In a nutshell: Fewer than 40 percent of operators relevant to NIS2 have registered in Germany, indicating delays in implementation.
In Germany, just under 11,500 of approximately 29,500 critical operators have registered under the NIS2 Directive. The registration rate of about 39 percent reveals significant implementation gaps ahead of upcoming compliance deadlines.
The registration rate for NIS2 operators in Germany currently stands at approximately 39 percent: 11,500 companies out of a total of 29,500 identified critical operators have registered. This figure illustrates the reality of implementing an EU-wide binding cybersecurity directive among German mid-sized and large enterprises.
For CISOs, this registration rate presents a time-critical scenario: the remaining approximately 18,000 operators face pressure to complete their registration and implement the required cybersecurity measures under NIS2. In parallel, enforcement proceedings are already underway against operators failing to meet their reporting obligations. Non-compliance can result in penalties of up to 10 million euros or a percentage of worldwide annual turnover.
The situation is particularly critical for organizations in the energy, transport, water, banking, and healthcare sectors, where the registration requirement is already active. Operators should immediately review their classification, designate their NIS2 contacts, and begin implementing the technical and organizational requirements. The deadline for full implementation of all technical security measures expires in October 2025.
Source: news.google.com · Published May 29, 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.6.2.