NIS2 Austria (NISG 2026): Obligations from 1 October 2026

1. NISG 2026 — overview

The Network and Information Systems Security Act 2026 (Netz- und Informationssystemsicherheitsgesetz 2026, NISG 2026) transposes the NIS2 Directive (Directive (EU) 2022/2555) into Austrian law. It replaces the NISG 2018 and implements the EU requirements for essential and important entities in Austria.

The NISG 2026 has already been enacted and promulgated: BGBl. I Nr. 94/2025, issued on 23 December 2025; it becomes applicable on 1 October 2026 (derivation of that date in section 2). The EU transposition deadline was 17 October 2024; Austria — like many Member States — transposed NIS2 late.

Timing: All Austrian obligations described below only take effect from 1 October 2026.

The scope rests on two sector lists: Annex 1 covers the eleven sectors of high criticality (§ 2 nos. 1 to 11: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management, public administration, space), Annex 2 the seven other critical sectors (§ 2 nos. 12 to 18: postal and courier services, waste management, chemicals, food, manufacturing, digital providers, research). Together these are the 18 sectors of the Directive; allocation to a type of entity under Annex 1 or Annex 2 is a precondition for classification under § 24 NISG 2026.

2. Start of application: 1 October 2026

Under § 51(1) and (2), the NISG 2026 enters into force after nine months have elapsed since promulgation, on the first day of the following month — that is, on 1 October 2026. From that day the risk-management obligations of § 32 apply; the further dates follow on from it:

Two points matter for planning. First, the registration deadline is not tied to a calendar date but to entry into force, or to the point in time from which an entity meets the requirements (§ 29(3)) — anyone who only grows into the scope later has three months from that point. Second, the twelve-month period for the self-declaration runs from the moment the registration obligation arises, not from the actual registration. Practitioner recommendation: document both starting points for each company as soon as they are established; without that record it is impossible to show later which deadline started running when.

3. Who is affected?

Affected are essential and important entities; for Germany the BSI puts the number at approx. 29,500. Whether an Austrian entity is covered is decided not by an overall figure but by the scope check:

1. Sector: is there a type of entity under Annex 1 or Annex 2 NISG 2026 (§ 2 nos. 1 to 18; corresponds to Annexes I and II of Directive (EU) 2022/2555)?
2. Size (§ 25(2) and (3)): large = from 250 employees OR (annual turnover above EUR 50 million AND balance sheet total above EUR 43 million); medium = from 50 employees OR (annual turnover above EUR 10 million AND balance sheet total above EUR 10 million). Large enterprises of Annex 1 types are essential entities (§ 24(1) no. 3); Annex 1 and Annex 2 types that are large or medium-sized enterprises are important entities (§ 24(2) no. 1). Arts. 1 to 6 of the Annex to Recommendation 2003/361/EC apply to the calculation, with the exception of Art. 3(4).
3. Size-independent (§ 24(1) no. 1): qualified trust service providers, TLD name registries (.at) and DNS service providers are essential entities; non-qualified trust service providers and providers of public electronic communications networks/services are important entities irrespective of size (§ 24(2) no. 3).

This results in four classifications:

Two delimitations come up frequently in practice. Municipalities and associations of municipalities are exempt (§ 24(3), last sentence). And for entities within the scope of DORA, the provisions there, including national implementing rules, take precedence (§ 4(2), § 24(7)).

Difference from Germany: the size thresholds correspond to the formula above, the class names and the size-independent categories do not. The upper class there is called particularly important entity and, for size-based classification, requires a type of entity under Annex 1 to the German BSI Act (BSIG), while the important entity requires a type under Annex 1 or 2 (§ 28(1) and (2) BSIG). Irrespective of size, in Germany operators of critical installations, qualified trust service providers, top-level domain name registries and DNS service providers are particularly important entities (§ 28(1) BSIG); trust service providers are important entities irrespective of size (§ 28(2) BSIG). For telecommunications providers, § 28(1) and (2) BSIG contains separate classification rules. A German scope analysis therefore cannot be adopted for the Austrian subsidiary without review.

4. Obligations compared: DE vs. AT

The catalogues of obligations run in parallel in substance; the standard differs in wording: § 32(1) NISG 2026 requires suitable and proportionate risk-management measures in technical, operational and organisational terms, whereas § 30(1) BSIG requires suitable, proportionate and effective technical and organisational measures — and additionally requires compliance to be documented. Both catalogues are based on an all-hazards approach and name ten areas in the same order:

For implementation work this means: the substantive building blocks — risk analysis methodology, incident response playbook, business continuity plan, supplier assessment, authorisation concept, MFA policy — are transferable between the two legal areas, because the ten areas run in parallel in substance and appear in the same order. What is not transferable is the allocation of sources, as well as the addition of effectiveness and the documentation requirement that § 30(1) BSIG contains in contrast to the wording of § 32(1) NISG 2026, and the management body provision: § 31 NISG 2026 requires the management bodies to ensure and supervise compliance with the measures under § 32 and to take part in specifically designed cybersecurity training; entities must regularly offer corresponding training to their employees (§ 31(2)). Practitioner assessment: most of the building blocks of an existing German programme are transferable; what has to be adapted specifically for Austria is essentially sources, supervisory and reporting channels, self-declaration and penalty provisions (not a legal statement).

5. Supervision: Cybersecurity Authority vs. BSI

Contrary to how it is often presented, NIS2 supervision in Austria is organised centrally: under § 3a(1) NISG 2026 the competent authority is the Federal Office for Cybersecurity (Bundesamt für Cybersicherheit, Cybersecurity Authority) — an authority directly subordinate to the Federal Minister of the Interior with nationwide competence (§ 3a(2)) and seat in Vienna (§ 3b(3)). It exercises supervision and enforcement vis-à-vis essential and important entities (§ 4(1) no. 13, §§ 38 and 39). The Federal Ministry of the Interior (BMI) itself is not the supervisory authority. In Austria, sectoral differentiation exists only at CSIRT level (§ 8(3)), not in supervision.

In practice this creates a difference from Germany, where the reporting office (jointly of the BSI and the BBK, § 32(1) BSIG), supervision (§ 1 BSIG) and fines (§ 65 BSIG) all come together at the BSI: in Austria the addressee of notifications and the supervisory authority are separate. Notifications of significant incidents go to the competent sector-specific CSIRT, or, in the absence of one, to the national CSIRT; forwarding to the Cybersecurity Authority is governed by § 34(1). Registration, self-declaration and proof, by contrast, run directly vis-à-vis the Cybersecurity Authority (§ 29, § 33). The administrative penalty is imposed by a third body, the district administrative authority (§ 44(1)). Practitioner recommendation: record these three channels separately in the emergency and contact directory before 1 October 2026 — with a named deputy, because the 24-hour deadline also runs outside office hours.

6. Fines under the NISG 2026

The administrative penalties of the NISG 2026 go up to EUR 10 million or 2% of worldwide annual turnover for essential entities and up to EUR 7 million or 1.4% for important entities — in each case the higher value, and thus the EU maxima one to one (§ 45(2) and (3)). In detail:

• Essential entities: for administrative offences under § 45(1), up to EUR 10 million or 2% of worldwide annual turnover (whichever is higher) — § 45(2)
• Important entities: for administrative offences under § 45(1), up to EUR 7 million or 1.4% of worldwide annual turnover — § 45(3)
• Other offences: up to EUR 50,000, and in the event of repetition up to EUR 100,000 — § 45(4)
• Competence: the administrative penalties are imposed by the district administrative authority (§ 44(1)); the Cybersecurity Authority reports the suspicion of an administrative offence and remains the supervisory authority

Two differences from German law are material for group risk assessments. First, the calculation logic: in § 45(2) and (3) Austria refers directly to the higher amount — fixed amount or percentage of worldwide annual turnover. Germany first names the fixed amounts in § 65(5) BSIG (EUR 10 million for particularly important entities, EUR 7 million for important entities); the turnover variant of 2% or 1.4% respectively only applies there from a total turnover above EUR 500 million and only for the infringements designated in § 65(6) and (7) BSIG. Second, the liability side: § 31 NISG 2026 places the management bodies under obligation (section 4), but does not provide for an express claim for damages by the entity itself against its management, as § 38(2) BSIG does for Germany.

7. Seven-step checklist for Austrian companies

Seven steps lead from the scope assessment to completed registration by the end of 2026. The monthly grid of steps 1 to 5 counts from the start of the project and is a practitioner schedule (recommendation, not statutory deadlines); only step 6 (start of application 1 October 2026, § 51(1) and (2)) and step 7 (registration within three months, § 29(2) and (3)) have statutory dates. Anyone starting with less lead time compresses the steps (remaining lead time below).

1. Month 1: scope analysis: sector + size, group consolidation — check for each company whether a type under Annex 1 or 2 exists and whether the thresholds of § 25(2) or (3) are met. The result determines the class under § 24 and therefore the depth of evidence and the penalty range (section 3).
2. Month 2: brief the management — § 31 NISG 2026 with its training obligation. The management bodies bear responsibility for compliance with the measures under § 32 and must themselves be trained (section 4); the briefing should come before the ISMS is built, because it approves its scope.
3. Month 3: set up the ISMS (unless already ISO 27001 certified) — it carries the ten items of § 32(4)(a) to (j) and at the same time provides the basis for the later self-declaration under § 33(1).
4. Month 4: incident response playbook + notification templates for the competent CSIRT (§ 34(1) NISG 2026: sector-specific, otherwise national CSIRT) — one template each for the early warning, the 72-hour notification and the final report (section 8).
5. Month 5: supplier assessment + cybersecurity contract clauses — mandatory area § 32(4)(d) NISG 2026; the assessment needs a risk classification so that the depth of the review remains justifiable.
6. 10/2026: entry into force — risk management under § 32 NISG 2026 activated; from this day the reporting, registration and evidence obligations as well as the penalty provisions take effect at the same time.
7. 12/2026: complete registration with the Cybersecurity Authority (§ 29(2) and (3) NISG 2026) — three months from entry into force. When the registration obligation arises, the twelve-month period for the self-declaration under § 33(1) begins (section 9).

Remaining lead time (practitioner recommendation): anyone starting only shortly before or after 1 October 2026 should complete steps 1 and 2 in the same week (scope assessment and management briefing), run steps 4 and 5 in parallel and, for the ISMS, first put in place the basic framework of the ten areas of § 32(4) — the more detailed work can continue afterwards; the obligations of § 32 nevertheless apply in full from 1 October 2026, and the twelve-month period of § 33(1) concerns only the timing of the self-declaration.

8. Notification obligations for significant cybersecurity incidents

In Austria the reporting chain has three fixed stages — early warning within 24 hours, notification with an initial assessment within 72 hours, final report within one month (§ 34(2) nos. 1, 2 and 4); in addition there are two conditional stages: an intermediate report on request (no. 3) and a progress report in the case of an ongoing incident (no. 5). At every stage the addressee is the competent sector-specific CSIRT, otherwise the national CSIRT (§ 34(1)). The 24-hour deadline runs from becoming aware of the incident, not from when it began (§ 34(2) no. 1); the 72-hour notification must be submitted without undue delay and in any event within 72 hours (no. 2).

What the second stage carries in substance is described by the Directive: an initial assessment with severity, impact and, where applicable, indicators of compromise (Art. 23(4)(b) of Directive (EU) 2022/2555).

When an incident is significant is stated by § 35(1) NISG 2026: if it has caused or is capable of causing severe operational disruption of the services provided or severe financial loss for the entity (no. 1), or if it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage (no. 2). The threshold is therefore forward-looking — it is enough that the incident can cause such consequences. Practitioner recommendation: anchor the significance assessment in the playbook as a short, documented decision step and also record the decision against notification together with its reasoning; without that record it is impossible to show later that an assessment was made.

9. Registration, self-declaration and proof

Austria requires three successive evidence steps vis-à-vis the Cybersecurity Authority — and thus goes further than Germany, where the recurring three-yearly evidence obligation under § 39(1) BSIG is addressed to operators of critical installations.

First, registration (§ 29(2) to (4)). Essential and important entities, as well as entities providing domain name registration services, register electronically with the Cybersecurity Authority and submit, among other things, name, address and contact details, the sector or subsector under Annex 1 or 2, the Member States in which services are provided, the main establishment and information on the thresholds. The deadline is three months from entry into force or from the point at which the requirements are met; changes to the core data under § 29(2) nos. 1 to 5 must be notified within two weeks. The register itself is maintained by the Cybersecurity Authority (§ 29(1)).

Second, the self-declaration (§ 33(1)). Within twelve months of the registration obligation arising, structured information on the implemented risk-management measures must be submitted to the Cybersecurity Authority. This obligation applies to all essential and important entities — not just to a subset.

Third, proof by an independent body (§ 33(2)). Upon request, implementation must be evidenced within two years by an independent body; essential entities must evidence operational and organisational implementation within two months of the request. The first request may be made no earlier than two years after entry into force.

Groups with German and Austrian companies register separately: in Germany via the joint registration facility of the BSI and the BBK (§ 33(1) BSIG), in Austria with the Cybersecurity Authority (§ 29(2) NISG 2026). One registration does not replace the other, and the deadlines run independently of each other. Practitioner recommendation: define a fixed trigger for the two-week follow-up notification — for example any change of company name, seat, contact mailbox or service provision in further Member States — because otherwise these data become outdated unnoticed.