Data Sovereignty|28 Jul 2026
Germany's BSI set 31 July 2026 as a de facto NIS2 registration deadline, with only about 18,500 of an estimated 29,000 to 40,000 affected companies registered by late May.
Why It Matters
This isn't a new law, it's Germany's cyber regulator signaling it will start enforcing the March 2026 deadline that most affected firms already missed. NIS2 reaches well past critical infrastructure into mid-sized suppliers, IT service providers, and manufacturers selling into Germany or the wider EU. "We didn't know we were in scope" will not hold once enforcement begins.
What To Do About It
If your business sells into Germany or holds EU supply-chain, logistics, or IT-services contracts, run BSI's free NIS2 self-assessment this week. It takes under 20 minutes and tells you whether you're in scope. Missing the 31 July window risks fines up to 500,000 EUR, and increasingly, disqualification from EU customers who now vet supplier NIS2 status before signing.
nis2bsigermany cybersecurityeu smb regulationnis2 registration deadlinecyber compliance
