NIS2 in Austria: what the NISG 2026 requires since 1 October 2026

A plastics processor in Upper Austria with 140 employees supplies parts to a car maker in Bavaria. In September, the purchasing department in Germany sends its annual supplier questionnaire. One question is new: “Are you subject to NIS2? If so, please confirm your registration with the competent authority.” The managing director asks IT whether the company has to register somewhere.

Until 30 September 2026, the answer for NIS2 in Austria was “not yet”. On 1 October 2026, the Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026) entered into force, Austria’s implementation of the EU’s NIS2 Directive. The Austrian Economic Chamber expects around 4,000 companies and organisations to be covered, many of them for the first time. The first hard deadline is the registration at the end of 2026.

Key takeaways

• The NISG 2026 has applied since 1 October 2026. It replaces the NISG 2018, which expired on 30 September 2026.
• Registration is due within three months, so by the end of 2026, through the NIS2 service in the Unternehmensserviceportal (USP).
• Whether you are in scope depends on sector and size. As a rule of thumb: 50 or more employees, or more than 10 million euros in turnover and balance sheet, in one of the listed sectors.
• Significant incidents must be reported within 24 hours, 72 hours and one month.
• A self-declaration of your security measures is due by 30 September 2027. From October 2028, the authority can ask for proof.
• Fines go up to 10 million euros or 2 percent of worldwide turnover for essential entities, and up to 7 million euros or 1.4 percent for important entities, whichever is higher.

How Austria got here

NIS2, Directive (EU) 2022/2555, had to be transposed by October 2024. Austria’s first attempt failed in 2024, because the bill did not reach the two-thirds majority it needed in the Nationalrat. A new bill passed on 12 December 2025 and was published in the Federal Law Gazette on 23 December 2025 as BGBl. I Nr. 94/2025. The legislator then gave companies a run-up: the law only entered into force on 1 October 2026.

The supervisory authority is new as well. The Cybersicherheitsbehörde is a federal office for cybersecurity under the Federal Minister of the Interior, set up outside the Directorate General for Public Security. Incident reports go to a CSIRT, which passes them on to the authority.

Who is covered by NIS2 in Austria?

The NISG 2026 combines two tests. Does your company work in one of the sectors listed in Annex 1 or Annex 2 of the law? And is it at least a medium-sized enterprise? As a rule, only the combination brings you in.

Annex 1 covers sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management for business customers, public administration and space. Annex 2 covers other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing (including medical devices, electronics, machinery and vehicles), digital providers such as online marketplaces and search engines, and research.

Two points are easy to miss. First, the thresholds are calculated at group level. A subsidiary with 40 employees that belongs to a group with 400 is not a small company. Second, each company falls under the law of the member state where it is established: an Austrian subsidiary under the NISG 2026, a German one under German law. Only certain digital providers, such as cloud and data centre providers, managed service providers and online marketplaces, follow the main-establishment rule. Each group company that falls under the law registers on its own.

Our plastics processor works in manufacturing, an Annex 2 sector, and has more than 50 employees. It is an important entity.

Registration: the first deadline

Essential and important entities must register within three months of the law entering into force. That puts the deadline at the end of 2026. Registration runs electronically through the NIS2 service in the Unternehmensserviceportal. The people doing it need an ID Austria and a USP role that allows NIS registration, assigned by the company’s USP administrator.

The law asks for seven sets of data:

• the name of the entity,
• address and current contact details, and a representative if there is no establishment in the EU,
• sector, subsector and type of entity,
• the EU member states in which you provide services,
• your public IP address ranges, where applicable,
• the addresses of your main establishment and other establishments in the EU,
• the information on thresholds and your classification as essential or important.

You also name a contact point that can be reached at least by phone and email. Changes to names, contacts, sectors, member states or IP ranges must be reported within two weeks, changes to establishments, thresholds or classification within three months. Late or incorrect registration can cost up to 50,000 euros, and up to 100,000 euros for repeat offences.

Registration takes an afternoon if the data is ready. Collecting it across several group companies, with IP ranges and establishments, often takes weeks. Start with the data.

What the law requires

The core of the NISG 2026 is § 32: appropriate and proportionate technical, operational and organisational measures to manage the risks to your network and information systems. The law lists ten areas:

1. risk analysis and security policies for information systems,
2. incident handling,
3. business continuity, including backup management, disaster recovery and crisis management,
4. supply chain security, including your direct suppliers and service providers,
5. security in the acquisition, development and maintenance of systems, including vulnerability handling,
6. policies and procedures to assess the effectiveness of the measures,
7. basic cyber hygiene and cybersecurity training,
8. cryptography and, where relevant, encryption,
9. personnel security, access control and asset management,
10. multi-factor authentication and secured communication.

For certain digital service providers, the details follow from Implementing Regulation (EU) 2024/2690. For all other sectors, the authority sets out the requirements by regulation. If you already run an ISMS under ISO 27001 or hold a TISAX® label, most of these areas are covered in substance. What is new are the registration, the reporting deadlines, the self-declaration and the duties of management.

Reporting: 24 hours, 72 hours, one month

A significant security incident must be reported to the CSIRT in three stages:

• Early warning without undue delay, at the latest within 24 hours of becoming aware of the incident.
• Incident notification within 72 hours, with a first assessment of severity and impact.
• Final report at the latest one month after the notification.

An incident is significant when it has caused or can cause severe operational disruption or financial loss for your company, or considerable material or non-material damage to others. Reports go to the competent CSIRT through the NIS2 reporting platform. If personal data is affected, the GDPR’s 72-hour notification to the data protection authority applies on top.

The deadlines start when you become aware of the incident, even if the analysis is still running. That is why the reporting step belongs in the incident process itself, with a named decision-maker and a deputy who can decide on a Saturday.

Self-declaration and proof

Austria has chosen a staged approach to supervision. By 30 September 2027, twelve months after the registration duty began, every entity submits a self-declaration on the measures it has implemented. From 1 October 2028, the authority can ask for proof.

• Essential entities then have two months to prove the organisational and operational measures (earliest 30 November 2028) and two years for the technical measures (earliest 30 September 2030).
• Important entities have two years after a request, and are only asked when there are substantiated indications of a breach.

Proof means an audit by an independent body that is at most two years old. Certificates such as ISO 27001 can count for the organisational and operational side. Whether they are enough for the technical side is disputed among practitioners, so plan for an audit that looks at the technical measures as well.

What management has to do

The management body, the managing directors of a GmbH or the executive board of an AG, is responsible for approving the measures and monitoring their implementation. Managers must attend cybersecurity training designed for them, and employees should be offered regular training too.

Here Austria differs from Germany. The German BSI Act sets out explicit liability for managing directors. The NISG 2026 does not regulate management liability itself, so the general rules of company law apply. Administrative fines are imposed on the entity itself. That does not make the duty lighter: a managing director who ignores a known gap still takes a personal risk under general corporate law.

Austria and Germany side by side

For groups with companies in both countries, the differences matter more than the similarities:

• In force: Germany since 6 December 2025, without a transition period. Austria since 1 October 2026.
• Registration: Germany with the BSI, which was due by 6 March 2026 for companies in scope from day one. Austria through the USP, by the end of 2026.
• Authority: the BSI in Germany, the new federal office for cybersecurity in Austria.
• Proof: in Austria a self-declaration first and audits from October 2028.
• Reporting stages: the same in both countries, 24 hours, 72 hours and one month.

The measures themselves come from the same directive. One control set can cover both laws, as long as registration, reporting channels and evidence are kept separately per country. Our guide on multi-framework control mapping shows how.

The plan until the end of 2026

1. Check scope for every company in the group, by sector and by size at group level.
2. Collect the registration data, including IP ranges and establishments, and set up the USP roles.
3. Register by the end of 2026 and decide who keeps the data current.
4. Run a gap analysis against the ten areas, starting from the controls you already have under ISO 27001 or TISAX®.
5. Add the reporting stages to your incident process, with a decision-maker, a deputy and pre-filled report templates.
6. Get a management resolution on the measures and book the management training.
7. Review critical suppliers and their contracts.
8. Document as you go, so the self-declaration in 2027 only has to summarise what is already there.

Common pitfalls with the NISG 2026

Counting only your own company. The thresholds apply at group level. Small subsidiaries of larger groups are often in scope.

Assuming ISO 27001 settles it. A certificate covers much of § 32, but not the registration, the reporting deadlines or the management duties.

Leaving registration to the last week of December. USP roles, ID Austria and the data from several sites take longer than the form itself.

One reporting chain for two countries. German and Austrian entities report to different bodies. The playbook needs both routes.

FAQ: NIS2 in Austria

When is the NISG 2026 registration deadline?

Registration is due by 31 December 2026, three months after the law entered into force. It runs through the NIS2 service in the USP.

Is ISO 27001 enough for NIS2 in Austria?

It covers a large part of the risk management measures. Registration, the staged incident reporting, the self-declaration and the duties of management are separate obligations under the NISG 2026.

Which law applies to our German subsidiary?

As a rule, the law of the member state where the company is established: German law for the German company, the NISG 2026 for the Austrian one. Certain digital providers follow the main-establishment rule instead.