NIS2 registration and authority notification

Start with two separate questions: whether the organisation belongs on a Member State list under Article 3, and whether it is one of the Article 27 entity types whose information flows into the ENISA registry, but not its IP ranges.

Article 3 covers the Member State list of essential and important entities and entities providing domain name registration services. Member States had to establish that list by 17 April 2025 and must review and, where appropriate, update it at least every two years. That deadline governs the Member State list; it is not a universal initial filing deadline for every entity.

Article 27 covers DNS service providers, TLD name registries, entities providing domain name registration services, cloud computing providers, data centre providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, and social networking services platforms. Member States had to require those providers to submit the listed information by 17 January 2025. The operational filing route still depends on national implementation.

For Article 3 list purposes, NIS2 requires at least the entity name, address, up-to-date contact details, email addresses, IP ranges, telephone numbers, relevant Annex I or Annex II sector and subsector where applicable, and the Member States where services in scope are provided where applicable.

For Article 27 providers, NIS2 requires the entity name, relevant sector, subsector and type of entity where applicable, the main establishment and other Union legal establishments or EU representative, up-to-date contact details, Member States where services are provided, and IP ranges.

NIS2 leaves national implementation and competent-authority routing to Member States. Article 8 requires Member States to designate competent authorities and single points of contact, and Article 10 requires CSIRTs. Registration, supervision, and incident notification can therefore use different authorities, portals, and forms in the same country.

A practical registration file should name the official national route checked on the filing date, the sector and legal entity it covers, any authentication or representative requirement, and a backup contact if the portal fails. Do not carry a portal statement from one Member State into another or assume a past implementation status is still current.

National implementation is still uneven. On 8 July 2026, the European Commission said that Ireland, Spain, France, and the Netherlands had not notified full transposition and referred them to the Court of Justice of the European Union. That procedural status does not establish the filing rule for a particular entity: check the current national legislation, authority page, and portal before acting.

For information submitted for the Article 3 list, entities must notify changes without delay and in any event within two weeks of the change. Article 27 providers must notify the competent authority of changes to their Article 27 information without delay and in any event within three months of the change.

Use separate update clocks. A change in IP ranges, contact details, Member States served, main establishment, representative, or sector classification can reopen the registration record and may trigger a different national authority route.

Review this checklist before submitting, updating, or closing a NIS2 registration decision. The goal is a record that a later reviewer can trace from service facts to EU article, Member State route, authority contact, and submission evidence.

Do not use this checklist to infer penalties, registration thresholds, or country deadlines that are not stated in the cited EU or national source.