The extended NIS2 registration deadline expired on 31 July 2026, yet the number of registered organisations in Germany remains well below initial government estimates. According to the Federal Office for Information Security (BSI), 18,845 companies and public authorities have registered so far, compared with an original forecast of around 29,500 entities.

The BSI described the current level of registrations as broadly satisfactory but acknowledged that a significant number of organisations subject to the regulation have not yet fully complied with their legal obligations. Complex corporate structures and uncertainty over whether organisations qualify as “important” or “essential” entities are cited as key reasons for the slower-than-expected registration process. Organisations that fail to register remain exposed to potential regulatory penalties under Germany’s NIS2 implementation framework.