NIS2 Registration Gap: What It Reveals About Scope Uncertainty

The German government originally assumed that almost 30,000 companies would have to register as critical infrastructure under NIS2. In fact, around 10,000 notifications are still missing relative to that expectation, as Golem reports. The government itself does not describe this as a gap in the strict sense. This assessment deserves a closer look, because it says something about the nature of scope determination itself.

How large is the gap between expected and registered NIS2-affected entities?

The expectation of around 29,500 entities subject to registration was based on a calculation by the Federal Statistical Office. The actual number of notifications remained well below that figure.

The expectation of 29,500 affected entities was based on a calculation by the Federal Statistical Office (Statistisches Bundesamt), which the German government relied on when passing the NIS2 Implementation Act. Even after a granted grace period, the gap persisted. Around 10,000 registrations are currently missing relative to the forecast, after only about 11,500 operators had registered properly by the originally set deadline.

It is remarkable how the government frames this gap: not as evidence of systematic non-registration, but as an open question of whether the original estimate itself was set too high. This uncertainty on the statistical side mirrors an uncertainty that also exists on the corporate side.

Why can companies not simply read off whether they are affected?

NIS2 applicability results from a combination of sector affiliation and size threshold, which each company must assess and document itself, without any prior notification from the authorities.

Applicability results from two criteria that must both be met: sector affiliation and company size, whereby the relevant annexes list 18 sectors, including energy, transport, health, water, digital infrastructure, IT services, chemicals, food and manufacturing. There is no external assignment by an authority. Affected entities must identify themselves; there are no official notices and no request from an authority.

The association of municipal utilities states the cause clearly: the main reason for the existing registration gap lies in the complexity of the applicability assessment. Where self-assessment without a feedback loop forms the basis, the quality of the internal assessment methodology becomes the decisive factor.

What does this mean for the quality of a company's own scope assessment?

A one-off, informal assessment is not sufficient, because sector classification, group structures and thresholds can change over time and must be documented in a traceable way.

Experience from Germany shows that even companies with compliance resources can misjudge the classification, or simply overlook that part of their own activity falls into a regulated sector. This affects not only companies with an obvious link to critical infrastructure, but also suppliers and service providers whose classification only arises through chain relationships. A company that carries out its applicability assessment only once, without renewing it at every relevant change, risks quietly growing out of scope or quietly growing into it.

For the GRC function, this means that scope determination itself should be treated as a control object, with clear responsibilities and recurring review. The article “Rethinking cyber resilience in the context of NIS2” describes how this requirement can be embedded into an existing resilience concept.

What does this mean for companies outside Germany?

Swiss companies with subsidiaries, branches or significant customer relationships in the EU should also check whether NIS2 applicability arises through this connection.

The registration gap is a German phenomenon, but the underlying problem of scope determination is not. Each EU member state implements NIS2 with its own deadlines and procedures, which means additional assessment steps for companies operating across borders. The review “NIS2 resolution in the Bundestag: pressure to act for companies” outlines the consequences arising from the German implementation for cross-border business relationships.

For Switzerland itself, the discussion around a separate cyber resilience law is running in parallel, with its own systematics. The article “Federal Council announces new cyber resilience law” describes the current status of this initiative.

How can companies concretely improve their own scope assessment?

The first step is a written, documented sector and threshold analysis, approved by executive management and updated at every relevant structural change.

The analysis should record which activity is assigned to which sector, which size indicators were used, and who is responsible for the assessment. This documentation serves not only internal clarity but also as evidence towards supervisory authorities and business partners, who increasingly demand proof themselves. The article “ISMS: people, processes and technology are decisive” shows how such an assessment can be integrated into an existing management system.

The compliance or risk officer should complete the scope analysis before the next management review of the information security management system and submit it to the person responsible for governance for approval. This is a manageable, verifiable first step that can be implemented regardless of company size.