NISG 2026 · § 29
Registration by 01.01.2027
Essential and important entities must register with the Bundesamt für Cybersicherheit within three months of the law taking effect. This is not signing up to a programme; it is a statutory duty with a penalty range of its own.
Deadline
01.01.2027
What the law says
You register yourself
The authority does not classify you and does not invite you. You assess whether you are in scope, and you register.
Within three months
The period runs from the law taking effect on 01.10.2026, which puts the date at 01.01.2027. Because that is a public holiday, § 33 Abs. 2 AVG moves the last day to the next working day: 04.01.2027. Our own recommendation is to be finished by 31.12.2026, so that nothing rests on the extension.
And later, if it applies later
A company that meets the conditions later — through growth, a new activity or a changed group structure — must register within three months of that point.
Through the USP
Registration is made on an electronic form reachable through the Unternehmensserviceportal (USP) or the Portalverbund.
Keep the details current
Registered details have to stay up to date, and changes have to be reported.
Registrars additionally
Providers of domain name registration services carry their own registration and data duties (§§ 29, 30) even where they are not an essential or important entity.
What is not settled yet
What is open is the regulation setting out the form and the details it asks for; it has not been issued as this page stands. The route itself is settled: the USP. Waiting on that to begin is waiting for the wrong thing — your classification, who owns it, and contact details for incident reports do not depend on which fields the form ends up asking for.
What you can do now
- Settle the classification defensibly: essential, important, or not in scope.
- Name who owns it — who registers, and who keeps the details current.
- Fix the contact details for incident reports, including cover outside business hours.
- Assemble what a registration predictably asks for: company details, sector, activity, named contacts.
If the deadline passes
A missed registration is a breach in its own right, however good your security measures are. The penalty range for formal breaches reaches €50,000, and €100,000 on repetition (§ 45).
Read on
The other duties, each on its own page.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
Every essential and every important entity — the obligation follows from being in scope, not from any notice. If you are unsure which you are, that is the question the free check answers.
Registering is not an admission that turns a company into a covered entity. Scope follows from activity and size, not from the register. If a check later shows you are out of scope, the sensible thing is to document the reasoning rather than quietly disappear.
Not for the work that matters. The route is settled — an electronic form reachable through the USP — and what is open is the regulation setting out the form and the details it asks for. The classification, the named owner and the incident contact details are independent of it, and they are the parts with lead time.
Then the three months run from that point rather than from 01.10.2026. Growth, a new activity or a changed group structure can all trigger it, which is why the size question is worth revisiting annually.
Not sure which of these applies to you?
The free check answers the ordinary case in five minutes. For anything else a conversation is the quicker route.