NIS 2 registration deadline extended to July 2026 for DNS providers

Germany’s implementation of the EU’s NIS 2 Directive has hit a snag, with fewer DNS service providers registering than expected. The BSI has responded by pushing back the compliance deadline to the end of July 2026, offering a four-month extension for affected entities to complete mandatory registration steps without penalty.

The NIS 2 Directive, adopted by the EU in December 2022, broadens the scope of cybersecurity regulations to include more sectors and introduces stricter requirements for risk management and incident reporting. DNS service providers are classified as "essential entities," subjecting them to the directive’s most stringent obligations regardless of their size. Germany transposed the directive into national law on 6 December 2025, triggering a three-month registration window that originally closed on 6 March 2026.

What the extension means

The BSI’s decision to extend the deadline follows a two-stage registration process that has proven more complex than anticipated. Entities must first register via the "Mein Unternehmenskonto" digital service, then complete a second step by enrolling in the BSI’s dedicated portal for cybersecurity incident reporting. The portal also facilitates secure information exchange between regulated organizations and authorities.

DENIC, Germany’s country-code top-level domain registry, has advised its members that DNS service providers may fall under NIS 2’s scope. The registry’s assessment, however, stops short of legal advice, leaving individual companies responsible for determining their compliance obligations. To assist with this, the BSI offers a non-binding impact assessment tool on its website, allowing organizations to evaluate whether they are subject to the directive.

Why uptake has been slow

Industry observers attribute the low registration numbers to several factors. The two-stage process, while designed to enhance security, has created friction for smaller providers unfamiliar with bureaucratic procedures. Additionally, the distinction between "essential" and "important" entities under NIS 2 has led to confusion, with some companies uncertain about their classification. The BSI’s extension aims to address these challenges by providing more time for outreach and education.

What to watch

The BSI’s extension does not alter the underlying requirements of NIS 2 but signals a pragmatic approach to enforcement. Future deadlines may face similar adjustments if compliance rates remain low, particularly among smaller providers. Meanwhile, other EU member states are monitoring Germany’s implementation closely, as their own transposition of NIS 2 could face similar challenges. For DNS providers, the next six weeks will be critical for ensuring all registration and organizational measures are in place before the new deadline.