Germany's Federal Office for Information Security (BSI) has given the country's cybersecurity law a second chance to work. After the statutory registration deadline under the NIS-2 Implementation Act (NIS2UmsuCG) expired on March 6, 2026, the BSI confirmed that only around 18,500 of the roughly 29,500 obligated companies and federal institutions had registered by the end of May — a compliance rate of about 63% (heise.de). Rather than begin issuing fines of up to €500,000 for late registration, the BSI has set a new, informal cutoff of July 31, 2026, and signaled that enforcement attention sharpens for anyone still unregistered after that date.
A Law Built for Interdependence
The steelman case for BSI's approach is straightforward and correct on the merits. NIS2UmsuCG, which entered into force on December 6, 2025 with no transition period, applies to roughly 29,500 entities across the energy, transport, health, digital infrastructure, finance, public administration, food, and manufacturing sectors (Bundesregierung; BSI). Modern critical infrastructure is a networked system: a hospital's IT security is only as strong as the medical-device supplier and cloud vendor it depends on, and a single unpatched, unregistered mid-sized manufacturer can become the entry point for an attack that cascades through a supply chain. Registration is not paperwork for its own sake — it is what lets the BSI actually know who is obligated to report incidents, and incident reporting is what lets the state see attacks in progress before they spread. Given that framing, extending the deadline rather than immediately fining a third of the regulated economy is a defensible act of regulatory pragmatism, not weakness.
But the Numbers Point to a Capacity Problem, Not Defiance
What the shortfall actually shows, though, is less about companies refusing to comply and more about the state building compliance infrastructure faster than industry can absorb it. A Plusserver survey published July 8, 2026 found that only 34% of affected companies say they have fully met NIS2's requirements, while 47% describe the implementation process itself as difficult or very difficult, and 48% point to legacy operational-technology systems as the central obstacle (boerse-express.com). That is not a picture of companies gambling on non-enforcement; it is a picture of a regulated population — heavily weighted toward the German Mittelstand, which rarely has a dedicated CISO — trying to complete a two-step registration process (an ELSTER organizational certificate followed by BSI Portal enrollment) against requirements that arrived with zero transition period after a delayed legislative process (BSI).
The stakes for getting this wrong are real. Beyond the €500,000 ceiling for registration failures alone, companies that miss substantive risk-management or incident-reporting obligations face fines up to €10 million or 2% of global annual turnover for "essential" entities, and management boards can be held personally liable for oversight failures (ad-hoc-news.de). Those are proportionate tools for genuine security lapses — persistent failure to patch, refusal to report a breach, negligent risk management. They are a poor tool for punishing a Mittelstand firm that is still working through its ELSTER certificate three months after a law took effect overnight.
The Case for Calibrated, Not Symbolic, Enforcement
This is where BSI's July 31 grace period earns its keep, provided the agency follows through on differentiation. A regulator that fines registration lag at the same severity as an actual, negligent security failure teaches companies that compliance theater and genuine risk management carry the same penalty — which perversely discourages investment in the harder, more expensive work of real risk management in favor of just clearing the registration bar. The BSI's own framing — that the July 31 date is "not a formal extension but a firm expectation," with heightened scrutiny to follow — is the right instinct: keep the legal deadline intact for accountability purposes, but concentrate actual enforcement resources on entities that combine non-registration with demonstrable risk exposure, not on the mid-sized manufacturer three weeks behind on paperwork.
The smarter long-term fix is upstream of enforcement altogether: the German government's own impact assessment estimated NIS2 compliance would add roughly €2.3 billion in annual costs and €2.2 billion in one-time implementation costs to the economy — a burden that falls hardest on exactly the SMEs struggling most with legacy OT systems. If Berlin wants the July 31 deadline to actually close the compliance gap rather than just relabel it, BSI's starter-package guidance and sector outreach need real resourcing, not just a portal and a hashtag. A cybersecurity law that only the well-staffed half of the regulated economy can keep up with does not make Germany's infrastructure more secure — it just concentrates risk in the companies that can least afford to fix it.