NIS2 Registration: Who Must Register, What to Submit and the National Deadlines

The registration duty reaches organisations through national law. Directive (EU) 2022/2555 of 14 December 2022 is addressed to the Member States (Article 46), which had to transpose it by 17 October 2024 and apply it from 18 October 2024 (Article 41(1)). Each national law therefore sets the portal, the deadline and the penalty, and how the Directive itself is built is explained under NIS2 Directive on the home page.

The sections below set out who registers, the four Article 3(4) items and the six Article 27 items with their two change deadlines, the entity list, five practical steps, the channels and deadlines of 23 Member States as of 23 October 2026, and the national penalties.

What Is NIS2 Registration?

NIS2 registration is the submission of an entity's identification and contact data to the competent authority under its national NIS2 law, so that the Member State can build the list of essential and important entities that Article 3(3) requires and, for 11 digital entity types, feed the Article 27 registry. The Directive text on EUR-Lex sets the minimum data; the national law sets the procedure.

Each Member State had to establish its entity list by 17 April 2025 (Article 3(3)). To collect the data, Member States may set up national mechanisms through which entities register themselves (Article 3(4), fourth subparagraph). Germany, Italy, Luxembourg and Poland, for example, run self-registration portals or online forms.

Registration always runs at national level: an entity submits its data to the competent authority or the national mechanism, never to ENISA. For the digital types, the single point of contact forwards the Article 27 data to ENISA (Article 27(4)).

Registration Does Not Decide Scope

Registration does not decide whether NIS2 applies: scope follows from Articles 2 and 3 of the Directive as transposed, so an entity that meets the criteria carries the duties whether or not it has registered. The entity list is the authority's record of entities, not a test of whether an entity falls under the law.

Two national authorities state this consequence directly. Luxembourg's Institut luxembourgeois de régulation (ILR) states that non-registration does not exempt an entity from its obligations. In Germany, the BSI may register an entity itself where the entity does not meet its duty (§ 33(3) BSIG).

Who Must Register under NIS2?

Every essential and important entity must give its competent authority the Article 3(4) registration data under its national NIS2 law, and so must every entity providing domain name registration services, which falls in scope regardless of size and sits on the Article 3(3) list without being classified as essential or important (Article 2(4)).

Classification follows Article 3. Essential entities include Annex I entities that exceed the medium-sized ceilings, qualified trust service providers, TLD name registries and DNS service providers regardless of size, and central government public administration entities (Article 3(1)); every other Annex I or II entity in scope is important (Article 3(2)). Who NIS2 applies to rests on the size-cap rule: an Annex I or II type is covered when it is at least medium-sized under the Annex to Recommendation 2003/361/EC (Article 2(1)), while the types in Article 2(2) to (4), such as providers of public electronic communications networks and CER critical entities, are covered regardless of size. The full entity test is set out under who NIS2 applies to.

The Member State of registration depends on the entity type. The 11 types of Article 26(1)(b), from DNS service providers to social networking services platforms, register in the Member State of their main establishment in the Union. Other entities register in the Member State where they are established (Article 26(1)).

What Entities Submit under Article 3(4)

Article 3(4) of the Directive requires at least four items from each entity: its name, its address and up-to-date contact details including email addresses, IP ranges and telephone numbers, where applicable its sector and subsector under Annex I or II, and where applicable the Member States where it provides services in scope. The four items are listed below as the Directive words them.

• Name: the name of the entity.
• Address and contacts: the address and up-to-date contact details, including email addresses, IP ranges and telephone numbers.
• Sector and subsector: where applicable, the relevant sector and subsector referred to in Annex I or II.
• Member States served: where applicable, a list of the Member States where the entity provides services falling within the scope of the Directive.

The European Commission published guidelines on the application of Article 3(4) on 14 September 2023 and updated them on 21 September 2023. The Commission guidelines on Article 3(4) offer one template that covers both the Article 3(3) list and the Article 27(2) registry data, prepared with ENISA's assistance, and the template has no NACE field (points 2 and 6 and the Appendix). The guidelines are not binding; the national form decides the exact fields.

Changes Within Two Weeks

An entity notifies any change to its Article 3(4) data without delay and in any event within two weeks of the date of the change (Article 3(4), second subparagraph). National laws in Belgium (Article 13 § 3), Croatia (Article 20(3)), Luxembourg (Article 11(4) of the law of 5 May 2026), the Netherlands (Article 44(2) Cyberbeveiligingswet), Germany (§ 33(5) BSIG) and Austria (§ 29(4) NISG 2026, for the data of § 29(2) Z 1 to 5) keep two weeks. Three laws count differently: Sweden allows 14 days, Slovakia 30 days and Portugal 30 working days.

Extra Data Some National Laws Require

Seven Member States ask for more than the four Article 3(4) items in their national law or official registration form, as listed below.

• Belgium: the BCE/KBO company number (Article 13 § 1 of the law of 26 April 2024).
• Germany: legal form, register number and the competent federal and Land supervisory authorities (§ 33(1) Nos. 1 to 5 BSIG).
• Austria: main and other EU establishments, the § 25 threshold information and the essential or important status (§ 29(2) Z 1 to 7 NISG 2026).
• Luxembourg: the size of the entity and of its group (Article 11(4) of the law of 5 May 2026).
• Netherlands: domain names and AS numbers (NCSC registration page).
• Slovenia: size flags, a security contact and deputy, AS numbers and all domain names (Article 8 ZInfV-1).
• Sweden: organisation number, how the entity was identified, IP addresses and domain names (NCSC form).

The Directive sets a minimum ("at least"), so the national form decides what an entity collects. The national row in the table further down names the channel.

The Article 27 Registry for Digital Entity Types

Article 27 requires 11 digital entity types, DNS service providers, TLD name registries, domain name registration service providers, and providers of cloud computing, data centre, content delivery network, managed and managed security services, online marketplaces, online search engines and social networking services platforms, to submit six data items to their competent authority by 17 January 2025. These are the 11 types of Article 26(1)(b).

The six items of Article 27(2) are (a) the name; (b) the sector, subsector and type of entity; (c) the address of the main establishment and other EU establishments, or of the representative designated under Article 26(3); (d) up-to-date contact details; (e) the Member States where the entity provides services; and (f) its IP ranges. Changes are notified within three months of the date of the change (Article 27(3)). The list differs from the 11 entity types of Regulation (EU) 2024/2690, which include trust service providers and leave out domain name registration services.

ENISA keeps the registry of these entity types (Article 27(1)). The single point of contact of each Member State forwards the data to ENISA without undue delay, except the IP ranges of point (f), which stay at national level (Article 27(4)). What the agency does with the data is covered under ENISA and NIS2.

Article 3(4) Data and Article 27 Data Compared

Article 3(4) and Article 27 ask for overlapping data on two different clocks, compared below.

Directive (EU) 2022/2555 as of 23 October 2026; national laws may ask for more (see the list above).

A digital entity type meets both duties, usually in one national form, as the Commission template allows. Supervisors can request information on compliance with the Article 27 obligation from essential entities (Article 32(2)(e)) and from important entities (Article 33(2)(d)).

The Member State Entity List under Article 3(3)

By 17 April 2025 each Member State had to establish a list of essential and important entities and entities providing domain name registration services, and it reviews and updates that list regularly and at least every two years (Article 3(3)). The list draws on the data that entities submit under Article 3(4).

Competent authorities also notify the number of entities per sector and subsector to the Commission and the NIS Cooperation Group by 17 April 2025 and every two years after that, so the next notification is due by 17 April 2027 (Article 3(5)). The list and the counts sit on the EU calendar next to the transposition and review dates, and every EU date is listed in the NIS2 timeline.

The list is the authority's record and is not public. An entity's duties do not depend on being on it.

How Registration Works in Practice: Five Steps

Registration under a national NIS2 law runs in five steps: confirm that the entity is in scope and in which category, identify the Member State whose law applies, find that Member State's registration channel, submit the Article 3(4) data (plus the Article 27 data for the digital types), and keep the data current. The five steps are listed below in order.

1. Confirm scope and category under Articles 2 and 3 of the Directive as transposed.
2. Identify the Member State whose law applies: the place of establishment, or the main establishment for the 11 types of Article 26(1)(b) (which Member State supervises the entity).
3. Find the national channel and deadline in the table of the next section.
4. Submit the Article 3(4) data, plus the Article 27(2) data for the digital types.
5. Update changes within two weeks (Article 3(4)) or within three months (Article 27(3)).

Registration is the first duty, and it does not replace the measures, reporting and management duties that follow from Articles 20, 21 and 23. Those other duties are set out under NIS2 compliance requirements.

National Registration Deadlines and Portals as of 2026-10-23

As of 23 October 2026, the national laws in the table below set three kinds of registration deadline: a fixed calendar date, a period counted from entry into force or from meeting the criteria, and a recurring annual window (Italy, 1 January to 28 February).

Status, authority and law per country are in the NIS2 transposition tracker.

Four Member States have no registration channel or deadline on this page as of 23 October 2026, listed below.

• NIS2 in Cyprus
• NIS2 in Latvia
• NIS2 in Malta
• NIS2 in Spain

The channels differ as much as the deadlines. Germany, Italy, the Netherlands and Denmark use online portals with a national login, Estonia uses the eesti.ee state portal, and Sweden and Slovenia accept e-mail. Croatia identifies entities itself, while France offers voluntary pre-registration.

The BSI counted 20,373 registrations by 30 September 2026, including 232 EU branches, with 6,837 essential and 13,252 important entities, against about 29,500 entities it expected in its press release of 6 January 2026. In Czechia, NÚKIB reported 4,825 notifications by 8 February 2026. The German law behind these figures is covered under NIS2 in Germany.

What Happens If an Entity Does Not Register?

A missed registration is penalised under the national law, because Article 36 of the Directive leaves the penalty rules for registration to the Member States, while the Article 34 maximums of at least EUR 10,000,000 or 2 % and at least EUR 7,000,000 or 1.4 % of total worldwide annual turnover, whichever is higher, apply only to infringements of Articles 21 and 23. No EU-wide fine for late registration exists.

Germany sets fines of up to EUR 500,000 for registration failures (§ 65(2) No. 6 with § 65(5) No. 5 BSIG). Austria sets up to EUR 50,000, and up to EUR 100,000 for a repeat offence (§ 45(4) NISG 2026), imposed by the Bezirksverwaltungsbehörden, the district administrative authorities (§ 44(1)). Italy sets up to 0.1 % of worldwide turnover for essential and 0.07 % for important entities (Article 38(10) and (11) D.Lgs. 138/2024), and for missing or late registration the most serious sanction rises up to threefold (Article 38(13)).

Member States had to notify their penalty rules to the Commission by 17 January 2025 (Article 36), so the national act is the only place to read the amount. The maximums for the measures and reporting duties are explained under NIS2 fines.

Pending Changes to Registration

The Commission's proposal COM(2026) 13 of 20 January 2026 would extend the Article 27 registry to all essential and important entities and entities providing domain name registration services, with changes notified within two weeks; as of 23 October 2026 it is pending. The proposal would also extend the EU representative duty to every essential or important entity not established in the Union.

The European Parliament procedure 2026/0012(COD) is at "Awaiting committee decision" as of 23 October 2026: the ITRE draft report PE792.221 is dated 24 September 2026, and the amendments PE796.471 13 October 2026.

Until any adoption, Articles 3(4) and 27 stand as written, and the proposals are tracked under NIS2 amendments and review.

What NIS2 Registration Is Not

NIS2 registration is not a certificate, not an approval and not a classification decision: it is a data duty under national law that runs alongside every other NIS2 obligation.

Do Non-EU Companies Register?

A company not established in the Union registers only if it is one of the 11 types of Article 26(1)(b) offering services in the Union, through the representative it must designate in a Member State where it offers services (Article 26(3), Article 27(2)(c)). The representative's address replaces the establishment address in the registry data.

The entity then falls under the jurisdiction of the Member State where the representative is established. Without a representative, any Member State where the entity provides services may take legal action, and the representative rules are explained under NIS2 for non-EU companies.

Do Financial Entities Still Register?

Yes in Germany: § 28(6) BSIG exempts financial entities under Regulation (EU) 2022/2554 from §§ 30, 31, 32, 35, 36, 38 and 39 BSIG, but not from the § 33 registration duty. In Germany, DORA thus displaces the BSIG rules on measures, reporting and supervision for these entities, not the registration.

How DORA and NIS2 divide the remaining duties is set out on the NIS2 vs DORA page.

Does the Domain Name Database Count as Registration?

No: the database of domain name registration data under Article 28 is a duty of TLD name registries and entities providing domain name registration services towards domain holders' data, separate from the entity's own registration, and it answers lawful access requests within 72 hours (Article 28(5)). It holds the domain name, the registration date and the registrant's contact data (Article 28(2)).

An entity providing domain name registration services therefore carries both duties side by side, and the database duty is explained under NIS2 for TLD registries and domain registrars.