- Meaning
- Signing up entities that fall under NIS2
- Where
- The national registration portal
- Deadline
- Set by each Member State
- Relevance to NIS2
- A concrete legal duty
- Updated
- June 2026
- Editorial team
- Compliance Compass
What is the registration duty?
Under NIS2, entities in scope must register themselves with the authority designated in their own Member State — the National cybersecurity authorities differ from country to country. Registration tells the authority who is subject to the duties and who will submit notifications in an emergency. Unlike the Registration portals (the technical tool), the registration duty is the legal act itself. One point matters: classification as an essential or an important entity is, as a rule, a matter of self-identification – organisations have to check for themselves whether they fall under NIS2 and then sign up on their own initiative.
What data is required
- Master data of the Entity
- Sector and classification as an essential or an important entity
- Contact points for notifications (ideally reachable around the clock)
Deadline and procedure
The registration duty comes from national law, not directly from the directive. NIS2 has applied since 18 October 2024, and each Member State sets out in its transposing act who has to register, with which body and by when. The date that binds you is therefore a national one. Check your own Member State before you rely on any single deadline: in several countries the first registration deadline has already passed, and a missed deadline does not remove the obligation. The European Commission publishes the state of transposition per country.
Registration is only the beginning
Registration does not discharge your duties – it is the formal entry point. What follows is the real work: Risk management, technical and organisational measures, and compliance with the reporting obligations. Failing to register risks fines: Article 34 sets minimum ceilings of at least EUR 10 million or 2 % of total worldwide annual turnover for essential entities and at least EUR 7 million or 1.4 % for important entities, and Member States may set higher amounts.
A case from everyday practice
A typical case: a manufacturer of industrial components is unsure whether it is in scope. After checking the sectors and the size thresholds it concludes that it counts as an important entity. Because the deadline in its country has already passed, it registers without delay through the national portal, files a reporting contact point and starts building its risk management in parallel – which limits its exposure to sanctions.
Frequently asked questions
What is the NIS2 registration duty?
The registration duty is the legally required sign-up of entities that fall under NIS2, made through the portal their Member State operates. Registering tells the competent authority which entity is subject to the NIS2 duties, which sector it belongs to and through which contact point security notifications will be submitted. Classification as an essential or an important entity is, as a rule, a matter of self-identification.
By when do you have to register?
That is set in national law, not in the directive itself. NIS2 has applied since 18 October 2024, and each Member State fixes in its transposing act who has to register, with which body and by when. In several countries the first deadline has already passed; a missed deadline does not remove the obligation, so late registration is still required. Anyone who fails to register risks fines, for which Article 34 sets minimum ceilings of at least EUR 10 million or 2 % of total worldwide annual turnover for essential entities.
Is registration on its own enough?
No. Registration is only the formal entry into NIS2 compliance and does not satisfy the duties themselves. The real work follows: appropriate risk management, technical and organisational security measures, and compliance with the staggered reporting chain of an early warning within 24 hours, a detailed notification after 72 hours and a final report within one month.
Further reading: European Commission – NIS2 Directive