--- title: "NIS2: what machine builders must catch up on | logiccloud" description: "BSI registration was due on 6 March, the extension on 31 July. Both are gone — the obligation is not. What to do now, in the order that actually works." url: https://logiccloud.com/en/nis2-missed-what-machine-builders-must-catch-up-on/ language: en-GB updated: 2026-09-12 --- [← Back to overview](https://logiccloud.com/en/knowledge/) Knowledge · 12 September 2026 · 4 min read # NIS2 missed? What machine builders have to catch up on BSI registration was due on 6 March, the extension on 31 July. Both are gone — the obligation is not. What to do now, in the order that actually works. By **Bernhard Böhrer**, CEO ![NIS2 missed? What machine builders have to catch up on](https://logiccloud.com/_astro/nis2-welche-maschine-ist-betroffen.BbeKx3fs_Z2ekkOq.webp) If you have not registered with the BSI, the short answer is: **do it now.** The statutory deadline passed on 6 March 2026, and the extension the BSI granted ran out on 31 July 2026. A missed deadline does not end the obligation — it turns non-registration into a fineable offence in its own right. And the reporting duties apply whether you are registered or not. You are not alone in this. Of roughly 29,500 affected companies in Germany, about 11,500 had registered by the March cut-off. The gap was still there after the extension. ## Does this even apply to my company? The German NIS2 implementation act (NIS2UmsuCG) has been in force since **6 December 2025**, with no transition period. It reaches far beyond classic critical-infrastructure operators. As a rule of thumb: companies in one of the sectors listed in Annexes 1 and 2 of the BSIG — which include manufacturing, machine building among it — with **at least 50 employees or more than €10 million in revenue or balance sheet total** are frequently in scope. The rule of thumb does not replace the check. The BSI provides a free, anonymous scope assessment; it takes a few minutes and is the right first step before anyone sets up a project. ## NIS2 and the CRA are two different things These get mixed up regularly, which costs time and puts effort in the wrong place. Both affect machine builders, but at different points: | | NIS2 / NIS2UmsuCG | Cyber Resilience Act | | ---------------- | ---------------------------------------- | -------------------------------------------- | | Regulates | your company as an entity | your product on the market | | Concerns | your own IT and OT | the machine you ship | | In force since | 6 December 2025 | reporting duties since 11 September 2026 | | Fully applicable | immediately, no transition period | 11 December 2027 | | Core duty | risk management, registration, reporting | handle vulnerabilities, ship updates, report | In short: **NIS2 asks how safely you work. The CRA asks how safe what you sell is.** Plan them together and you do the work once. What the CRA requires in concrete terms is on our [Cyber Resilience Act page](https://logiccloud.com/en/cra/). ## What to do now, in this order 1. **Check whether you are in scope.** The BSI self-test, a few minutes. Document the result — even a “not in scope” needs to be evidenced later. 2. **Register.** Through the BSI’s reporting and notification portal (`muk.bsi.bund.de`). It needs an ELSTER organisation certificate, and getting one takes time, so start that first. 3. **Become able to report.** Section 32 BSIG requires, for a significant security incident, an early warning **within 24 hours**, a qualified notification **within 72 hours** and a final report **within one month**. These clocks start when you learn of the incident — not when you fix it. 4. **Document your risk management.** Section 30 BSIG names ten areas of measures, from risk analysis through incident handling and business continuity to access control and supply chain security. What matters is evidence: a decision that exists only in someone’s head cannot be defended afterwards. 5. **Involve the management board.** Section 38 BSIG makes this a board matter: management must approve the measures, monitor their implementation and attend training. This one cannot be delegated. ## And what does this have to do with the controller? More than it first looks. Three of the ten areas of measures come down to being able to say the same things about your own OT that you can say about your IT: - **Which software runs where?** A plant whose software version nobody knows cannot be written into a risk analysis. - **How does a security update get there?** If the answer is “somebody drives out”, the 24-hour clock has run out before the first measure takes effect. - **Who changed what, and when?** Without roles, permissions and a log there is no evidence, only recollection. Those three questions are exactly what [logiccloud ORCHESTRATE](https://logiccloud.com/en/products/orchestrate/) answers: record devices and software versions centrally, roll out updates in a controlled way — with rollback when something goes wrong — govern access through roles, and log changes. The building blocks are IDENTIFY, CONTROL, UPDATE, MONITOR and AUDIT, and they work with existing systems too, not only with controllers from logiccloud. That does not make you NIS2-compliant by itself — compliance is an organisational achievement, not a product feature. It does answer the questions where technical evidence otherwise falls apart. ## The next step If you cannot say with confidence which software version is running on which plant in the field right now, start there. Everything else in NIS2 builds on that answer. [Talk to us about your installed base](https://logiccloud.com/en/contact/) — we will look together at which evidence your current setup can actually produce. --- **Sources, checked on 12 September 2026** - Statutory text of sections 30, 32, 33 and 38 BSIG: - BSI registration, deadlines and the extension to 31 July 2026: - Registration status (approx. 29,500 affected, approx. 11,500 registered): - What applies when registration was missed: This article is a technical explainer, not legal advice. ## More articles [All articles](https://logiccloud.com/en/knowledge/) - Knowledge · 14 September 2026 ### [CRA reporting duty: 24 hours, from the moment you know](https://logiccloud.com/en/cra-reporting-duty-24-hours-from-awareness/) Article 14 of the Cyber Resilience Act has applied since 11 September 2026 — including to machines already in the field. Which deadlines run, and what you need to answer them. - Knowledge · 12 September 2026 ### [Margo before its first release: what machine builders gain](https://logiccloud.com/en/margo-before-the-first-release/) Preview Release 2 is out and the first general release is planned for 2026. What the open edge standard changes in practice — and what you can do today. - Knowledge · 12 September 2026 ### [Siemens is virtualising the PLC too. Who owns the software?](https://logiccloud.com/en/virtual-plc-who-owns-the-software/) Siemens put the S7-1500V centre stage at Hannover Messe 2026. The virtual PLC is settled. The follow-up question is not: hardware-free is not vendor-free.