NIS2 Deadlines October 2026: What Regulators Check After Registration

On 3 October 2026, Poland's six-month window to apply for entry in the national register of key and important entities closed. Germany's BSI registration window has been extended more than once and is now at or past its latest date. Italy's first basic-measures deadline lands this month. If you advise clients in any of these countries, the question has changed. It is no longer "have you registered?" It is "what will the regulator ask for next?"

This is the moment NIS2 deadlines October 2026 stop being a calendar item and become an evidence problem.

NIS2 deadlines October 2026: what actually closed

Three national regimes hit milestones within weeks of each other. They are not synchronised, and that is the point. A client with entities in Germany, Poland and Italy now has three different clocks.

Poland. The amendment to the National Cybersecurity System Act (the ustawa o krajowym systemie cyberbezpieczeństwa, KSC) entered into force on 3 April 2026. Key and important entities had until 3 October 2026 to apply for entry in the register. The next hard dates are 3 April 2027 for implementing the new obligations and 3 April 2028 for the first mandatory audit of key entities. According to the Ministry of Digital Affairs, administrative fines for most obligations can only be imposed from 3 April 2028.

Germany. The NIS2 Implementation Act rewrote the BSI Act (BSIG). The original registration deadline was 6 March 2026. The BSI then granted extended periods, and published sources disagree on the latest end date: some cite 31 July 2026, others 30 September 2026. Do not rely on either. Check the BSI portal for your client's status. What is not in dispute is that the BSI has said the registration duty still applies and has reserved fine-backed enforcement steps. Fines can reach €10 million or 2% of worldwide annual turnover, whichever is higher.

Italy. Under Legislative Decree 138/2024 and ACN determination 379907/2025, entities listed in 2025 must have the basic security measures in place 18 months after they received ACN's inclusion notice. Commentary puts that date in October 2026, and several sources cite 31 October. The arithmetic matters here: ACN notices went out on 12–13 April 2025, which would put 18 months in mid-October. Read the date on the client's own notice. Entities listed for the first time in 2026 have until 31 July 2027 under determination 127434/2026.

Registration was the easy part

A register entry proves one thing: you exist and you declared yourself in scope. It says nothing about whether your controls work.

Regulators know this. The BSI has been explicit that registration is only the first step and that technical and organisational measures, incident reporting and a risk management system follow. Italy's ACN is moving from declaration to verification: the baseline set covers 37 measures and 87 requirements for important entities and 43 measures and 116 requirements for essential entities, according to published commentary on the ACN annexes.

For a consultant, the shift is practical. Your client's first question used to be "are we in scope?" The second is now "can we show what we do?" A binder of policies no one follows will not survive an inspection. A dated, minuted, tested set of records will.

What the regulator will ask for first

Across all three jurisdictions, the early requests follow a pattern. Expect these, in roughly this order:

1. Proof of registration and an accurate entity profile. Wrong sector, wrong size category or a stale contact point is the cheapest finding to avoid. In the Netherlands, for example, changes to registered details must be reported within 14 days.
2. Board-level accountability. Germany makes management bodies personally liable under § 38(2) BSIG. Italy's Article 23 of Decree 138/2024 requires management to approve and oversee the measures and to follow cybersecurity training. Dutch boards must also be trained under the Cbw. A dated board resolution and training certificates are the evidence.
3. Incident procedure with the three clocks. The 24-hour early warning, 72-hour notification and one-month final report apply in every one of these regimes. Italy's reporting obligation has been live since January 2026 for the 2025 cohort.
4. An asset and service inventory. It must match what the client declared in the portal. Mismatches are how a regulator finds understated scope.
5. Evidence that measures operate. Backup restore tests with dates. Access reviews. Vulnerability handling records. Supplier contracts with security clauses.

Where there is still no law

Not every client sits in a country with a live regime. France and Spain have not transposed NIS2, and on 8 July 2026 the European Commission referred both to the Court of Justice of the EU, together with Ireland and the Netherlands, asking for a lump sum and daily penalties. The Netherlands has since brought the Cyberbeveiligingswet into force on 15 August 2026, with registration through the NCSC.

In France, the Résilience bill has not been promulgated, and reports indicate it was taken off the parliamentary agenda in early October. ANSSI's ReCyF framework remains a working document. In Spain, the draft law approved in January 2025 is still before parliament.

None of this means a French or Spanish client can wait. Their German, Dutch and Italian customers are already sending Article 21 questionnaires down the supply chain. The obligation arrives through the contract, not the statute.

The Article 21 baseline is the common denominator

Every national law implements the same ten risk-management measures from Article 21(2) of the directive. That gives you one assessment you can reuse across borders, with national overlays on top.

The workable approach for a multi-country client:

• Run one gap analysis against Article 21(2) and map it to each national baseline.
• Keep one evidence repository, organised by measure, not by country.
• Maintain a per-country calendar for registration updates, reporting contacts and audit dates.

Our guides on the gap analysis process and on the evidence regulators actually ask for cover the method. For country detail, see the posts on Poland, the Netherlands, Italy and France and Spain.

Why the sequencing trips up MSPs

The failure pattern is predictable. A provider handles registration for a client in one country, files it, and moves on. Six months later the client's Italian subsidiary has a deadline the provider never calendared, because the notice went to a mailbox nobody monitors. The notice date, not the calendar year, drives the Italian clock.

The same applies to contact points. Every one of these regimes expects a reachable person for the regulator and the CSIRT. A departed employee listed as the contact point turns a routine message into a missed obligation.

What to do this week

Pick the client with the most exposure and do four things.

First, confirm registration status in each country where they operate, and write down the date shown, not the date you assume. Second, find the Italian inclusion notice and calendar the 18-month date from it. Third, check that the board has a dated approval of the security measures on file. Fourth, test the incident procedure with a 24-hour tabletop and record the result.

If you want a structured starting point, a NIS2 readiness scan maps a client's current posture against the Article 21 measures in a few minutes and shows where the evidence gaps are. It is a readiness assessment, not a statement of compliance, and the regulator's own requirements still govern.

The registration windows were the warm-up. The inspections will test whether the controls were ever real.