Germany's cybersecurity regulator has a registration problem. Its answer, a formal enforcement process, rests on a number that nobody has verified.
Channelpartner, relaying a Tagesspiegel report, wrote on 8 October 2026 that the Federal Office for Information Security (BSI) last put NIS-2 registrations at 20,373 as of 30 September 2026, counting secondary establishments. The BSI expects just under 30,000 entities to fall under the rules. Measured against the 29,500 that it-daily reports the legislature originally anticipated, that is about 69%. The shortfall persists after a grace period that, per the same report, ran to 31 July 2026.
A caveat on sourcing: the BSI page we could reach carries no registration statistics. These figures come from press reports citing the BSI, not from a table we could check.
The case for getting tough
The strongest argument for enforcement is straightforward. The registration duty in section 33 of the BSI Act is the foundation of the whole regime. The BSI cannot supervise, warn, or coordinate incident response for entities it cannot see. The BSI's own NIS-2 page states that the statutory registration deadline has already expired. Entities that complied on time bear real costs, and a regime that tolerates open non-compliance rewards those who waited.
The BSI's plan is also gradual. The agency told Channelpartner it would start an enforcement initiative in the fourth quarter, a process that "begins with a hearing and can end with a fine". From the first quarter of 2027, it intends to order individual entities to audit their IT security and hand over evidence. A hearing before a fine is the proportionate order of operations, and we should say so.
What the number does and does not show
The trouble is what the 69% figure is being asked to prove. Three points complicate a reading of mass non-compliance.
- The denominator is contested. According to it-daily, the Federal Interior Ministry has asked the Federal Statistical Office to recalculate the earlier estimate of obligated entities. The ministry said so in an answer to a Green MP, quoted by heise. If the true population is smaller than 29,500, some of the gap is not evasion at all.
- Registration is a self-assessment. Whether a company falls in scope depends on sector, size and activity, and companies must work that out themselves. Firms that conclude in good faith they are out of scope will never appear in the register.
- Growth has slowed. it-daily reports 18,845 registrations at 31 July 2026, with about 11,500 at the original early-March deadline. The 20,373 for 30 September implies about 1,500 further registrations in two months. The counting bases may differ, since Channelpartner's figure includes secondary establishments, so this comparison is rough. The direction is still plain: the deadline and the grace period pulled in most of those who were going to register.
A hearing process will therefore meet two populations. One is firms that ignored the law. The other is firms the law never reached. The BSI cannot tell them apart without asking, and a hearing is the cheapest way to ask.
The stakes for firms and for innovation
For those inside the net, exposure is serious. Under section 65 of the BSI Act, fines for essential entities reach 10 million euros, and 7 million euros for important entities. For the largest firms, turnover-based ceilings of up to 2% and 1.4% apply. Under section 38, managers can be held liable to their company for culpably caused damage.
The cost of misdirected enforcement falls mainly on small and mid-sized firms and on municipal operators. These have the thinnest compliance staff. A start-up that gets a hearing letter because it was miscategorised spends engineering time on legal triage instead of on product. That cost is an argument for precision, and not an argument against supervision.
What the BSI should do before Q1 2027
- Publish the table. The BSI should release registration counts by sector, entity class and counting basis on its own site. Today the market relies on secondary relays of an unlinked table.
- Triage before ordering audits. Hearings should come first for sectors where non-registration is most likely to be evasion, such as larger firms in energy, transport and digital infrastructure. Audit orders for small firms should wait until the population estimate is settled.
- Offer a safe harbour for good-faith scoping. A firm that documents its out-of-scope reasoning and can show it applied the published criteria should be treated differently from one that never looked.
- Report outcomes. The BSI should state how many hearings ended in registration, how many in a finding of non-applicability, and how many in a fine. That would show whether the gap was evasion or estimation.
Bottom line
Enforcement is legitimate, and the staged approach is sensible. But a regulator that moves from hearings to audit orders on the strength of a 69% ratio should first confirm what the ratio measures. If the denominator falls when the Statistical Office finishes its work, the gap shrinks with it. If it holds, the hearings will show it. Either way, publishing the underlying data costs the BSI little and would improve trust in the process.