Germany Expected 29,500 NIS2 Registrations. By Mid-2026, 17,729 Had Arrived.

Quick Answer: NIS2 applies to your company if it operates in one of 18 listed sectors and is medium-sized or larger (50 or more employees, or turnover and balance sheet both above €10 million, counted together with linked and partner companies), or if it falls into a category covered at any size, such as telecoms, trust services or DNS providers. Generally, no authority will notify you: NIS2 expects you to work it out yourself, and in Germany only 17,729 of an estimated 29,500 companies had registered by 30 June 2026.

When Germany's NIS2 law took effect on 6 December 2025, the federal cybersecurity office BSI said it covered around 29,500 companies and federal institutions. Each of them had three months to register.

By 30 June 2026, almost four months after that deadline, BSI's own count stood at 17,729 registered companies. That is roughly 11,800 short of the estimate. The count predates the end of a grace period: BSI had said it would tolerate late registrations until 31 July 2026, and its next figures are due at the end of October.

NIS2, formally Directive (EU) 2022/2555, is the EU's cybersecurity law for 18 sectors. It sets security and incident-reporting duties for medium-sized and large organizations in those sectors.

Do not wait for a letter saying NIS2 applies to you. The directive expects every company to work it out for itself, from three things: its sector, its size (counted together with its group) and a short list of exceptions. Each of the three is easy to get wrong, and the check itself takes days, not months.

17,729 companies had registered in the BSI portal by 30 June 2026: 11,501 as important entities and 6,215 as particularly important ones (Germany's term for essential entities). Against an estimate of about 29,500, that is roughly 60%.

The sector breakdown is the interesting part. The largest single group is manufacturing, with 4,095 registrations. Health follows with 3,354, then digital infrastructure with 2,373 and energy with 2,365. Food production and distribution accounts for another 1,782.

A machine builder or a food processor does not usually think of itself as critical infrastructure. Under NIS2 it does not have to be. It only has to be in a listed sector and above a size line.

Germany is a useful example because BSI publishes the numbers. The starting point is the same across the EU: Article 3 of the directive requires in-scope entities to submit their details to the national authority.

Many companies do not know whether NIS2 applies to them because the directive asks them to classify themselves, and the classification is less obvious than "50 employees in a critical sector."

A survey published in early October 2026 by compliance software vendor Kertos asked 51 German companies with 50 to 1,000 employees in NIS2 Annex I sectors where they stood in August and early September 2026. 31% said they were still checking whether they were affected. The sample is small, but it points the same way as the registration numbers.

In practice the uncertainty comes from three places:

NIS2 covers 18 sectors, split across two annexes of Directive (EU) 2022/2555. Which annex you fall under affects how you are classified later.

Annex I, sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration and space.

Annex II, other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research.

Two details catch companies out. First, "digital infrastructure" and "digital providers" are different entries: cloud, data centre, CDN and DNS services sit in Annex I, while online marketplaces, search engines and social networks sit in Annex II. Second, managed service providers and managed security service providers are in Annex I in their own right. A managed service provider with 60 people is a regulated entity, not only a supplier to regulated entities.

Banks and other financial entities covered by DORA are a special case. For them, DORA's rules on ICT risk and incident reporting apply in place of the NIS2 ones. We covered what DORA expects in 2026 separately.

NIS2 applies to entities in the listed sectors that are medium-sized or larger under the EU's SME definition. In numbers, that means at least 50 employees, or annual turnover and balance sheet total both above €10 million.

The part that surprises people is whose numbers count. The EU definition adds in linked enterprises (typically, companies under common control) and a proportional share of partner enterprises. A 30-person subsidiary of a 2,000-person group is not a small enterprise for this purpose.

The directive does leave room for judgment here. Recital 16 lets member states take into account how independent an entity is from its group, particularly whether it runs its own network and information systems. Whether your country's law uses that flexibility, and how, is a national question.

So the size check has to be done on group figures first, then adjusted if national law allows.

Article 2 of NIS2 lists entities that are covered even if they are small or micro enterprises:

Note what is not on that list. Cloud, data centre and CDN providers are in Annex I, but the directive does not pull them in below the size threshold. A ten-person hosting company is not automatically an NIS2 entity. It still needs to check national law and that last, case-by-case category.

Essential and important entities must implement the same NIS2 risk-management measures and report significant incidents. The difference is in supervision and in the maximum fine.

For both categories, Article 20 makes the management body responsible for approving the security measures and overseeing them, and says management bodies can be held liable for infringements.

A company outside NIS2 scope has no legal obligation under the directive, but it will probably still receive NIS2 questions from customers that are in scope. Supply chain security is one of the ten measure areas in Article 21, and recital 85 encourages regulated entities to write cybersecurity requirements into contracts with their direct suppliers.

For a supplier, this arrives as a questionnaire or a contract clause. The honest answer to "are you NIS2 compliant?" from an out-of-scope company is "NIS2 does not apply to us, here is the written reasoning, and here is what we do for security anyway." That answer needs the first part documented.

Being out of scope is a conclusion worth having on paper, with the sector and size analysis behind it. It is what you show a customer, an insurer or an authority that asks.

The 2026 NIS2 amendment may change scope at the edges, but it is not law yet. On 20 January 2026 the European Commission proposed targeted amendments to NIS2 as part of a wider cybersecurity package. As of early October 2026 the proposal is still at first reading in the European Parliament, where the lead committee's draft report was submitted on 24 September 2026. It is not law.

The main scope-related points in the proposal:

The Commission says the changes would ease compliance for about 28,700 companies. What the proposal does not do is move the entry threshold. A 60-person company in a listed sector is in scope today and would still be in scope afterwards.

So waiting for the amendment is not a reason to postpone the check. Current national law is what applies now.

To check whether NIS2 applies to your company, work through six steps in this order, and write down the reasoning at each one:

If the answer is "in scope", the next steps are registration with the national authority and a gap analysis against Article 21. The directive itself points to international standards such as the ISO/IEC 27000 series as a reference for those measures, and we explain what stands between a company and that certificate separately. If the answer is "out of scope", you have a document to attach the next time a customer asks.