How do I check whether I am registered for NIS2?

There is no public list of NIS2 entities, so you cannot look yourself up in a directory. To find out whether your organisation is registered, check internally whether someone has already registered it on your national authority’s platform. In France, where the law is not yet adopted as of 13 August 2026, only voluntary pre-registration with ANSSI is possible.

To check first whether you are in scope at all, see Who does NIS2 apply to?.

What the directive requires

Article 3(4) of Directive (EU) 2022/2555 requires essential and important entities to provide their national authority with at least:

• their name;
• their address and up-to-date contact details, including email addresses, IP ranges and telephone numbers;
• where applicable, their sector and sub-sector;
• where applicable, the list of Member States where they provide services covered by the directive.

Article 3(5) provides that any change is notified within two weeks. For certain digital service providers (cloud, DNS, data centres, managed services, MSSPs, platforms), Article 27 adds an EU-level registry kept by ENISA.

From this information, each Member State draws up a list of essential and important entities and reviews it at least every two years. That list is for the authorities: it is not published.

Registration depends on your country

Each Member State designates its own authority and registration process. Check the competent authority of the country where you are established; if you are a digital service provider covered by the main-establishment rule, check the country of your main EU establishment (see Does NIS2 apply to foreign subsidiaries?).

In France, ANSSI offers on its MesServices platform (formerly MonEspaceNIS2):

• an eligibility test, to find out whether your entity is regulated and in which category;
• a pre-registration service, available now.

Under the bill, registration would become mandatory once the French transposition law is in force. As of 13 August 2026, the bill has not yet been debated in plenary at the National Assembly.

How to check whether your organisation has already registered

1. Ask internally the people likely to have done it: management, IT, the CISO, legal or compliance. Registration usually goes through a personal account on the authority’s platform.
2. Look for a trace in mailboxes: account creation, submission confirmation.
3. Ask your group if you are a subsidiary: head office may have handled it centrally.
4. Ask your managed service provider if it supports you on compliance.
5. If in doubt, use the contact channels your national authority provides.
6. Keep a record of the steps taken and of who owns the platform account, so the information can be updated when something changes.

You were an operator of essential services under NIS1?

Being designated under NIS1 does not count as NIS2 registration. Your authority already knows you, but NIS2 has its own criteria and procedure. The directive lets Member States classify former operators of essential services as essential entities (Article 3(1)(g)), but that depends on national law. See NIS1 vs NIS2: what changed?.

Common mistakes

• Waiting to be contacted. The directive relies on entities providing their information to the authority (Article 3(4)), rather than on the authority finding them.
• Registering the same entity several times because nobody coordinated. Appoint a single owner for the process.
• Confusing registration with compliance. Registering says nothing about your security level: the risk-management measures listed in Article 21 are a separate matter.

Talk to an expert

Registered, or about to be? The next question is incident handling: Article 23 of NIS2 provides for an early warning within 24 hours of becoming aware of a significant incident. If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch. Still unsure about your status? See Not sure if NIS2 applies to you?.

Frequently asked questions

Is pre-registration binding?

It lets the authority identify you and keep you informed. Obligations come from the law, not from pre-registration. Doing it early, though, saves you from rebuilding everything in a hurry once the law is published.

Who should handle it internally?

Someone mandated by management, often the CISO, the IT director or the compliance lead. They need the administrative and technical information requested, such as IP ranges.

Do I need to update my registration?

Article 3(5) of the directive provides that any change to the information provided is notified to the authority within two weeks.

Is there one registration for the whole EU?

No. Registration happens with the authority of the relevant Member State. Certain digital service providers are also listed in an EU-level registry kept by ENISA (Article 27), based on information passed on by national authorities.

Can my MSP register on my behalf?

Article 3(4) places the obligation to provide this information on the entity itself. Your provider can help gather information; who may submit the declaration depends on the rules of your national platform, which your authority or legal adviser can confirm.