NIS2 registration: who registers where

Two routes in the directive

NIS2 contains two registration rules. Article 3(3) and (4) apply to all essential and important entities and to entities providing domain name registration services. Member States had to establish a list of these entities by 17 April 2025 and review it at least every two years. To build that list, they require entities to submit certain details to the competent authority.

Article 27 adds a second route for certain digital providers: DNS service providers, TLD name registries, entities providing domain name registration services, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines and social networking platforms. ENISA keeps a registry of these entities on the basis of what the national authorities pass on. These providers fall under the Member State of their main establishment in the Union (Art. 26(1)(b)).

In both cases you submit your details to a national body, not to ENISA. Most Member States have built one portal that covers both routes.

What you have to submit

Under Article 3(4), entities submit at least the following:

• the name of the entity,
• the address and up-to-date contact details, including email addresses, IP ranges and telephone numbers,
• where applicable, the relevant sector and sub-sector referred to in Annex I or II,
• where applicable, a list of the Member States where they provide services falling within the scope of the directive.

Digital providers under Article 27(2) submit more: the type of entity, the address of the main establishment and of any other legal establishments in the Union, the contact details of their representative where they have designated one, the Member States where they provide services, and their public IP ranges.

National laws often ask for further details. Typical additions are the classification as essential or important, figures on staff and turnover, the main establishment, and a contact point that can be reached around the clock. Prepare these details before you open the portal. Gathering IP ranges and confirming the group structure tends to take longer than filling in the form.

Deadlines

The directive sets three dates:

In practice these dates only bind you once your national law applies. Many Member States transposed late and set their own first deadlines, usually a few months after the law entered into force. The transposition overview lists the national laws and links to our country versions, which explain the national portal and deadline in detail. Organisations that come into scope later, for example by growing past the size threshold, have to register within the period their national law sets.

Groups and several countries

Registration follows the legal entity and the jurisdiction rules of Article 26. A group with a parent company in one Member State and subsidiaries in others usually registers each in-scope subsidiary in the country where it is established. The exceptions are the digital providers listed in Article 26(1)(b), which register only in the Member State of their main establishment. Providers of public electronic communications fall under each Member State in which they provide their services (Art. 26(1)(a)).

For groups this means: draw up a list of all legal entities, assess scope for each one, note the responsible Member State and track the registrations in one place. National portals often require a national identifier or electronic identity for the legal representative, which can take weeks to obtain for a foreign director. Start early.

Practical tips

• Document the scope assessment first. The registration asks for your sector and category. If you are unsure, the scope page explains the test.
• Name a contact point that works. Use a function mailbox and a phone number that is staffed outside office hours, not the personal address of one person.
• Keep the details current. Two weeks for changes is short. Add the registration to your processes for mergers, relocations and changes of management.
• Keep proof. Save the confirmation of submission. It is your evidence if an authority asks.
• Check the reporting access. In many countries the same portal is used for incident reporting. Test your access before you need it.

Whether your registration is in order is one of the questions in the NIS2 scoring. A missing registration is one of the easiest infringements for an authority to detect.