How many organisations have registered under NIS2? Figures by country

Germany is the first country to publish detailed NIS2 registration figures: by 30 September 2026, 20,141 organisations had registered with the BSI. That is roughly two thirds of the organisations estimated to fall under the law. The Netherlands is well behind.

How many organisations have registered in each country?

Country	Registered	As of	Estimated in scope
Germany	20,141	30 September 2026	approx. 29,500
Italy	over 20,000 (on the NIS list)	September 2026	–
Belgium	approx. 4,000	autumn 2025	approx. 4,500
Netherlands	2,942	14 August 2026	over 8,000

Germany. The BSI publishes the figures every quarter. Of the 20,141 registrations, 6,837 are besonders wichtige (essential) and 13,252 wichtige (important) entities. Including 232 branch offices, the total is 20,373. Most registrations come from manufacturing (4,739), healthcare (3,703), energy (2,794) and digital infrastructure (2,674). At the original deadline of 6 March 2026, the count stood at around 11,500. The BSI has also already received 1,272 initial incident reports.

Belgium. One year after the Belgian NIS2 law took effect, the CCB reported around 1,500 essential and 2,500 important entities, out of an estimated 4,500 or so. According to the CCB, this means the vast majority of organisations in scope have been identified.

Netherlands. The Cyberbeveiligingswet has applied since 15 August 2026 to more than 8,000 organisations. On 14 August, NCSC figures showed 2,942 registrations in the entity register, or 4,144 when affiliated organisations are included. No more recent figures have been published.

Italy. Based on the registrations, the ACN draws up a list of NIS entities. More than 30,000 organisations submitted information; over 20,000 of them are on the list, including more than 5,000 essential entities, according to the ACN. In September 2026, the ACN updated the list with more than 2,000 late registrations.

As far as we know, other member states have not yet published registration figures.

What do these figures tell us?

Even in Germany, where registration is furthest along, about a third of organisations are still missing. In the Netherlands, fewer than half had registered when the law took effect. Registration is the first legal obligation: without it, the regulator does not know your organisation falls under NIS2, and failing to register is itself a breach.

The German sector figures also show that NIS2 is not just about IT. The largest group is manufacturing, followed by healthcare and the food sector (1,986).

What has Belgium learned after two years of NIS2?

Even in Belgium, seen as a front-runner, the uncertainty has not gone away. That was the conclusion of an ITdaily round table on two years of NIS2. Companies are still unsure whether NIS2 applies to them, said Ulrich Seldeslachts (LSEC). According to the participants, the topic has become less clear rather than clearer for SMEs and municipalities.

Two other lessons from Belgium:

• From paper to proof. “All the boxes have been ticked, now it is time for evidence,” says Ron Mukherjee (ESET). In some places, compliance exists only on paper.
• The supply chain counts. According to Seldeslachts, a typical NIS2 organisation has three to four thousand suppliers. Suppliers that cannot show their security is in order can no longer do business with large companies, the participants said.

What does this mean for your organisation?

• Check whether you fall under the Cyberbeveiligingswet and whether you have registered via mijn.ncsc.nl. Include subsidiaries and branches in other EU countries: they may need to register there separately. If in doubt, document why the law does or does not apply to you.
• Registration is a start, not the finish line. The duty of care, incident reporting and training for board members follow.
• Make responsibility explicit. The board is accountable for compliance.

Want to know where your organisation stands? See our support for NIS2 compliance.