follows:

1. Management has the classification recorded in a short classification record, with a date.
2. The NIS2 officer checks who manages the ELSTER organisation certificate. It sits with accounting; access and safekeeping of the password are arranged.
3. She completes the checklist above. IT takes the IP ranges from the provider contracts of both sites.
4. The registration is completed in the BSI portal and the date documented.
5. In parallel, the company checks whether risk management and the reporting chain are in place, because these obligations have applied since December 2025. The order of the open points goes into the implementation plan.

Three typical gaps

This page provides general information and does not replace legal advice in an individual case. If, beyond registration, you want to know where your organisation stands on the other obligations, the NIS2 gap analysis is the structured starting point.