NIS2 Registration: How and When to Register in Each EU Country

Updated monthly. Last full check of all 27 countries: 4 November 2026. Changes are listed at the end of the page.

What the directive requires

Under Article 3(3) of NIS2, each Member State had to establish a list of essential and important entities, and of entities providing domain name registration services, by 17 April 2025, and review it at least every two years. To build that list, entities must submit at least (Article 3(4)):

• the name of the entity;
• the address and up-to-date contact details, including email addresses, IP ranges and telephone numbers;
• where applicable, the sector and subsector in Annex I or II;
• where applicable, the Member States where they provide services within the scope of NIS2.

Changes must be notified without delay and in any event within two weeks. Member States may set up national mechanisms for entities to register themselves, and most have.

Extra details for digital providers

DNS service providers, TLD name registries, domain name registration services, cloud computing, data centre, content delivery network, managed service and managed security service providers, online marketplaces, online search engines and social networking platforms also go into an EU registry kept by ENISA (Article 27). They had to submit, by 17 January 2025, their sector and type, the address of their main establishment and other EU establishments (or of their EU representative), contact details, the Member States where they provide services and their IP ranges. Changes are due within three months.

These providers register only in the country of their main establishment: where decisions on cybersecurity risk-management are predominantly taken (Article 26). Providers outside the EU that offer services in it must designate a representative in one of the countries where they offer services.

Before you start: what to have ready

1. Your scope decision, documented. Sector, subsector, entity type, and the size test (employees, turnover, balance sheet, counted with partner and linked enterprises). See Does NIS2 apply to my company?.
2. Essential or important. Several national forms ask you to state it, and some (Austria, for example) ask for the threshold figures too.
3. A business login. Many portals need a national business identity: Mein Unternehmenskonto in Germany, eHerkenning in the Netherlands, Suomi.fi in Finland, Taxisnet in Greece. Getting one can take days or weeks.
4. Technical and contact data. Public IP ranges, a monitored security contact mailbox and phone number, all EU establishments, and the countries where you provide services.
5. Someone who owns updates. Changes are due within two weeks (three months for some details), so assign the duty.

Registration in each Member State

Deadlines given as "was due" have passed. In every country that has one, a missed deadline does not end the duty: register as soon as you can and keep a record of when you assessed your scope.

Deadlines still open or coming up

• Austria: the NISG 2026 has applied since 1 October 2026. Registration is due within three months, so by the end of 2026 (section 29(3)).
• Italy: the annual registration and update window on the ACN portal runs from 1 January to 28 February each year.
• France, Ireland and Spain: no NIS2 registration yet. It will start once each national law is adopted; the transposition status page tracks the bills.
• Everywhere: entities that fall in scope later (growth past the size limit, a new service, an acquisition) usually have a short window from that date, for example 60 days in Czechia and Slovakia, 30 days in Romania and Slovenia, three months in Austria and Germany.

Common mistakes

• Waiting for a letter. In most countries registration is self-assessed. The authority will not tell you that you are in scope.
• Registering in the wrong country. Digital providers listed in Article 26(1)(b) register only where their main establishment is; other entities register in every Member State where they are established.
• Forgetting updates. A new contact person, new IP ranges or a new establishment must be notified, usually within two weeks.
• Treating registration as compliance. It only starts the clock. The Article 21 measures and incident reporting apply regardless; see the NIS2 compliance checklist.

Registered? Now prove the measures. The NIS2 Compliance Starter Kit includes a gap-assessment workbook against Article 21, an incident response plan template, a supply chain security policy template and a board briefing deck.

Change log

• 2026-11-04: First published. All 27 Member States checked.

Sources

• Directive (EU) 2022/2555 (NIS2), Articles 3, 26 and 27, EUR-Lex
• ACN: NIS
• Agency for Digital Government: registration obligation
• BDO Malta: what Legal Notice 89 of 2026 changes
• BSI: NIS-2 Implementation Act in force
• BSI: registration guide
• BTA: Parliament adopts amendments to the Cybersecurity Act
• CCB
• CNCS
• Cybersecurity Act NN 14/2024 (English, Ministry of Foreign and European Affairs)
• DNSC
• European Commission: referral of four Member States (8 July 2026)
• Government of Luxembourg: NIS 2 (6 July 2026)
• Government of the Netherlands: Cbw in force 15 August 2026
• Grant Thornton Estonia: the Cybersecurity Act is in force
• Harneys: Cyprus adopts NIS2
• Ministry of Digital Affairs: amended KSC Act
• NBÚ
• NKI: guidance on the scope of the Cybersecurity Act
• NKSC
• NÚKIB Portal
• RIS: NISG 2026, s. 29
• Riksdagen: Cybersecurity Act (2025:1506)
• SOA: national cybersecurity authority
• Saeima: new law strengthens cybersecurity
• Traficom: register for the list of NIS 2 entities
• URSIV: obligations under ZInfV-1
• gov.gr: NIS2 self-declaration of entities

Related tools