From directive to binding law
Since 1 October 2026, Austria’s Network and Information Systems Security Act 2026 (NISG 2026, Federal Law Gazette I No. 94/2025) has been in force. It transposes the EU NIS2 Directive into Austrian law and replaces the previous NISG 2018. Supervision lies with the new Federal Office for Cyber Security (Bundesamt für Cybersicherheit) within the Ministry of the Interior.
We have covered the basics of NIS2 before – for example in NIS2 Directive: who needs to comply?. This article focuses on what applies now: registration, the upcoming deadlines and the obligations that are already running.
Who is covered?
The act distinguishes between essential and important entities. Two questions decide whether you are in scope: which sector you operate in, and how large your organisation is.
- Sectors: Annex 1 lists eleven highly critical sectors, including energy, transport, banking, health, drinking water, digital infrastructure and B2B ICT service management. Annex 2 adds seven more, such as postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research (WKO).
- Size: As a rule, medium-sized and larger organisations are covered – from 50 employees, or with annual turnover above EUR 10 million and a balance sheet above EUR 10 million. An organisation counts as large from 250 employees, or with turnover above EUR 50 million and a balance sheet above EUR 43 million. Linked and partner companies are generally included in the calculation.
- Regardless of size: Some entities are covered whatever their size, for example DNS service providers, top-level domain registries and trust service providers.
The Austrian Economic Chamber (WKO) estimates that around 4,000 companies and organisations are directly affected. Note that the authority does not classify anyone: each organisation has to assess for itself whether the act applies (WKO FAQ, German). If in doubt, check your status with your legal adviser or your chamber.
Registration: now open via the USP
Entities in scope must register with the Federal Office for Cyber Security, electronically via Austria’s business service portal (Unternehmensserviceportal, USP). Registration has been open since 1 October 2026 and must be completed by the end of 2026 at the latest.
Sources differ slightly on the exact cut-off: the WKO and KPMG give 31 December 2026, while the analysis by Schönherr in ecolex counts the three-month period from entry into force to 1 January 2027. To be safe, work towards the earlier date. Organisations that only fall into scope later have three months from meeting the criteria.
Failing to register, or registering incorrectly, can lead to fines of up to EUR 50,000, or up to EUR 100,000 for repeat offences.
What comes after registration
Risk management under Section 32
The act requires appropriate technical, operational and organisational measures, including (WKO FAQ):
- risk analysis and information system security policies
- incident handling
- business continuity: backup management, disaster recovery and crisis management
- supply chain security
- security in acquiring, developing and maintaining systems, including vulnerability handling
- assessing how effective the measures are
- basic cyber hygiene and training
- cryptography and encryption
- personnel security, access control and asset management
- multi-factor authentication
Self-declaration by autumn 2027
Within twelve months of the registration obligation arising, you must submit a structured self-declaration to the authority – by 30 September or 1 October 2027, depending on the source. It covers the measures implemented, the systems in use, supply chain security and the results of your risk analysis. According to Schönherr, the authority can request external proof from an independent body no earlier than two years after the act came into force.
Reporting obligations already apply
Significant incidents have had to be reported since 1 October 2026, in stages:
| Step | Deadline |
|---|---|
| Early warning | without undue delay, within 24 hours of becoming aware |
| Incident notification with assessment | within 72 hours |
| Final report | no later than one month after the notification |
Meeting these deadlines requires clear responsibilities, working monitoring and a process that also works at weekends – starting today.
Management is accountable
Management bodies must ensure and oversee the risk management measures. Every managing director has to attend cyber security training designed for management, and staff must be offered regular training too. According to the WKO, the NISG 2026 does not impose administrative fines on managers personally, but liability for damages remains possible in cases of negligence. For the entities themselves, fines reach up to EUR 10 million or 2% of worldwide turnover (essential) and EUR 7 million or 1.4% (important entities).
Suppliers and service providers feel it too
Smaller businesses are usually not covered directly – but they are affected indirectly. Entities in scope must secure their supply chain and pass on security requirements by contract: incident notification duties, audit rights, rules on vulnerability management. A general reference to the act in purchasing terms is not enough, the WKO notes. If you supply customers in energy, health, manufacturing or IT, expect questionnaires and new contract clauses.
Checklist for the coming weeks
- Assess whether you are in scope: sector, size, linked companies – and document the result
- Sort out USP access and complete registration before the end of the year
- Define the incident reporting route (who reports, how, within 24 hours)
- Schedule management training and keep evidence of it
- Start the risk analysis and record gaps across the ten areas of measures
- Review backup, recovery and multi-factor authentication
- List suppliers and service providers and check contracts for security requirements
- Set a timeline for the self-declaration due in autumn 2027
How IT United can help
We help you tackle the technical side of the NISG 2026 in an orderly way: an inventory of your IT, a risk analysis from the IT perspective, implementing measures such as multi-factor authentication, monitoring and emergency planning, and documentation for the self-declaration. Find out more under IT security and backup. The legal classification remains a matter for your legal adviser – we are happy to work alongside them.
Want to know where your organisation stands? Book a free initial consultation and we will go through the points together.
