Since 1 October 2026, Austria's new Network and Information Systems Security Act, NISG 2026 for short (Netz- und Informationssystemsicherheitsgesetz), has been in force. It transposes the EU's NIS2 Directive and turns cybersecurity into a legal obligation for thousands of companies. According to the Austrian Economic Chamber (Wirtschaftskammer), around 4,000 companies and organisations from 18 sectors are directly affected, plus many suppliers who are brought into the obligations through their customers.
One of the best German-language overviews on the subject has been put together by the Viennese lawyer and management consultant Franz Kopp at https://nis-2-ready.at as a companion to his book „Quick Guide NIS-2 in Österreich“ (Quick Guide to NIS-2 in Austria, Springer Gabler). I have worked through the site and its guides and summarise here what managing directors need to know now: who is affected, which deadlines are running, what has to be reported in an emergency and which penalties apply. My own company is going through this process right now, so in a few places I add what we have learned in practice.
What is NIS2 and what is the NISG 2026?
NIS2 is the second EU directive on network and information security (Directive (EU) 2022/2555). It obliges the member states to introduce binding minimum cybersecurity standards for critical and important parts of the economy. Austria did this with the NISG 2026, published in the Federal Law Gazette (BGBl. I Nr. 94/2025). The operative provisions have applied since 1 October 2026, and the accompanying regulation, the NISV 2026, since 2 October 2026.
The core of the law can be summed up in four sentences. Affected companies must register. They must set up risk management for their IT covering ten defined areas. They must report significant security incidents within 24 hours. And management is personally responsible for making sure all of this happens.
Am I affected? The three test questions
Whether a company falls under the NISG 2026 is not decided by its sector alone, nor by its size alone, but by both together. On top of that there are some special cases that apply regardless of size.
The first question is size. In principle, medium-sized companies are covered from 50 employees, or with more than 10 million euros in annual turnover and at the same time more than 10 million euros in balance sheet total. A company counts as large from 250 employees, or with more than 50 million euros in turnover and more than 43 million euros in balance sheet total. Important: fewer than 50 employees does not automatically rule you out, because the financial figures also count. In groups, partner and affiliated companies are generally included, unless the company is genuinely independent in organisational, technical and operational terms.
The second question is the activity. The law lists in two annexes which services are covered. Annex 1 covers the sectors of high criticality: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration and space. Annex 2 covers other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing, for example of medical devices, electronics, machinery and vehicles, digital services and research. What matters is the specific service as described in the law, not a general industry label.
The third question concerns your customers. Even a company that is not covered itself can become subject to obligations through its clients, because they have to secure their supply chain. More on this below.
Essential or important entity?
The NISG 2026 distinguishes two classes. Large companies in an Annex 1 sector are usually essential entities. Medium-sized companies in both annexes, as well as large companies in Annex 2, are important entities. The obligations are essentially the same, but essential entities are subject to stricter supervision and higher maximum penalties.
Regardless of size, the law covers qualified trust service providers, top-level domain name registries, DNS service providers and certain providers of public communications services. In addition, the cybersecurity authority can classify a company by official decision, for example if it is the only provider of a critical service in Austria. This is exactly the case for my own company: because we operate DNS services, we are an essential entity despite our size. Anyone offering hosting, domains or IT infrastructure should therefore check this point particularly carefully.
The deadlines: registration by 31 December 2026
For companies that already met the criteria on 1 October 2026, the roadmap has four stages.
First, registration under § 29 with the cybersecurity authority. It must take place within three months of entry into force, i.e. by the end of 2026. Among other things, you must provide your name and contact details, sector and type of entity, the EU countries concerned, your main establishment and the thresholds. You also have to designate a point of contact with a telephone number and e-mail address. If these details change later, the changes must be reported within two weeks or three months respectively. In practice, registration is done via the Austrian business service portal, the Unternehmensserviceportal (USP), under „NIS2 Services“. Anyone who only meets the criteria later, for example through growth, must register no later than three months from that point.
Second, risk management under § 32. There is no general transition period here, so the measures have to be built up in parallel with registration.
Third, the self-declaration under § 33 (1). Within twelve months of the registration obligation arising, the company must report to the authority in a structured form which measures it has implemented, including supply chain security and the results of the risk analysis. For most companies already covered, this means: by the end of September 2027.
Fourth, the independent audit under § 33 (2). It does not happen automatically but at the request of the authority, at the earliest two years after entry into force. In principle, implementation must then be demonstrated by an independent body within two years. Essential entities, by contrast, must provide evidence for the operational and organisational part within two months. Valid certificates can only cover this operational and organisational part, not the technical one.
The ten areas of measures under § 32
The heart of the law is § 32. It requires appropriate and proportionate technical, operational and organisational measures based on an all-hazards approach. At least ten areas must be covered.
First, a risk analysis and the security of information systems: which systems, services and threats determine your own risk? Second, incident handling, meaning detection, assessment, escalation and response. Third, business continuity with backup, recovery and crisis management. Fourth, the security of the supply chain and of service providers. Fifth, security in procurement, development and maintenance, including vulnerability handling. Sixth, procedures for assessing the effectiveness of the measures, such as key figures, control tests and audits. Seventh, cyber hygiene and training. Eighth, cryptography and encryption. Ninth, human resources security, access control and asset management. Tenth, multi-factor authentication, secured communications and, where appropriate, emergency communications.
What „proportionate“ means depends on risk exposure, size, likelihood of occurrence and the potential severity of an incident, including its social and economic consequences. Costs alone are not a reason for an exemption. The NISV 2026 adds that the risk analysis should consider technological, human, supply-chain-related and location-related risks. Anyone who cannot meet a requirement temporarily or because of their size must justify and document compensating measures and review their effectiveness at least once a year.
Reporting obligation: 24 hours, 72 hours, one month
If a significant security incident occurs, a three-stage reporting procedure applies, addressed to the competent sector-specific CSIRT (Computer Security Incident Response Team) or, if there is none, to the national CSIRT. The deadlines run from the moment you become aware of the incident.
Within 24 hours an early warning must be submitted, indicating whether an attack is suspected and whether other countries could be affected. Within 72 hours the actual incident notification follows, with an initial assessment of severity and impact and, where applicable, indicators of compromise. No later than one month after that, a final report is due, describing the causes, type of threat, remedial measures and cross-border effects. If the incident is still ongoing, a progress report is submitted first. In addition, customers whose services are affected must be informed without delay. The CSIRT in turn responds within 24 hours and provides support on request.
When is an incident significant? The NISV 2026 names criteria under which this is the case in any event: a direct financial loss of more than 500,000 euros or 5 percent of the previous year's turnover (whichever is lower), the leak of trade secrets, the death or serious damage to the health of a person, a successful, presumably malicious access likely to cause serious operational disruption, an outage for more than 100,000 users or 10 percent of users lasting more than 24 hours, an outage in the area of at least one Austrian federal state lasting more than 24 hours, and the activation of crisis or emergency plans. Repeated smaller incidents with the same cause can also add up to a significant one. Planned maintenance does not count.
From my own experience: you should not read these criteria for the first time in an emergency. We introduced a written reporting process for our team with clear on-call duty and an exercise called „significant or not?“. Nobody wants to open the statute book in the night from Saturday to Sunday.
A matter for the boss: duties of management
§ 31 explicitly makes NIS2 a leadership task. The management or executive board must ensure that the measures under § 32 are implemented and must supervise this on an ongoing basis. The operational work may be delegated to IT, information security, purchasing or external service providers, but the responsibility stays at the top.
In addition, the members of the management bodies must attend cybersecurity training designed specifically for the leadership level. A general awareness training for employees is not sufficient for this. The law does not prescribe the duration, frequency or form of the confirmation of attendance. Useful content includes the current risk situation, the legal duties, decision-making situations during an incident, supply chain risks and the question of what a piece of evidence actually proves. For employees, the law additionally requires regular, suitable training.
As evidence, Franz Kopp recommends passing resolutions on roles and budget, having regular reports presented and documenting decisions. A good management report contains the risk situation, the implementation status of the ten areas of measures, critical suppliers, incidents, overdue measures, audit results and the training status.
Penalties and liability
The fines are substantial. For essential entities they reach up to 10 million euros or 2 percent of worldwide turnover in the previous year, for important entities up to 7 million euros or 1.4 percent, in each case whichever is higher. A missed registration or incorrect information is also an administrative offence, as is failing to submit a report.
It is primarily the company itself that is penalised. The law does not provide for an automatic personal fine for managing directors. However, consequences under company, civil and insurance law must be examined separately, and anyone who cannot document that they fulfilled their duty of supervision will be in a weak position in a dispute. For essential entities there is also an escalation level under § 39: if the company does not comply with a remedial order in time, the authority can temporarily prohibit members of the management bodies from exercising their management functions until the measures have been implemented. This is not a general ban from practising a profession. Nevertheless, I recommend also reviewing your own D&O and cyber insurance in this context.
NIS2 in the supply chain: what suppliers can expect
Many smaller companies will feel NIS2 not through the law, but through their customers. Essential and important entities must take the security of their supply chain and of their direct service providers into account in their own risk management. This does not automatically make a supplier an NISG entity itself. Binding obligations do arise for it, however, through contracts and tenders.
How strict it gets depends on the risk. A cloud service with administrative access is checked differently from a supplier of office supplies. Typical evidence includes a description of the service and its technical dependencies, a point of contact for security incidents, rules for access and multi-factor authentication, a patch and vulnerability process, a tested backup and recovery concept, an incident process including customer notification, a list of key subcontractors, and audit reports or certificates with a suitable scope.
A sentence such as „The contractor complies with NIS2“ is too vague as a contractual clause. Good contracts specify which security measures apply, who informs whom about incidents and within what deadline, which evidence is accepted, how audits are carried out and how subcontractors and deficiencies are dealt with. We have been through exactly this with large customers: questionnaires, penetration tests, retests. Those who prepare early gain trust and sometimes new orders as well.
What you should do now
Check and document whether you are affected: size including affiliated companies, activities according to Annexes 1 and 2, special cases that apply regardless of size. Record the result in writing and have it signed by management.
If you are affected, register via the USP by 31 December 2026 and designate a point of contact who can be reached.
Draw up a plan of measures along the ten areas of § 32, have it approved by management and file the evidence for each measure from the very beginning. This dossier is the basis for the self-declaration in autumn 2027.
Write a reporting and escalation process for 24 and 72 hours and practise it. Train management and the team. And review your most important service providers and customer contracts for security requirements.
My conclusion
NIS2 is not an IT project you hand over to the technical team, but a leadership task with clear deadlines. The good news: anyone who already runs their IT properly has much of it in place and above all needs to make it demonstrable. The bad news: without documentation, none of it counts in an emergency.
As a starting point I recommend the site https://nis-2-ready.at with its short check of whether you are affected and its six guides. The binding sources are the primary texts in Austria's federal legal information system (RIS). This article is my summary as an entrepreneur and does not replace legal advice.
I am happy to advise you
As an essential entity, my company has just implemented the NISG 2026 itself: classification, registration, plan of measures, reporting and emergency process, training for management and the team, evidence for the supply chain. I am happy to pass on this experience. If you want to know whether your company is affected, or are looking for a pragmatic way to implement the requirements, I will gladly advise you personally. Simply write to me: https://www.mariokoerbler.com/en/contact