Art.3.4NIS2Last reviewed 24 September 2026

NIS2 Art.3.4: Entity Registration with National Authorities

Before anything else, NIS2 needs to know who you are. If your organisation falls within scope, you must register with your national competent authority by providing basic identifying information. This is the administrative foundation that allows regulators to maintain oversight of all regulated entities in their jurisdiction.

Start a 10-question NIS2 readiness check to identify priorities. Use the reference guides and workbook for a wider review.

Start my free NIS2 assessmentNo account · No credit card · Save when useful

Requirement summary

So that each Member State can keep its list of essential and important entities, entities must give the competent authority at least their name; their address and up-to-date contact details, including email addresses, IP ranges and telephone numbers; where applicable, the relevant sector and subsector in Annex I or II; and, where applicable, the Member States where they provide services in scope. Under Art. 3(5), changes to these details must be notified without delay and in any event within two weeks.

Check the source wording and scope in NIS2 Directive on EUR-Lex. The guidance below explains how to approach a review.

In Plain Language

The registration covers organisational basics (name, address, sector classification), contact details for cybersecurity communications, and technical information like your IP address ranges and domain names. Authorities use this technical data to map the digital footprint of regulated entities and to support security scanning and incident attribution.

First you need to work out whether NIS2 applies to you at all, based on the sector definitions in Annexes I and II and the size thresholds. If it does, register before the national deadline and keep the information updated whenever anything changes.

How to Implement

Run a scoping assessment first. Review the sector definitions in Annexes I (essential entities) and II (important entities), apply the size thresholds (generally medium and large enterprises, with some exceptions), and check whether any national implementation provisions affect your classification.

Pull together the required registration data: legal entity name and registration details, your sector, subsector, and entity type classification, addresses of your main establishment and any other EU establishments, contact details for cybersecurity communications (email, phone, designated contact persons), all IP address ranges used by the organisation, and your domain name registrations.

Submit through whatever mechanism your national competent authority has set up - typically an online portal or structured form. Make sure you hit the national deadline.

Put a process in place to keep the registration current. Define what triggers an update: changes to legal entity details, new contact information, acquisition of new IP ranges or domains, changes to your sector classification, or any expansion or reduction of EU establishments.

Assign a specific person - your compliance officer or IT governance lead - to own the registration. Set calendar reminders for periodic review even if nothing has changed.

Keep records of the initial registration and all subsequent updates. If an auditor asks to see your registration history, you want it readily available.

For organisations operating across multiple Member States, determine your primary jurisdiction for NIS2 and understand any additional registration requirements elsewhere.

Evidence to review

NIS2 scoping assessment documenting entity classification
Registration submission confirmation from the competent authority
Current registration information on file
Process for maintaining and updating registration details
Records of any registration updates submitted

Common Mistakes

Organisation has not assessed whether it falls within NIS2 scope
Registration submitted with inaccurate or incomplete information
IP address ranges and domain names not comprehensively documented
No process for updating registration when information changes
Multi-jurisdictional registration obligations not identified or addressed

Related Controls Across Frameworks

Framework	Control ID	Relationship
GDPR	GDPR Art.30: Records of Processing Activities	Related
ISO 27001	ISO 27001 A.5.1: Policies for information security	Related

Frequently Asked Questions

What happens if we do not register?

Non-registration is itself a compliance violation that can trigger enforcement action. Competent authorities have other ways to identify in-scope entities, so skipping registration does not make you invisible - it just adds a non-registration penalty on top of whatever substantive non-compliance they find.

How do we determine if we are an essential or important entity?

It comes down to three factors: your sector (listed in Annexes I and II), your size (generally 50 or more employees, or over 10 million euros in turnover/balance sheet, based on the SME Recommendation criteria), and any specific designations by your Member State. Some entities are essential regardless of size - for example, trust service providers and DNS providers. Your national competent authority can provide specific guidance for your situation.

Track NIS2 compliance in one place

Start a 10-question NIS2 readiness check to identify priorities. Use the reference guides and workbook for a wider review.

Start Free Assessment

Start without an account · Sign up only to save

Start my free NIS2 assessment