When must German companies register with the BSI?

Under section 33(1) of the BSIG, particularly important and important entities must register within three months. The clock starts when they first or again count as such, and they use the registration facility set up by the BSI and the BBK. They submit their name and legal form, address and contact data including public IP address ranges, their sector, the Member States they serve and their supervisory authorities. Operators of critical installations will register under section 8 of the KRITIS-Dachgesetz instead (section 33(2)), but only once the regulation identifying critical installations under that law is in force; until then, section 66 keeps the earlier wording of section 33(2) in effect, so follow the BSI's current instructions. Changes must be reported without undue delay and at the latest within two weeks of becoming known (section 33(5)). If an entity does not register, the BSI can register it itself in agreement with the supervisory authorities (section 33(3)), and failing to submit the details correctly or in time is an administrative offence that can be fined up to EUR 500,000 under section 65. Keep the registration confirmation with your NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. records.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 15 questions on Germany: BSIGAll topics