Compliance Deadlines Roadmap 2026 / 27 / 28: All EU/DACH Dates

All dates in chronological order

Short answer: The table below lists every milestone in this roadmap with its source and its status as at the article date of 16 August 2026 — the column 'Source / evidence' indicates for each row whether the date follows from a legal provision, is a forecast, or is a statement taken from the first version of this article; the dates 2 December 2027 and 2 August 2028 follow from Regulation (EU) 2026/1744 (Digital Omnibus AI), which has been in force since 27 July 2026.

Methodology

Short answer: This roadmap brings together the dated milestones, the event-triggered deadlines and the recurring obligations from six areas of law and classifies each dated milestone as at the article date of 16 August 2026 — as occurred, as pending, as a forecast date that has passed, or as a proposed date that was not in force as at the source review date.

It aggregates the deadlines arising from the GDPR, the EU AI Act (Regulation (EU) 2024/1689), the NIS2 Directive 2022/2555 plus the NIS2UmsuCG, the HinSchG, the AGG plus the EntgTranspG reform, and the EU Pay Transparency Directive 2023/970. The legal areas covered by this roadmap are EU law and its national transposition in Germany and Austria; Switzerland is not the subject of this article. Sources reviewed as of: 2 May 2026.

Four types of date must be kept apart. Statutory deadlines follow from a legal provision and carry a legal citation here. Forecasts concern national transposition measures whose date of application had not yet been fixed as at the source review date (AT EntgleichV, DE EntgTranspG reform); they are labelled as expected. Statements from the first version of this article carry no legal citation and are identified as such; by contrast, the two dates 2 December 2027 and 2 August 2028 are statutory deadlines now that Regulation (EU) 2026/1744 (Digital Omnibus AI) entered into force on 27 July 2026. Practice cycles assign recurring tasks to an interval and are expressly marked as a practitioner recommendation — a recommended annual cycle is not a statutory deadline. Which category applies to which date is shown row by row in the 'Source / evidence' column of the overview table.

What this fact base does not cover. The article is dated 16 August 2026; the fact base for the dates is dated 2 May 2026. The status of transposition of Directive (EU) 2023/970 has been added: in Germany no transposing act was in place as at 17 August 2026 — according to the Federal Government's reply of 8 July 2026 (BT-Drs. 21/7026), individual questions are still being clarified, after which the legislative procedure is to be initiated; in Austria no transposing act was in place either, and Petition 2/PET (28th legislative period) has been referred to the Committee on Labour and Social Affairs, where deliberations have not yet begun. Digital Omnibus AI — the procedure is complete: Regulation (EU) 2026/1744 has been in force since 27 July 2026; for every statement in this article on Annex III and Annex I, it follows that the high-risk obligations in Chapter III Sections 1 to 3 apply to Annex III systems from 2 December 2027 and to Annex I systems from 2 August 2028 (Art. 113 AI Act in that version). EntgleichV caveat: 1 July 2026 was a forecast, not a documented date of application. Elsewhere in this article, this caveat appears only as a short cross-reference.

The line 'Sources reviewed as of' governs the dates given; it may differ from the visible update date.

Deadlines 2026

Short answer: Of the dated 2026 milestones, 7 June 2026 (the Member States' transposition deadline under the Pay Transparency Directive) and 2 August 2026 (the general date of application of the AI Act) had occurred as at the article date of 16 August 2026; for 1 July 2026, only the forecast date has passed (EntgleichV caveat, see Methodology). The German NIS2 registration obligation has been running on an event-triggered basis since 6 December 2025 — the BSI points out that the statutory registration deadline has already expired — and there is no official date for the start of German supervisory practice. The only pending item is the date of application of the Austrian NISG 2026 on 1 October 2026.

NIS2: obligation to register with the BSI — three months from the point at which the entity criteria are met

Status: ONGOING OBLIGATION. Particularly important and important entities must register with the BSI no later than three months after the entity criteria are met (§ 33(1) BSIG 2025); the BSI points out that the statutory registration deadline has already expired. Anyone who has missed registration should complete it without undue delay — the registration obligation continues to apply, and the obligations under §§ 30 and 32 BSIG 2025 apply irrespective of registration.

What the provision requires. Particularly important and important entities as well as domain name registry service providers must register via a registration facility set up jointly by the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK). The information to be submitted comprises name, address and contact details, the relevant sector under Annex 1 or 2, the EU Member States concerned and the competent supervisory authorities (§ 33(1) BSIG 2025). The three-month period runs from the point at which an entity first qualifies, or again qualifies, as a particularly important or important entity — not from the entry into force of the BSIG on 6 December 2025; the BSI registration portal has been available in its second stage since 6 January 2026. The event-triggered three-month period and the two-week period for notifying changes are set out in the table 'Event-triggered deadlines'.

Who is covered. What matters first is the type of entity under Annex 1 or 2, and only then its size (§ 28(1) and (2) BSIG 2025); without assignment to a type listed in an annex, headcount and turnover figures do not support the classification. The thresholds and the entities covered irrespective of size are broken down in the FAQ 'From what size do the NIS2 obligations apply in Germany?'.

DE NIS2UmsuCG: supervisory and enforcement practice

There is no official date for the start of supervisory and enforcement practice under the BSIG 2025. The only documented facts are: the BSI registration portal has been available in its second stage since 6 January 2026, and the BSI points out that the statutory registration deadline has already expired. The obligations under §§ 30, 33(1) and 38 BSIG 2025 apply irrespective of this and have done since 6 December 2025; the reporting obligation under § 32 BSIG 2025 applies, under the last sentence of § 32(1), at the earliest from the point at which the reporting channel is set up.

What supervision measures against. Particularly important and important entities must take appropriate, proportionate and effective technical and organisational measures to prevent disruption to the availability, integrity and confidentiality of their IT systems; compliance must be documented (§ 30(1) BSIG 2025). The statutory minimum catalogue covers ten areas — including risk analysis and security policies, incident handling, business continuity, supply chain security, cryptography, access control and multi-factor authentication (§ 30(2) nos. 1 to 10 BSIG 2025). Documentation is therefore not an end in itself: § 30(1) BSIG 2025 expressly requires it as evidence of compliance.

Periodic evidence — and who it applies to. In Germany, the obligation to provide periodic evidence through security audits, reviews or certifications applies primarily to operators of critical installations: they demonstrate implementation at a point in time set by the BSI — at the earliest three years after they first qualify as the operator of a critical installation — and every three years thereafter, including any security deficiencies identified (§ 39(1) BSIG 2025). Irrespective of this, the management body bears an obligation of its own: implementing and monitoring the risk management measures, internal liability under the company law applicable to the legal form concerned, and regular attendance at training (§ 38(1) to (3) BSIG 2025).

7 June 2026 — EU Pay Transparency Directive

Transposition deadline for the Member States under Art. 34(1) Directive (EU) 2023/970: the national laws, regulations and administrative provisions had to be brought into force by 7 June 2026. This date had occurred as at the article date. Content of the Directive: starting pay or pay range for job applicants (Art. 5(1)), prohibition on asking about pay history (Art. 5(2)), gender-neutral job advertisements (Art. 5(3)), employees' right to information within two months (Art. 7). Full guide.

Legal effect — frequently presented in abbreviated form: 7 June 2026 is a transposition deadline addressed to the Member States, not a date from which private employers are directly bound by the Directive. A directive that has not been transposed creates no direct obligations for private employers; direct effect can at most arise vertically against the state or public-sector employers. The primacy of EU law concerns conflicting national law — it does not create new employer obligations. The practical consequence: the obligations take effect with national transposition (DE: EntgTranspG reform, AT: EntgleichV); until then, there is pressure to transpose as well as interpretation and liability risks (interpretation of existing law in conformity with the Directive, state liability on the part of the Member State). Preparing now is therefore sensible — a direct employer obligation from 7 June 2026 it is not.

What already applies under current national law. In Germany, the equal pay requirement (§ 7 EntgTranspG) accompanies the individual right to information under §§ 10 to 12 EntgTranspG — details in the section '1 January 2027'. In Austria, the pay obligations of the Austrian Equal Treatment Act (GlBG) apply (see the section '1 July 2026'); gender-neutral job advertisements are governed by § 9 GlBG, and breaches carry a fine of up to EUR 360 (§ 10 GlBG).

1 July 2026 — AT EntgleichV (pay transparency in Austria)

1 July 2026 was the forecast date of application of the Austrian transposition of Directive (EU) 2023/970 (consultation draft 03/2026), not a statutory deadline. The forecast date has passed as at the article date; for the status of transposition in Austria, see Methodology (EntgleichV caveat).

What applies until national transposition. For Austrian employers, the pay obligations of the GlBG apply: the prohibition of discrimination in setting pay (§ 3 GlBG) and the pay criteria in § 11 GlBG, under which company classification rules and collectively agreed norms must observe the principle of equal pay for equal work or work of equal value. Practitioner recommendation for Austrian employers: before relying on this date, check the publication status of the EntgleichV in the RIS; in Austria, the Ombud for Equal Treatment (GAW) and the Equal Treatment Commission are responsible for advising and supporting those affected, and claims under the GlBG are asserted in court (deadlines in the table 'Event-triggered deadlines').

2 August 2026 — AI Act: general date of application (including Art. 50); Annex III high-risk obligations only from 2 December 2027

Occurred. The AI Act has applied in principle since this date (Art. 113 AI Act). The transparency obligations in Art. 50 are therefore also applicable: AI systems intended to interact directly with natural persons must inform them that they are dealing with an AI system (para. 1); synthetic audio, image, video or text content must be marked in a machine-readable format as artificially generated or manipulated (para. 2); deployers of emotion recognition or biometric categorisation systems must inform the persons concerned (para. 3); anyone generating or manipulating deep fakes must disclose this (para. 4).

What already applied before that. Chapters I and II of the AI Act — including the prohibited practices under Art. 5 and AI literacy under Art. 4 — have applied since 2 February 2025; Chapter V with the obligations for providers of GPAI models since 2 August 2025 (Art. 113 AI Act). Art. 4 has applied since 27 July 2026 in the version set out in Regulation (EU) 2026/1744: providers and deployers take measures to support the development of their staff's AI literacy; no particular level of competence is owed. The AI Act is an EU regulation; it applies equally in Germany and Austria — there is no national difference on this point. The Member States each designate at least one notifying authority and at least one market surveillance authority and make their contact details publicly available (Art. 70(1) and (2) AI Act); differences exist in supervision: in Germany, the Federal Network Agency (Bundesnetzagentur) has been the market surveillance authority since 29 July 2026 (§ 2(1) of the German AI Market Surveillance and Innovation Promotion Act (KI-MIG)), to the extent that sectoral authorities are not competent, whereas Austria had not designated a market surveillance authority under Art. 70 AI Act as at 17 August 2026 — the RTR AI service point there is an information and advisory body without supervisory powers.

Annex III no longer hinges on this date. Since Regulation (EU) 2026/1744, in force since 27 July 2026, the high-risk obligations in Chapter III Sections 1 to 3 apply to systems under Annex III only from 2 December 2027 (Art. 113(3)(c)(i) AI Act in that version). The obligations that will then take effect: risk management (Art. 9), data governance (Art. 10), technical documentation (Art. 11), logging (Art. 12), transparency (Art. 13), human oversight (Art. 14), accuracy/robustness/cybersecurity (Art. 15), quality management system (Art. 17), conformity assessment (Art. 43), registration in the EU database (Art. 49), fundamental rights impact assessment for certain deployers (Art. 27(1) — bodies governed by public law, private entities providing public services, and deployers of systems for creditworthiness assessment and for risk assessment and pricing in life and health insurance). The penalty framework for breaches of these obligations is shown in the table 'Prioritisation by fine risk'.

When a system falls under Annex III at all. Annex III names eight areas of application: biometrics, critical infrastructure, education and vocational training, employment and workforce management including access to self-employment, access to and enjoyment of essential private and public services (including creditworthiness, health and life insurance, emergency calls), law enforcement, migration, asylum and border control, and the administration of justice and democratic processes (Annex III to Art. 6(2) AI Act). By way of derogation, a system named there is exceptionally not considered high-risk if it does not pose a significant risk to health, safety or fundamental rights — unless it performs profiling of natural persons (Art. 6(3) AI Act). Practitioner recommendation: record the result of this derogation assessment in writing before relying on it — this is a working requirement set by this article, not a statement on a statutory documentation obligation.

1 October 2026 — AT NISG 2026

Date of application of the Austrian NIS2 transposition act: sections 2 to 45 of the NISG 2026 enter into force on 1 October 2026 and do not apply before that date (§ 51(2) NISG 2026). As at the article date of 16 August 2026, this date lies in the future — it is the only 2026 milestone in this roadmap still pending.

The Austrian NIS2 obligations take effect only from the date of application. From then on the following applies: registration with the cybersecurity authority with name, address and contact details, sector under Annex 1 or 2, Member States in which services are provided, main establishment and information on the thresholds (§ 29(2) to (4) NISG 2026; deadlines in the table 'Event-triggered deadlines'). Risk management measures must be appropriate and proportionate and must cover at least the ten items in the catalogue (§ 32(1) and (4) NISG 2026). Significant cybersecurity incidents must be reported to the competent CSIRT within 24 hours, 72 hours and one month (§ 34(2) NISG 2026). The management bodies must ensure and supervise compliance and attend cybersecurity training (§ 31(1) and (2) NISG 2026).

The evidence route differs from Germany's. Essential and important entities submit structured information on the measures implemented to the cybersecurity authority within twelve months of the registration obligation arising (self-declaration); on request, implementation must be demonstrated within two years by an independent body, and essential entities must demonstrate operational and organisational implementation within two months of the request (§ 33(1) and (2) NISG 2026). Whether an Austrian entity falls within the scope is determined under § 24 in conjunction with § 25 NISG 2026 — the same size figures as in Germany, in each case tied to a type under Annex 1 or 2 (figures in the FAQ 'From what size do the NIS2 obligations apply in Germany?').

Deadlines 2027

Short answer: All the dates in this section lie in the future as at the article date of 16 August 2026: 1 January 2027 (DE EntgTranspG reform, forecast), 7 June 2027 (first pay gap reports, staggered by headcount, Art. 9(2) and (3) Directive (EU) 2023/970) and 2 August 2027 (end of the transitional period for existing GPAI models); in addition there is 2 December 2027, from which the high-risk obligations in Chapter III Sections 1 to 3 apply to systems under Annex III (Art. 113(3)(c)(i) AI Act as amended by Regulation (EU) 2026/1744, in force since 27 July 2026); the obligations for Annex I systems under Art. 6(1) AI Act follow only on 2 August 2028.

1 January 2027 — DE EntgTranspG reform (expected)

Expected German transposition of Directive 2023/970; the date of 1 January 2027 for the application of the right to information is taken from the first version of this article (as at 04/2026). No German transposing act was in place as at 17 August 2026 (BT-Drs. 21/7026, see Methodology).

What changes in substance. The Entgelttransparenzgesetz (German Pay Transparency Act) as it currently stands ties the individual right to information to establishments with, as a rule, more than 200 employees, and dispenses with stating the comparator pay where the comparable activity is carried out by fewer than six employees of the other gender (§§ 10 to 12 EntgTranspG). Art. 7 of the Directive requires written information on the individual pay level and on the average pay levels — broken down by gender — for categories of workers performing the same work or work of equal value, to be provided within two months (Art. 7 Directive (EU) 2023/970); the Directive does not tie this right to any workforce size. How far the reform closes this gap will follow from the legislative text once it is available; the date itself is a forecast, not a statutory deadline.

Practitioner recommendation: the groundwork is the same under both versions — form categories of workers performing the same work or work of equal value, and review the classification criteria for freedom from discrimination; it supports both the right to information under Art. 7 and the report under Art. 9(1) of Directive (EU) 2023/970 (section '7 June 2027').

7 June 2027 — EU pay transparency: first reports (150 employees and above)

First pay gap reports due, staggered by size: employers with 250 or more employees report by 7 June 2027 and annually thereafter (Art. 9(2) Directive (EU) 2023/970); employers with 150 to 249 employees likewise by 7 June 2027, and every three years thereafter (Art. 9(3)); employers with 100 to 149 employees only by 7 June 2031 and every three years thereafter (Art. 9(4)). Content: the gender pay gap (including in variable components), median values, the proportion of workers in each pay quartile and the pay gap for each category of worker (Art. 9(1)). The applicable national transposition law governs in each case.

Why this is the next hard deadline. Unlike 7 June 2026, which was addressed to the Member States, Art. 9 addresses employers themselves — taking effect via national transposition law. The data basis does not come into being in the reporting month: the pay gap per category of worker and the proportion in each pay quartile presuppose that the categories are defined and the variable pay components can be allocated. Practitioner recommendation: start preparing in the first quarter of 2027 at the latest; this is a working requirement set by this article, not a deadline set by the Directive.

2 August 2027 — EU AI Act: GPAI transitional period ends

Pending. Providers of GPAI models placed on the market before 2 August 2025 must comply with the full catalogue of obligations (Art. 53 to 55) from 2 August 2027. For all models placed on the market after that date, the obligations in Chapter V have applied since 2 August 2025 (Art. 113 AI Act).

The catalogue in detail. Providers of general-purpose AI models must draw up and keep up to date the technical documentation of the model (at least in accordance with Annex XI), make information and documentation available to providers who integrate the model (at least in accordance with Annex XII), put in place a policy to comply with Union copyright law, and publish a sufficiently detailed summary of the content used for training, in accordance with a template provided by the AI Office (Art. 53(1) AI Act). For free and open-source models, points (a) and (b) apply in restricted form — but not where there is systemic risk.

Systemic risk extends the catalogue of obligations. A GPAI model is considered a model with systemic risk if it has high-impact capabilities; this is presumed where the cumulative amount of computation used for training exceeds 10^25 floating point operations (Art. 51(1) and (2) AI Act). In that case, model evaluation in accordance with standardised protocols including adversarial testing, assessment and mitigation of systemic risks at Union level, prompt reporting of serious incidents to the AI Office, and an adequate level of cybersecurity are added (Art. 55(1) AI Act). For deployers using such a model, this means in practice: these documents belong in the provider documentation, not in a separate assessment of their own.

2 August 2028 instead of 2 August 2027 — AI Act: Annex I (regulated products)

Obligations for AI in products covered by EU harmonisation legislation (Annex I) — machinery, toys, medical devices, lifts, pressure equipment, etc.

Where the date comes from. Art. 113(3)(c)(ii) AI Act, in the version applicable since 27 July 2026, exempts Art. 6(1) and the corresponding obligations from the general date of application and sets them at 2 August 2028 (Art. 113 AI Act as amended by Regulation (EU) 2026/1744). What is covered under that provision is an AI system that is intended to be used as a safety component of a product covered by the harmonisation legislation in Annex I, or is itself such a product, and is subject to third-party conformity assessment (Art. 6(1) AI Act). Both conditions must be met together — merely falling under an Annex I product law is not sufficient.

Deadlines 2028

Short answer: For 2028, this roadmap lists a single entry — the obligations for systems under Annex I (Art. 6(1) AI Act), which apply from 2 August 2028 following Regulation (EU) 2026/1744.

2 August 2028 — AI Act: Annex I (regulated products)

Regulation (EU) 2026/1744 (Digital Omnibus AI), in force since 27 July 2026, has postponed the obligations for AI in regulated products under Annex I from 2 August 2027 to 2 August 2028 (Art. 113(3)(c)(ii) AI Act in that version); 2 August 2028 is therefore the operative date. Anyone developing products with AI safety components should plan against 2 August 2028 and use the additional time as a buffer, not as a reason to postpone.

Ongoing tasks: recurring obligations and their cycle

Short answer: Eight tasks have to be performed on a recurring basis — seven of them rest on an obligation, while the effectiveness review of the internal reporting channel is best practice with no statutory audit obligation; only for the pay gap report is the interval set out in the Directive (Art. 9(2) to (4) Directive (EU) 2023/970; the obligation takes effect via national transposition law), § 38(3) BSIG 2025 merely says 'regularly', and the remaining intervals are practitioner recommendations or best practice.

The column 'Nature of the interval' separates what is often conflated: the obligation itself follows in each case from the provision cited — the interval, by contrast, in only one case.

DE/AT note: The German legal bases in this table (BSIG, HinSchG, AGG) have different counterparts in Austria — the Austrian Whistleblower Protection Act (HSchG), the GlBG, and the NISG 2026 from 1 October 2026; the EU-law bases (GDPR, AI Act, Directive (EU) 2023/970) apply equally in both countries. Responsibilities and differences in wording are set out in the section 'Austria: which obligation applies from when'. In Austria, § 17 GlBG prohibits discrimination on grounds of ethnic origin, religion or belief, age and sexual orientation (§ 3 GlBG for gender); the Ombud for Equal Treatment (GAW) and the Equal Treatment Commission take the place of the Federal Anti-Discrimination Agency.

Event-triggered deadlines: they run independently of the calendar

Short answer: Besides the cut-off dates in this roadmap, there are deadlines that start not with a date but with an event — a Personal Data Breach, a security incident, an incoming report, a rejected application. Every row in the table below is a statutory deadline with a source; none of them can be deferred to a quarterly date.

When a security incident is 'significant'. An incident becomes notifiable where it has caused or is capable of causing severe operational disruption to services or financial loss for the entity, or where it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage (§ 2 no. 11 BSIG 2025; in Austria § 35(1) NISG 2026 (from 1 October 2026), which expressly refers to 'severe financial loss'). Practitioner recommendation: for the 24-hour deadline, what matters is not the date but the availability of the responsible role — define deputies and the reporting route in advance.

Prioritisation by fine risk

Short answer: The highest fine risk lies with the EU AI Act, with up to EUR 35 million or 7% of annual turnover (prohibited practices under Art. 5, Art. 99(3) AI Act); the full ranking with sources and a DE/AT split is in the table — for NIS2 in Germany, the personal internal liability of the management body is added (§ 38(2) BSIG 2025).

What determines the framework in the individual case. The GDPR stages fines by type of infringement: up to EUR 20 million or 4% for infringements of the principles of processing, the conditions for consent (Art. 5, 6, 7, 9) or the rights of data subjects (Art. 12 to 22) under Art. 83(5) GDPR — up to EUR 10 million or 2% for infringements of obligations such as those in Art. 25 to 39 under Art. 83(4) GDPR. In addition, § 43(2) and (3) of the German Federal Data Protection Act (BDSG) makes the incorrect handling of a request for information, or of consumer information under § 30 BDSG, an administrative offence subject to a fine of up to EUR 50,000; no fines are imposed on public authorities and other public bodies. In Austria, § 62(1) of the Austrian Data Protection Act (DSG) provides for fines of up to EUR 50,000, unless the act already constitutes an infringement under Art. 83 GDPR or is subject to more severe penalties under other administrative penal provisions. Under the AI Act, alongside the staging in Art. 99(3) and (4), there is the fine for supplying incorrect, incomplete or misleading information to authorities — up to EUR 7.5 million or 1% (Art. 99(5) AI Act).

NIS2 and HinSchG in detail. Where total turnover exceeds EUR 500 million, the percentage replaces the fixed amounts in Germany — up to 2% for particularly important entities and up to 1.4% for important entities (§ 65(6) and (7) BSIG 2025). Under whistleblower protection, the framework is staged by type of infringement: up to EUR 50,000 for obstructing a report, retaliation and breach of confidentiality, up to EUR 20,000 for the absence of an internal reporting channel, and up to EUR 10,000 in the remaining cases (§ 40(2) to (6) HinSchG). In Austria, the framework is up to EUR 20,000, and up to EUR 40,000 in the event of repetition; the district administrative authority is competent (§ 24 HSchG). For SMEs including start-ups, the lower of the two amounts applies in each case to fines under the AI Act (Art. 99(6) AI Act) — the EUR 35 million figure is therefore not the benchmark for small undertakings.

Austria: which obligation applies from when

Short answer: In Austria, the NIS2 obligations take effect only when the NISG 2026 becomes applicable on 1 October 2026; whistleblower protection, equal treatment and data protection are already running, but they follow different sources and different authorities there than in Germany. Pure EU law — the AI Act and the Pay Transparency Directive — applies in both countries on the same dates.

Two differences in wording that matter in an assessment. First, the standard for the NIS2 measures: § 30(1) BSIG 2025 requires measures that are appropriate, proportionate and effective, and prescribes documentation of compliance; § 32(1) NISG 2026 (from 1 October 2026) requires appropriate and proportionate risk management measures. Second, the standard of proof in discrimination protection: under § 22 AGG, the other party bears the burden of proving that there was no breach of the provisions protecting against disadvantage, once indicative facts have been proven; under § 12(12) or § 26(12) GlBG, it is sufficient for the person concerned to establish a prima facie case, and the defendant must prove that, weighing all the circumstances, another motive was more probable or that a ground of justification exists.

Penalties and supervision. The frameworks for administrative offences under § 45(1) NISG 2026 are set out in the table 'Prioritisation by fine risk'; other offences carry fines of up to EUR 50,000, and up to EUR 100,000 in the event of repetition (§ 45(4) NISG 2026). The NISG 2026 contains no express internal liability provision comparable to § 38(2) BSIG 2025; liability there follows from general company law (§ 25 GmbHG (AT)). In return, the cybersecurity authority may temporarily prohibit the management bodies of an essential entity from exercising management functions by administrative decision (§ 39(4) no. 2 NISG 2026, with entry in the commercial register). All of these legal consequences presuppose that the NISG 2026 has become applicable.