Germany's NIS2 Implementation Falls Short of Registration Targets

From 4 August 2026 Germany’s NIS2 implementation law will require public procurers to embed IT‑security criteria such as resilience and supply‑chain safety directly into tender documents. The legislation also obliges companies and authorities to register with the Federal Office for Information Security (BSI) and to report security incidents within 24 hours.

By the end of the BSI registration deadline on 31 July 2026, 18 845 entities – 6 490 classified as “particularly important facilities” and 12 355 as “important facilities” – had registered. This is well below the 29 500 registrations the Federal Ministry of the Interior had expected based on statistical estimates. The ministry has asked the Federal Statistical Office to reassess the original target, noting that complex corporate structures make it difficult to determine which units fall under the rule. The BSI described the current level as “generally satisfactory” but said it will monitor the situation closely.