The grace period for NIS2 is coming to an end. According to media reports from early October 2026, the Federal Office for Information Security (BSI) intends to launch an initiative in the fourth quarter of 2026 to enforce the registration obligation. From the first quarter of 2027, individual entities are also to be required to have their IT security audited and to submit evidence. Initially, this affects companies that clearly fall under the law but have not yet registered with the BSI.
What the BSI has announced
The information comes from a report by the Tagesspiegel, which was picked up by specialist media. At the time of going to press, the BSI had not issued its own press release on the matter. According to these reports, the BSI is planning two steps:
| Period | Plan |
|---|---|
| Fourth quarter of 2026 | Direct contact with companies that should have registered |
| From the first quarter of 2027 | Ordering audits of individual entities, each with a thematic focus |
According to the reports, the BSI intends to start with particularly important entities in the sectors where it sees the greatest need for action. According to the reports, the first step is not a fine but a hearing. However, fine proceedings may follow.
Why now
The statutory deadline for registration under § 33 BSIG ended for most companies on 6 March 2026. The BSI subsequently called for late registrations by the end of July 2026. According to figures cited in the reports, around 20,000 registrations had been received by the end of September 2026, including branch offices. The BSI itself expects just under 30,000 affected entities. A considerable proportion is therefore still missing.
For an overview of the obligations as a whole, see our article NIS2 in Germany: What needs to be done now after the launch.
What the law permits the BSI to do
The announced steps are based on powers provided for in the BSI Act since December 2025. Summarised in our own words:
- Ordering audits (§ 61(1) BSIG). The BSI can order individual particularly important entities to have independent bodies carry out audits, inspections or certifications. These assess whether the measures under § 30, the reporting obligations under § 32 and the obligations of management have been fulfilled. No waiting period applies.
- Regular evidence (§ 61(3) BSIG). The BSI can only request evidence generally three years after the law comes into force, i.e. from December 2028. A longer deadline applies to licensed hospitals. This does not contradict the audits from 2027: these are targeted orders in individual cases.
- Important entities (§ 62 BSIG). Here the BSI only takes action if facts indicate that obligations are not being fulfilled or not fulfilled properly. Such a trigger could be a reported incident, for example.
- Fines (§ 65 BSIG). Missing, incorrect or late information in the registration constitutes an administrative offence, for which the law provides a fine of up to EUR 500,000. The upper limits for breaches of the security measures and reporting obligations are considerably higher.
The authoritative source is the legal text on gesetze-im-internet.de. How the BSI will use its powers in detail will only become clear in practice.
Who will be targeted first
According to the information available so far, the BSI is focusing on two groups. Firstly, companies that clearly fall under NIS2 but have not registered. Secondly, particularly important entities in high-risk sectors. Anyone operating there should expect audits to begin before 2028.
Important entities are not off the hook. A serious security incident or reports from third parties may be enough for the BSI to make enquiries. What then counts is whether you can provide evidence of your measures.
What an ordered audit is likely to look like
The law gives the BSI room for manoeuvre. It can specify the requirements that auditing bodies must meet and request audit results, identified deficiencies and a plan for remedying them. According to the reports, each audit is to have a thematic focus. Which topics these will be is not yet known. The core areas from § 30 are obvious candidates: risk analysis, handling of security incidents, supply chain, access protection and emergency planning.
An existing ISO/IEC 27001 certificate does not automatically replace such an audit. It does help, however, because much of the evidence is already available and has been audited. Make sure that the scope covers the services and locations relevant to NIS2.
What this means for you
- Check your registration. If you fall under NIS2 and are not yet registered, do so immediately via the BSI portal. Registering late before a hearing puts you in a better position. Also check whether the information you submitted is still correct.
- Record your classification. Document why you are a particularly important entity, an important entity or not an entity at all. You will need this justification if the BSI makes enquiries.
- Organise your evidence. For each area from § 30, define which policy, which process and which evidence belongs to it. Sorting this out now will allow you to respond to an order within the set deadline.
- Involve management. Management must approve the measures, monitor their implementation and receive regular training. Record resolutions and training in writing.
On the NIS2 page you can see how Sightadel maps the requirements of the BSIG control by control and stores evidence for each measure. If you already work to ISO/IEC 27001, the ISO/IEC 27001 page shows how the two frameworks connect. You can try Sightadel free of charge for 14 days without payment details.
As of: 9 October 2026 · Not legal advice. The standard or law in its current version is authoritative.
