Missing a NIS2 registration deadline is itself a violation — in Germany late registration alone can cost up to €500,000 — but registering late is always better than not registering: regulators treat a corrected omission far more leniently than a continuing one.
Where deadlines already passed
- Germany: the BSI’s original deadline was 6 March 2026 and the grace period ended 31 July 2026. Roughly a third of the ~29,500 in-scope companies had registered by March — the BSI knows most laggards exist.
- Denmark: CFCS registration closed 1 October 2025; non-registration is an independent breach and audits began in 2026.
- Belgium: Safeonweb@Work registration windows closed in 2024–2025; the CCB is in its enforcement phase.
- Netherlands: registration opens 15 August 2026 — Dutch companies still have the chance to be on time.
What to do if you are late
- Register immediately — it is administratively simple and stops the clock on the worst scenario.
- Commission a documented gap analysis against the ten Article 21 measures: demonstrable progress weighs heavily with every regulator.
- Fix the 24-hour reporting capability first; it is the obligation you cannot improvise during an incident.
Country details: Netherlands · Germany · Belgium · Denmark. Or book a free NIS2 gap review.