The first letter from the BSI is a hearing

On 30 September 2026, 20,141 entities were registered with the BSI under NIS-2, or 20,373 including secondary branches. Just under 30,000 are expected. So a good third is missing, more than seven months after the statutory deadline.

That is now set to change. Timo Hauschild, head of department at the BSI, announced in Tagesspiegel Background on 8 October that an enforcement initiative will start in the fourth quarter. It will first approach entities that obviously should have registered. And there will not be an immediate fine: the first step is a hearing.

What the law provides

The registration obligation is in Section 33(1) of the BSI Act. Particularly important and important entities must register no later than three months after they are deemed such an entity for the first time or again. In German:

„spätestens drei Monate, nachdem sie erstmals oder erneut als eine der vorgenannten Einrichtungen gelten“

Anyone who does not do so, or not in time, commits an administrative offence under Section 65(2) no. 6; subsection 5 sets a fine of up to 500,000 euros. The fact that the BSI hears the entity first does not change this. It only means you get the opportunity to explain yourself. Anyone who cannot then present anything solid has wasted that opportunity.

What follows from 2027

According to the announcement, from the first quarter of 2027 the BSI intends to instruct individual entities to have their IT security audited and to submit evidence, each with a thematic focus. The basis is Section 61(1) of the BSI Act: the BSI can order individual particularly important entities to have audits, examinations or certifications carried out by independent bodies to check compliance with the obligations under Section 30(1).

For important entities, this is only possible on a case-by-case basis under Section 62: when facts justify the assumption that obligations are not, or not correctly, implemented. And from all other particularly important entities, the BSI may only request evidence under Section 61(3) at the earliest three years after the act entered into force, so not before December 2028.

What should be prepared before the letter arrives

• The assessment of being in scope, with reasons. Even an entity that concluded it is not in scope should be able to support that with size, sector and activity. In a hearing, "we thought it did not apply to us" is not an answer.
• The registration, with date and content. What was submitted when, and is it still correct? A move, a new branch or a changed contact person are changes that must be reported.
• The documentation of measures. Section 30(1) requires entities to document compliance with their obligations. If that is missing, it is also an administrative offence under Section 65(2) no. 3.
• Who answers, and by when. A letter from the BSI comes with a deadline. It must not sit in a shared mailbox.

How isidaten handles this

The supervisory file keeps the file number, authority and contact person for each entity and regime. Every submitted version of the registration data is kept as a separate state, as evidence of what was reported on which day. Letters from the authority become cases with a response deadline that is checked daily. The NIS2 module adds the scope assessment with its reasoning and, if an audit is ordered, the audit body, evidence and findings.

The test question

If a letter from the BSI arrives tomorrow: who opens it, and where is the reasoning for why your organisation is registered or not?

If you first have to ask someone, now is the time to change that, not during the hearing deadline.

Sources

BSI Act, Section 30(1), Section 33(1), Section 61(1) and (3), Section 62, Section 65(2) and (5) (German). BSI, NIS-2 in figures (as of 30.09.2026, German). The BSI announcement according to Tagesspiegel Background of 8 October 2026, quoted by ChannelPartner (German); the BSI has not issued its own press release on this so far.