Cybersecurity

Germany's NIS2 Grace Period Has Ended

Germany's BSI stopped shielding late NIS2 registrants on July 31. Official figures show a registration gap near 40 percent - and utilities are hit hardest by the law's own complexity.

CybersecurityBy Servola Tech Desk2026-08-144 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Key takeaways

Germany's own cybersecurity agency, the BSI, published figures on its official 'NIS-2 in Zahlen' page showing only 17,729 of an expected 29,500 entities had registered under the new BSI Act (BSIG) as of June 30, 2026 - a gap of roughly 40 percent, with the deadline already behind them.
The July 31, 2026 date widely reported as a deadline was not a legal extension: the statutory registration deadline under Section 33 BSIG passed on March 6, 2026, and July 31 was only the date until which the BSI said it would hold off on sanctions for late filers - a forbearance period that has now expired.
Failing to register is its own fineable offense under Section 65 BSIG, up to 500,000 euros, entirely separate from the much larger fines - up to 10 million euros or 2 percent of global turnover for the most critical entities - that attach once a company's actual security measures are assessed.
VKU, the trade association for Germany's municipal utilities, says the main reason many Stadtwerke never registered is not neglect but the law's own multi-sector affiliation test, which it calls barely possible without external legal help - concentrating the compliance gap in exactly the critical-infrastructure operators NIS2 exists to protect.

A deadline that was never really a deadline

Germany's NIS2 implementation law, the BSI-Gesetz (BSIG), took effect on December 6, 2025, and required roughly 29,500 companies and public bodies across energy, health, transport and digital infrastructure to register with the Federal Office for Information Security by March 6, 2026. Registration opened through the BSI's own portal in January 2026, but by the statutory deadline only a fraction of that number had filed. Facing a compliance rate its own officials called too low to enforce, the BSI announced it would accept late registrations and refrain from sanctions through July 31, 2026 - a grace window, not a new legal date.

The BSI's own tracking page, 'NIS-2 in Zahlen,' put the count at 17,729 registered entities as of June 30, 2026, split into 11,501 'important' and 6,215 'particularly important' organizations, including 1,342 designated critical infrastructure (KRITIS) operators. Independent legal and trade reporting citing the BSI's own end-of-July figures puts registrations at roughly 18,500 to 19,000 once the grace window closed - meaning somewhere between 10,500 and 11,800 expected entities, close to a third of the total, still were not in the system when forbearance ended.

The utilities paradox

VKU, the association representing Germany's municipal utilities (Stadtwerke), told trade press that the registration gap in its sector is not a story of companies ignoring the law. Its stated view: 'the complex affiliation analysis, particularly for multi-sector companies, is in our view the primary reason registrations were so limited,' adding that the classification review 'is so complicated that it is barely possible without external professional legal assistance.' Many Stadtwerke sit simultaneously in energy, water, wastewater and sometimes telecoms, and NIS2's sector-by-sector affiliation test forces each of those lines of business through its own qualifying analysis before a single registration can be filed.

That detail matters more than a headline compliance percentage. The entities NIS2 was written to protect first - grid operators, water utilities, district heating networks - are structurally the ones most likely to trip over the law's own onboarding logic, precisely because they are multi-sector by design. A gap concentrated among generalist small businesses would be a training problem; a gap concentrated among municipal critical-infrastructure operators is a design problem in the law's own gateway.

The three-month blind spot

Here is the part the deadline coverage missed. The BSI's own figures page states its next update is 'not expected before October 31, 2026' - meaning the regulator's public registration count will sit unrefreshed for exactly the quarter in which its sanction forbearance lifted. Any German 'important' or 'particularly important' entity now has legal supply-chain obligations toward its own vendors and partners, and any EU or UK counterparty running NIS2-adjacent due diligence on a German supplier has no live source to check against - only a snapshot that was already six weeks stale on the day forbearance ended, and will be nearly four months stale before it refreshes.

Because registration itself changes nothing about an organization's actual security posture - it is a bureaucratic gateway, not a technical control - firms with the most to lose from being publicly identified as late have every reason to file quietly now rather than announce the gap. Expect Germany's public numbers to look meaningfully better by Halloween even though the intervening months contain an uncounted population of exposed entities. The practical takeaway for any business relying on a German critical-infrastructure or digital-services supplier: ask for BSIG registration confirmation directly, in writing, now - not in November, when the BSI's own number will already be out of date again.

Frequently asked questions

Does missing the July 31 date trigger an automatic fine?

No. The BSI has not committed to automatic enforcement; ending forbearance only removes its earlier promise not to act on late filers. Legal exposure under Section 65 BSIG is live again, but any actual fine still requires the BSI to open and pursue a case against a specific entity.

Does registering late erase the risk retroactively?

No. Registering now ends an ongoing violation going forward, but the statutory deadline was March 6, 2026, so any entity that registered after that date has already been in breach for the intervening period, whether or not the BSI chooses to act on it.

Which sectors show the widest registration gap?

Energy, health, transport and digital infrastructure were the priority sectors named for early BSI inspection. Within those, municipal multi-sector utilities represented by VKU report the affiliation-classification step itself, not neglect, as their principal obstacle to registering at all.

Registration was supposed to be the easy part of NIS2 - proof, before anything else, that Europe finally knows who its digitally critical operators are. Four and a half months after the real deadline quietly passed, and two weeks after Berlin's own patience ran out, roughly a third of the companies the law was built around are still not in the system, and nobody, including the regulator, will have a fresh count before Halloween.

NIS2BSIGermanycritical infrastructurecyber regulationcompliance

Attackers Hit 361 vCenter Servers Before KEV Listed It

A CVSS 9.8 vCenter flaw was under active exploitation across 47 countries within five days of its patch, per DFIR firm QUIRSO. Weeks later it still is not on CISA's KEV catalog.

4 min read

Cybersecurity

Gunra Ransomware Runs on Fortinet Bugs Patched in 2025

CISA, the FBI, NSA and South Korea jointly named Gunra ransomware on August 10. It breaks in through two Fortinet flaws patched over a year ago. The real finding is patch lag, not the malware.

3 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.