The Federal Office for Information Security (BSI) has published its quarterly "NIS-2 in Zahlen" statistics, with data as of 30 September 2026. In total, 20,141 entities have registered under Germany's NIS2 implementation law: 13,252 "important" and 6,837 "particularly important" entities. The 1,447 KRITIS operators are a subset of the latter group. The BSI also counts 1,272 initial incident reports and 3,070 NIS2 reports in total through its portal.
Measured against the roughly 29,500 entities the government expected, registration stands at about 68%. The law took effect on 6 December 2025, and registration was due within three months of an entity first falling in scope, which put the deadline at 6 March 2026. The BSI then set an informal grace date of 31 July 2026. ZFK reported on 4 August that this grace period had expired. By 31 July, it-daily, citing heise, counted 18,845 registrations. Since then, about 1,300 more entities have registered.
The case for treating this as a failure
The strongest argument for a tougher line is straightforward. Registration is the foundation of the whole regime. The BSI cannot send warnings, coordinate incident response or supervise entities it does not know exist. Registration is a legal duty under § 33 BSIG, and the deadline has now been missed twice. An observer could also argue that Germany already lost time. The Commission's Germany page records a reasoned opinion issued on 7 May 2025 for failure to notify full transposition. Having waited that long, the argument goes, Berlin cannot treat missed deadlines casually. Companies that ignore a free, one-time registration also give a poor signal about how seriously they take security.
Why the headline gap may overstate non-compliance
The ~29,500 figure is an estimate, not a census. According to it-daily, it derives from a Statistisches Bundesamt (Destatis) calculation that the government relied on when the law passed. The same report says the Federal Ministry of the Interior has asked Destatis to recalculate it. If the estimate was too high, part of the "missing third" does not exist.
There are good reasons to suspect overestimation. Scope under NIS2 depends on sector lists and size thresholds, and many firms have to self-assess whether they qualify. A company with a few activities in a listed sector may reasonably conclude it is out of scope. The BSI's own page notes that sector counts exceed the registration total because one registration can list several sectors. That shows how messy the classification is. A registry that treats every uncertain firm as a delinquent confuses legal ambiguity with defiance.
The pace of registration points the same way. Registrations rose by roughly 1,300 in the two months after the grace date. That is slow, but it is not the pattern of mass evasion. It looks more like a long tail of small entities working out whether the law applies to them.
Proportionality in enforcement
The penalty structure is lopsided, and the press coverage has blurred it. Computerwoche put the headline "Jetzt drohen Milliardenstrafen" ("Billion-euro penalties now loom") on a hypothetical sum of the maximum fine multiplied by every missing entity. The statute does not support that framing. Under § 65 BSIG, a violation of the § 33(1) registration duty carries a fine of up to €500,000. The €10 million and €7 million ceilings for particularly important and important entities apply to substantive violations, and the turnover-based ceilings apply only to the violations the statute lists. Registration offences are not among them. According to it-daily, the BSI had imposed no sanctions as of early August and was monitoring "closely". I did not find a later report of fines.
That restraint is sensible. A €500,000 ceiling is already large for a mid-sized firm that simply missed an administrative step. The better use of enforcement capacity is on entities that are plainly in scope and ignoring the duty, especially the largest and the KRITIS operators. For everyone else, outreach, plain-language scoping tools and a stable portal do more than penalties.
The incident-reporting figures suggest the system is already producing value. Of 3,070 reports through the portal, 1,272 are first reports. Entities are using the channel. Those reports are the data security policy needs, and they will dry up if firms come to see registration as a trap.
What should happen next
- Publish the recalculated estimate. The BSI and the Interior Ministry should release the Destatis revision with its methodology, so that the "coverage rate" means something.
- Sequence enforcement by size and risk. Start with large entities and KRITIS operators. Treat small first-time defaulters with a warning before any fine.
- Keep the next BSI update on schedule. The BSI says its next update is expected around 31 January 2027. By then the numbers should show whether registration is plateauing near 20,000 or still climbing.
Germany's regime is only as good as its map of who is regulated. But a map that is two-thirds complete may be closer to the territory than the official estimate suggests. Regulators should find that out before deciding whether the missing third is a compliance failure or a forecasting error.