Registration window opens on 1 October 2026
From this date, existing affected entities can register via the electronic form of the Federal Office for Cybersecurity.
NIS2 and NISG 2026
The Austrian Network and Information Security Act implements the EU NIS 2 Directive. Here you will find the most important points at a glance.
Status
Current
Registration
Existing essential and important entities register from 1 October to 31 December 2026 at the latest. Entities that become affected later have three months after the conditions apply.
Competent authority
The Federal Office for Cybersecurity is the competent authority (§ 3a para. 1).
What is NIS2?
NIS 2 is the EU directive on cybersecurity (Directive (EU) 2022/2555). It obliges entities in important economic sectors to implement mandatory risk management for network and information systems and to report security incidents.
In Austria, the directive is implemented by the Network and Information Security Act 2026 (NISG 2026, Federal Law Gazette I No. 94/2025). The competent authority is the Federal Office for Cybersecurity (§ 3a para. 1).
Who is affected?
Whether an entity falls under the act depends on its sector and its size. The size classes follow Recommendation 2003/361/EC (§ 25). From a medium-sized enterprise: at least 50 employees or annual turnover above EUR 10 million and a balance sheet total above EUR 10 million. A large enterprise has at least 250 employees or annual turnover above EUR 50 million and a balance sheet total above EUR 43 million.
Essential entities
Entities in the sectors of Annex 1 with a large enterprise, as well as certain providers regardless of size, for example qualified trust service providers or top-level domain name registries (§ 24 para. 1).
Important entities
Entities from Annexes 1 and 2 with a medium or large enterprise, as well as telecommunications providers regardless of size (§ 24 para. 2).
Affected sectors, among others
- Energy, transport, banking and financial market infrastructure
- Health, drinking water and wastewater
- Digital infrastructure and ICT services for businesses
- Public administration
Further sectors (Annex 2), among others
- Postal and courier services, waste management
- Chemicals, food, industry
- Digital providers and research
The authority can also classify an entity as essential or important by decision (§ 26 para. 1). Municipalities are excluded (§ 24 para. 3).
Timeline
1 October 2026
Start of the registration window for existing affected entities.
Registration deadline
Existing essential and important entities: by 31 December 2026 at the latest. Entities that become affected later: three months after the conditions apply.
Self-declaration
The self-declaration must be submitted within twelve months after the registration obligation arises (§ 33 para. 1).
Obligations
Risk management
The entity implements risk management measures that cover at least certain points, for example multi-factor authentication (§ 32 para. 4).
Responsibility of management
Management must ensure and supervise compliance with the risk management measures. This includes a training obligation (§ 31).
Reporting obligations
Significant security incidents are reported to the competent CSIRT: an early warning within 24 hours, a notification within 72 hours and a final report within one month (§ 34).
How we can help
We help you classify your own situation, prioritise the most important gaps and derive next steps. For the legal questions, please consult your legal adviser or the competent authority.
This page provides general information based on the text of the law and does not replace legal advice. The published statute is authoritative (RIS, Federal Law Gazette I No. 94/2025, German). Status: October 2026.