# NIS2 Registration Gap: What It Reveals About Scope Uncertainty

> Der Beitrag von Swiss GRC erklärt, warum in Deutschland rund 10'000 erwartete NIS2-Meldungen fehlen. Er richtet sich an Unternehmen, die ihre NIS2-Betroffenheit selbst bestimmen müssen, und empfiehlt eine schriftlich dokumentierte Sektor- und Schwellenwertanalyse.

- URL: https://swissgrc.com/en/nis2-registration-gap-scope-uncertainty/
- Publisher: SwissGRC®
- Published: 2026-08-21
- Last updated: 2026-09-17

## Key facts

- Die deutsche Bundesregierung erwartete auf Basis einer Berechnung des Statistischen Bundesamts rund 29'500 NIS2-betroffene Einrichtungen.
- Zwischen erwarteten und beim BSI tatsächlich registrierten Einrichtungen fehlen rund 10'000 Meldungen, nachdem bis zur ursprünglichen Frist nur etwa 11'500 Betreiber ordnungsgemäss registriert waren.
- Die NIS2-Betroffenheit ergibt sich aus Sektorzugehörigkeit und Unternehmensgrösse, die beide erfüllt sein müssen; die Anhänge des BSIG nennen 18 Sektoren.
- Eine Behörde teilt Unternehmen nicht zu: Betroffene Einrichtungen müssen sich selbst identifizieren, es gibt weder behördliche Bescheide noch Aufforderungen.
- Als Hauptursache der Registrierungslücke nennt der Verband kommunaler Unternehmen die Komplexität der Betroffenheitsprüfung.
- Swiss GRC empfiehlt, die Sektor- und Schwellenwertanalyse schriftlich zu dokumentieren, von der Geschäftsleitung freigeben zu lassen und bei jeder relevanten strukturellen Änderung zu aktualisieren.

The German government originally assumed that almost 30,000 companies would have to register as critical infrastructure under NIS2. In fact, around 10,000 notifications are still missing relative to that expectation, as Golem reports. The government itself does not describe this as a gap in the strict sense. This assessment deserves a closer look, because it says something about the nature of scope determination itself.

In short

The gap of roughly 10,000 companies between the number of NIS2-affected entities expected by the German government and the number actually registered with the BSI shows that determining one's own applicability is a demanding process requiring documentation. Companies should make their sector and threshold assessment traceable in writing, rather than relying on a gut-feeling judgement.

29'500entities

NIS2-affected entities expected by the German government, based on a calculation by the Federal Statistical Office

it-daily.net, NIS2: Nach Nachfrist weiter zu wenig Registrierungen

10'000companies

gap between expected and actually registered entities

it-daily.net, NIS2: Nach Nachfrist weiter zu wenig Registrierungen

18sectors

sectors relevant to NIS2 classification under the annexes of the BSIG

mars-solutions.de, NIS-2-Registrierung: Frist abgelaufen, Lücke bleibt

## How large is the gap between expected and registered NIS2-affected entities?

The expectation of around 29,500 entities subject to registration was based on a calculation by the Federal Statistical Office. The actual number of notifications remained well below that figure.

The expectation of 29,500 affected entities was based on a calculation by the Federal Statistical Office (Statistisches Bundesamt), which the German government relied on when passing the NIS2 Implementation Act. Even after a granted grace period, the gap persisted. Around 10,000 registrations are currently missing relative to the forecast, after only about 11,500 operators had registered properly by the originally set deadline.

It is remarkable how the government frames this gap: not as evidence of systematic non-registration, but as an open question of whether the original estimate itself was set too high. This uncertainty on the statistical side mirrors an uncertainty that also exists on the corporate side.

## Why can companies not simply read off whether they are affected?

NIS2 applicability results from a combination of sector affiliation and size threshold, which each company must assess and document itself, without any prior notification from the authorities.

Applicability results from two criteria that must both be met: sector affiliation and company size, whereby the relevant annexes list 18 sectors, including energy, transport, health, water, digital infrastructure, IT services, chemicals, food and manufacturing. There is no external assignment by an authority. Affected entities must identify themselves; there are no official notices and no request from an authority.

The association of municipal utilities states the cause clearly: the main reason for the existing registration gap lies in the complexity of the applicability assessment. Where self-assessment without a feedback loop forms the basis, the quality of the internal assessment methodology becomes the decisive factor.

## What does this mean for the quality of a company's own scope assessment?

A one-off, informal assessment is not sufficient, because sector classification, group structures and thresholds can change over time and must be documented in a traceable way.

Experience from Germany shows that even companies with compliance resources can misjudge the classification, or simply overlook that part of their own activity falls into a regulated sector. This affects not only companies with an obvious link to critical infrastructure, but also suppliers and service providers whose classification only arises through chain relationships. A company that carries out its applicability assessment only once, without renewing it at every relevant change, risks quietly growing out of scope or quietly growing into it.

For the GRC function, this means that scope determination itself should be treated as a control object, with clear responsibilities and recurring review. The article “Rethinking cyber resilience in the context of NIS2” describes how this requirement can be embedded into an existing resilience concept.

## What does this mean for companies outside Germany?

Swiss companies with subsidiaries, branches or significant customer relationships in the EU should also check whether NIS2 applicability arises through this connection.

The registration gap is a German phenomenon, but the underlying problem of scope determination is not. Each EU member state implements NIS2 with its own deadlines and procedures, which means additional assessment steps for companies operating across borders. The review “NIS2 resolution in the Bundestag: pressure to act for companies” outlines the consequences arising from the German implementation for cross-border business relationships.

For Switzerland itself, the discussion around a separate cyber resilience law is running in parallel, with its own systematics. The article “Federal Council announces new cyber resilience law” describes the current status of this initiative.

## How can companies concretely improve their own scope assessment?

The first step is a written, documented sector and threshold analysis, approved by executive management and updated at every relevant structural change.

The analysis should record which activity is assigned to which sector, which size indicators were used, and who is responsible for the assessment. This documentation serves not only internal clarity but also as evidence towards supervisory authorities and business partners, who increasingly demand proof themselves. The article “ISMS: people, processes and technology are decisive” shows how such an assessment can be integrated into an existing management system.

The compliance or risk officer should complete the scope analysis before the next management review of the information security management system and submit it to the person responsible for governance for approval. This is a manageable, verifiable first step that can be implemented regardless of company size.

For practice

## Key points

- The gap between expected and registered NIS2-affected entities points mainly to methodological uncertainty in scope determination, not necessarily to widespread refusal.
- Sector affiliation and size threshold must be assessed together, without any authority notifying the classification in advance.
- A one-off assessment is not enough, because group structures, fields of activity and key figures change over time.
- Swiss companies with EU exposure should assess their own applicability independently of the German discussion.
- A written, documented scope analysis approved by executive management is the verifiable first step.

FAQ

## Frequently asked questions

What is the NIS2 registration gap?

The German government expected around 29,500 companies to be subject to NIS2 registration, based on a calculation by the Federal Statistical Office. By the original deadline, however, only around 11,500 operators had registered, and around 10,000 notifications are still missing relative to the forecast today. The government does not treat this as proof of non-registration, but also as a possible overestimation of the original figure.

Which criteria determine whether a company is affected by NIS2?

Applicability results from two criteria that must both be met: affiliation with one of the 18 listed sectors, such as energy, transport, health or IT services, and reaching certain company size thresholds. There is no external classification by an authority; companies must identify themselves.

Do Swiss companies need to concern themselves with NIS2?

NIS2 is EU law that directly applies only to companies within member states. Swiss companies with subsidiaries, branches or significant customer relationships in the EU should nonetheless check whether applicability arises through this connection. For Switzerland itself, a separate cyber resilience law is being discussed in parallel.

Why is a one-off assessment of NIS2 applicability not sufficient?

Sector classification, group structures and thresholds can change over time, for example through growth, restructuring or new business lines. A company that carries out the applicability assessment only once risks unnoticed growing out of or into scope. The assessment should therefore be renewed and documented at every relevant change.

How should an NIS2 scope analysis be documented?

The documentation should record which activity is assigned to which sector, which size indicators were used, and who is responsible for the assessment. It should be approved by executive management and updated at relevant structural changes. This documentation also serves as evidence towards authorities and business partners.

Sources

1. [NIS-2-regulierte Unternehmen](https://www.bsi.bund.de/DE/Themen/Regulierte-Wirtschaft/NIS-2-regulierte-Unternehmen/nis-2-regulierte-unternehmen_node.html)Bundesamt für Sicherheit in der Informationstechnik (BSI)

## Frequently asked questions

### Was ist die NIS2-Registrierungslücke?

Die deutsche Bundesregierung ging von rund 29'500 registrierungspflichtigen Unternehmen aus. Bis zur ursprünglichen Frist hatten sich nur etwa 11'500 Betreiber registriert, aktuell fehlen rund 10'000 Meldungen. Die Regierung wertet dies nicht als Beleg für Nichtregistrierung, sondern auch als mögliche Überschätzung der ursprünglichen Zahl.

### Welche Kriterien entscheiden, ob ein Unternehmen von NIS2 betroffen ist?

Beide Kriterien müssen erfüllt sein: die Zugehörigkeit zu einem der 18 gelisteten Sektoren, etwa Energie, Verkehr, Gesundheit oder IT-Dienste, und das Erreichen bestimmter Grössenschwellen. Eine Zuordnung durch eine Behörde erfolgt nicht.

### Müssen sich Schweizer Unternehmen mit NIS2 befassen?

Schweizer Unternehmen mit Tochtergesellschaften, Niederlassungen oder wesentlichen Kundenbeziehungen in der EU sollten prüfen, ob sich eine Betroffenheit über diese Verbindung ergibt. Für die Schweiz selbst wird parallel ein eigenes Cyberresilienzgesetz diskutiert.

### Warum genügt eine einmalige Prüfung der NIS2-Betroffenheit nicht?

Sektorzuordnung, Konzernstrukturen und Schwellenwerte können sich im Zeitverlauf ändern. Wer nur einmal prüft, riskiert, unbemerkt aus dem Anwendungsbereich herauszuwachsen oder hineinzuwachsen.

### Wie sollte eine NIS2-Scope-Analyse dokumentiert werden?

Die Dokumentation hält fest, welche Tätigkeit welchem Sektor zugeordnet wird, welche Grössenindikatoren verwendet wurden und wer für die Beurteilung verantwortlich ist. Die Geschäftsleitung gibt sie frei, und sie wird bei relevanten Änderungen aktualisiert.