NIS-2 in Austria: the NISG 2026 has applied since 1 October 2026

After a long delay, Austria has implemented the European NIS-2 directive with the Network and Information System Security Act 2026 (NISG 2026, Federal Law Gazette I 94/2025). It was promulgated on 23 December 2025 and entered into force on 1 October 2026 (§ 51 NISG 2026). The obligations have applied since then; only the deadlines for registration and evidence are staggered.

Who is covered now

The scope grows considerably: from a few operators of essential services designated by administrative decision (Bescheid) to essential and important entities across 18 sectors, including energy, transport, health and digital infrastructure, but also food production, waste management and manufacturing. How many companies that is will only become apparent from the authority's register. The act covers anyone in one of these sectors with at least 50 employees or with both an annual turnover and a balance sheet total exceeding ten million euros (§ 25 NISG 2026); certain providers, such as trust service and DNS service providers, are covered regardless of their size (§ 24 NISG 2026). Those affected must register themselves without waiting for an official request.

Management is under a duty

The act expressly places the management bodies under a duty. Managing directors and board members must ensure and supervise compliance with the risk management measures and attend cybersecurity training designed specifically for them (§ 31 NISG 2026). Fines are primarily imposed on the company (up to 10 million euros or 2 % of worldwide annual turnover for essential entities, up to 7 million euros or 1.4 % for important entities, § 45 NISG 2026). If an essential entity fails to comply with official orders, however, the authority may temporarily prohibit its management bodies from exercising management functions and has this recorded in the Austrian companies register (Firmenbuch) (§ 39 Abs. 4 NISG 2026). In addition, directors' liability under company law remains. Delegating downwards does not relieve them.

What to do

• Clarify applicability: sector, size class, role in the supply chain; suppliers of covered companies also have the requirements passed down to them contractually.
• Registration: it must be completed with the Federal Office for Cybersecurity (Bundesamt für Cybersicherheit) within three months of entry into force, that is, by the end of December 2026; those who fall under the act only later have three months from that point (§ 29 Abs. 3 NISG 2026).
• Risk management in line with the state of the art must be put in place: access control, multi-factor authentication, encryption, backup concepts, supply chain security, contingency plans (§ 32 NISG 2026). Within twelve months of the registration obligation arising, a self-declaration on the measures implemented must be submitted to the authority (§ 33 Abs. 1 NISG 2026).
• Set up reporting channels: significant cybersecurity incidents must be notified to the competent CSIRT within 24 hours as an early warning and within 72 hours as an incident notification; the final report follows no later than one month after the notification (§ 34 NISG 2026).

The overlap with the GDPR is built into the act: the cybersecurity authority and the data protection authority cooperate on incidents involving personal data breaches, and a fine imposed by the data protection authority for the same conduct rules out a penalty under the NISG (§§ 21, 44 NISG 2026). Anyone who already meets the GDPR's requirements (records of processing, technical measures, reporting processes) has thereby prepared part of what the NISG demands. We assess applicability and supplement the existing measures with what the act additionally requires.