Article 27 · entity registry · ENISA
Designation and registration are two different obligations and they are done in that order, because the registration form asks for the representative. Article 27 requires a defined set of entity data to reach the competent authority of the Member State where your representative is established, and the Member States pass part of it to ENISA. Nothing about it is difficult. What makes it slow is that one field, the public IP ranges, has to come from your infrastructure team, and nobody asks them early enough.
Entity dataSectorMember StatesIP rangesThree months
Four of them you already have on a letterhead. The fifth, the public IP ranges used to provide the service, is the one that turns a one-hour task into a two-week one if you ask for it late.
| Field | What to put | Where it goes wrong |
|---|---|---|
| Legal name | Exactly as in your commercial register | Using the brand instead of the company |
| Trading names | Any name the service is sold under in the Union | Omitting a product brand the authority then cannot match to you |
| Address | Registered seat outside the Union, plus the representative's address | Giving only one of the two |
| Contact details | An email and phone that are answered | A generic inbox nobody reads |
| Sector and subsector | From Annex I or II, matched to the real service | Choosing the flattering category instead of the accurate one |
| Member States served | Every state where the service is offered | Listing only the state of registration |
| Public IP ranges | The ranges used to provide the service | Sending stale ranges, or none because nobody asked engineering |
Most transpositions require notification within three months of the change. The directive leaves the detail to Member States, so check the one you registered in.
New regions, new providers, new anycast ranges. Put a quarterly reminder against this field specifically; it is the one that goes stale first.
People leave. A registration pointing at a former employee's inbox is worse than no registration, because it looks maintained.
Launching a managed service or a marketplace changes your sector entry. Update it when the service goes live, not at renewal.
The reference the authority returns is what you quote in vendor questionnaires and audits. Store it with the mandate.
Provide the entity data, choose the sector honestly, obtain the IP ranges and submit in your own name.
Sign the mandate, appear as your representative in the registration, hold the documentation and answer what the authority sends.
Registers the entity, supervises, and passes the required part of the information to ENISA.
Maintains the registry of entities for the categories the directive assigns to it. You do not deal with ENISA directly.
Files your incident reports for you. That duty stays inside your organisation, with the 24 and 72 hour deadlines.
Legal advice on a national transposition. Where a state has added its own requirements, a local firm is the right call.
| Step | Who | Typical time |
|---|---|---|
| Intake call and annex check | You and us | 30 minutes |
| Mandate signed | Us | Within 24 hours |
| Entity data assembled | You | A few hours |
| Public IP ranges obtained | Your infrastructure team | Two days to two weeks |
| Submission | You, naming us | Same day once complete |
| Confirmation from the authority | The authority | Varies by Member State |
The only step with a real unknown is the fourth. Start it on day one and the rest of the timetable holds.
This one field decides your timetable, so it deserves its own section. The request is simple, the answer rarely is, and the reason is that nobody has ever had to write it down before.
| Ask for | Why | Where it hides |
|---|---|---|
| Ranges you own | Assigned to your organisation and announced by you | The regional registry account, often held by one person |
| Ranges you use from providers | Cloud and hosting allocations serving European customers | Provider consoles, one per account and region |
| Anycast and CDN ranges | Used to deliver the service, even if not owned | The CDN dashboard, rarely inventoried |
| Ranges no longer used | To exclude them, so attribution stays accurate | Old documentation nobody has pruned |
| A named owner | Someone who updates the list when it changes | Usually nobody, until you assign it |
Ask on the day you sign the mandate, not on the day you submit. Two days is a good outcome, two weeks is normal, and the difference is entirely down to how early the question is asked.
The authority returns a confirmation. Store it with the mandate; it is what vendor questionnaires ask for.
Clarifications, sector questions, sometimes a survey. It arrives at the representative and reaches you the same working day.
Annex I entities can be inspected without a trigger. Being registered and reachable is what makes that a routine exercise instead of an incident.
New Member States, new services, new IP ranges. Most transpositions give three months.
Annual, on one date with your other designations if you hold them with us.
What does not happen is a certificate of NIS2 compliance, because no such thing exists. Registration proves you are on the register; compliance is demonstrated by your Article 21 measures when someone asks to see them.
Sign the mandate first, because the registration form asks for the representative. Assemble the entity data, choose the sector honestly, list every Member State where the service is offered, and get the public IP ranges from engineering on day one rather than on the day you submit. Then send it through the national channel of the Member State where your representative is established, store the confirmation reference with the mandate, and put a quarterly reminder against the IP ranges, because they are what goes stale first. Changes are notified in most transpositions within three months.
Nothing in that list is difficult. What makes registrations late is starting them in the wrong order and asking for the infrastructure data at the end instead of at the beginning.
Five failures, all of them cheap to avoid and all of them seen more than once.
The form asks for the representative. Beginning without one wastes a week and produces a half-finished submission.
Picking a lighter category than the service deserves misroutes supervision and reads badly when the truth surfaces.
The field asks for every Member State where the service is offered, not the one where you filed.
Stale ranges are worse than none: they attribute someone else's infrastructure to you.
Without a named owner the entry decays quietly, and the first sign is a question you cannot answer.
Assign the fifth one on the day you register. It costs nothing and it is the only thing that keeps the other four fixed.
Mandate, then data, then submission, then maintenance. Five fields, one of which depends on engineering, and a confirmation reference worth storing where procurement can find it. If your registration is complete and current, an inspection starts as an administrative conversation. If it is missing or stale, the same inspection starts by asking why you were unreachable, and that is a much worse first question.
No. Registration puts you on the register and makes you reachable. Compliance is your Article 21 measures, demonstrated when someone asks to see them. The two are related and they are not the same, and conflating them is how companies end up surprised during their first inspection.
The register is held by the authority, not published as a directory. What your customers see is the reference you give them in a questionnaire, together with the representative's certificate. That pair is what unblocks procurement, and it is worth keeping both in the same folder as the mandate so that answering takes five minutes rather than five days.
NIS2 is a directive, which means each Member State has written its own version of the registration procedure inside the frame the directive sets. The fields are the same everywhere because Article 27 lists them, but the channel, the format and the confirmation differ. Some states use a web portal with an account, others a signed form, a few accept submissions only from an entity established locally, which is one more reason the representative comes first. Deadlines for notifying changes are usually three months, but not universally, and a handful of states have added their own reporting of contact-point changes on top.
None of this changes what you prepare. It changes who you send it to and in what shape, and it is the reason we ask which Member State you have chosen before assembling anything. If a state has added requirements beyond the directive, that is a question for a local firm, and we say so rather than guessing on your behalf.
No. The mandate makes you reachable; the registration puts your entity in the authority's register. Both are required and the mandate comes first.
Entity name, trading names, address, contact details, sector and subsector, the Member States where you offer services and your public IP ranges.
So an authority can attribute infrastructure to an entity during an incident. It is the field most often supplied late or stale.
With the competent authority of the Member State where your representative is established, through that state's national channel.
No. You register once and list the states served in the registration itself.
In most transpositions within three months of the change. NIS2 is a directive, so check the state you registered in.
No. You deal with the national authority, which passes the required information to ENISA for the categories concerned.
Correct it. A wrong sector misroutes supervision and looks careless when it surfaces during an inspection.
The submission is made in your name. We provide our details, help assemble the pack and answer what comes back.
The reference the authority returns on registration, which is what vendor questionnaires ask for.
The registration itself is a filing with the authority. Fees, where they exist, are set nationally.
Tell the authority and terminate the mandate deliberately, rather than letting the entry go stale.
Yes. The registration duty applies to the entities in Article 26(1)(b) regardless of which annex they sit in.
Not at all in procedure, but entirely in practice: an unregistered entity reporting an incident starts the conversation from a bad place.
We hold the mandate and the documentation and remind you before renewal. The data itself is yours to update.
Twenty-four hours for the mandate, then as long as your infrastructure team needs for the IP ranges. That is the honest answer.
€490 a year for the designation and the ongoing desk. The registration filing itself has no charge from us.
Incident reporting, Article 21 implementation, penetration testing and legal advice on national transpositions.
Related: the designation · when NIS2 reaches you
Europe Services, SE in Prague signs within 24 hours and appears as your representative in the Article 27 registration, with the data pack assembled together.
Request this service