NIS2 · Austria
NIS2 in Austria: what the NISG 2026 requires now
Since 1 October 2026, the Austrian Network and Information Systems Security Act 2026 (NISG 2026) implements the EU NIS2 Directive. Who is affected, the deadlines, the obligations and how we help – in brief and with sources.
Last updated:
In short
What does NIS2 mean for companies in Austria?
In Austria, the NIS2 Directive is implemented by the NISG 2026, which entered into force on 1 October 2026. It mainly covers medium-sized and large entities in critical sectors such as energy, transport, health, digital infrastructure and manufacturing. They must register by 1 January 2027 via “NIS 2 Services” in the Austrian business service portal (USP), implement cybersecurity risk-management measures and report significant incidents. The competent authority is the new Federal Office for Cyber Security (Bundesamt für Cybersicherheit).
Deadlines that count now
1 January 2027registration deadline under the NISG 2026
- In force01.10.2026
NISG 2026 applies
Since 1 October 2026; the reporting obligations apply from this date.
- Registration01.01.2027
Deadline 1 January 2027
Registration via “NIS 2 Services” in the Austrian business service portal (USP).
- Early warning24 h
After becoming aware
Of a significant incident, to the competent CSIRT.
- Incident notification72 h
With an initial assessment
Severity, impact and, where available, indicators of compromise. A final report follows within one month.
Who is affected?
As a rule, medium-sized and large companies in the sectors listed in the annexes of the NIS2 Directive. Under the EU definition, a company is medium-sized from 50 employees or with more than EUR 10 million in annual turnover and balance sheet total. For groups, linked and partner enterprises count.
Essential entities are mainly large companies in sectors of high criticality; important entities are mainly medium-sized companies in these sectors and companies in other critical sectors. The classification determines the type of supervision and the level of possible sanctions.
Some providers are covered regardless of size, for example trust service providers, providers of public electronic communications, top-level domain name registries and DNS service providers. In the financial sector, the Digital Operational Resilience Act (DORA) partly takes precedence.
Sectors of high criticality (examples)
- Energy, transport, banking and financial market infrastructure
- Health, drinking water and waste water
- Digital infrastructure and ICT service management (B2B)
- Public administration and space
Other critical sectors (examples)
- Manufacturing, including machinery, vehicles, electronics and medical devices
- Production and distribution of food and chemicals
- Postal and courier services, waste management
- Digital providers and research
A first orientation in three clicks: our NISG-Schnellcheck (German, runs in your browser, nothing is stored).
Obligations of affected entities
- Registration via “NIS 2 Services” in the USP – by 1 January 2027.
- Risk-management measures of a technical, operational and organisational nature, including supply chain security.
- Reporting of significant incidents – from early warning to final report.
- Accountability of management bodies for implementing and overseeing the measures.
- Supervision by the Federal Office for Cyber Security, with sanctions for violations. Essential entities are supervised proactively, important entities mainly after indications of violations.
Preparing the registration (according to the USP)
Access
Make sure you have access to the business service portal (Mein USP).
ID Austria
Everyone who registers or reports needs an ID Austria.
Roles
Decide who registers and who reports: roles “NIS Gesamt”, “NIS Registrierung”, “NIS Meldung”, with deputies.
Data
Prepare the details under § 29 (2) NISG 2026, in particular the company size (§ 25). External support via power of attorney in the USP.
How we help – from analysis to operation
Personal exchange instead of generic advice: we focus on what matters and choose the most efficient route with you. Meetings in English are no problem.
Clarify scope
Check sector, size and special cases; prepare the classification as essential or important entity.
Assess status
Gap and risk analysis against the risk-management measures, technical checks such as vulnerability scans.
Plan measures
A prioritised plan of software and consulting building blocks, including funding options in Austria.
Implement and report
Registration, reporting process, incident response, training and ongoing operation – also as a managed service.
All details in German: NISG 2026 · Maßnahmen · Registrierung und Meldepflichten
Frequently asked questions
- Since when does the NISG 2026 apply?
- The Network and Information Systems Security Act 2026 (NISG 2026) entered into force on 1 October 2026. It implements the EU NIS2 Directive in Austria. The reporting obligations apply from that date.
- By when do entities have to register?
- According to the Austrian business service portal (Unternehmensserviceportal, USP), registration must be completed by 1 January 2027, using the application “NIS 2 Services” in the USP.
- What is needed to register in the USP?
- Access to “Mein USP”, users with an ID Austria and a suitable role: “NIS Gesamt”, “NIS Registrierung” or “NIS Meldung”. The registration details under § 29 (2) NISG 2026 – in particular the company size under § 25 – should be prepared in advance. External advisers can be authorised by power of attorney.
- Our group is headquartered outside Austria. Does the NISG 2026 apply to our Austrian company?
- It can. What matters is whether the Austrian entity operates in a covered sector and meets the size thresholds; for the size, linked and partner enterprises in the group are taken into account. The exact assignment should be checked case by case – we are happy to do this with you.
- Is ISO 27001 certification enough for NIS2?
- An ISMS under ISO/IEC 27001 covers many organisational and technical requirements and is a strong foundation. It does not replace the legal obligations such as registration and incident reporting. A mapping between the ISMS and the NISG 2026 is recommended.
- We supply an affected company. Are we affected too?
- Not automatically. Affected entities must, however, address the security of their supply chain. Suppliers and IT service providers are therefore often bound contractually to security measures and evidence.
Clarify your NIS2 status
We check sector, size and special cases with you – in a free 30-minute intro call, on site or remotely.