Austria missed the EU deadline for transposing the NIS2 Directive in October 2024. A first draft failed in the National Council in July 2024 for lack of the required two-thirds majority. The NISG 2026 was adopted in December 2025, published at the end of December 2025 and came into force on 1 October 2026 after a nine-month vacatio legis.
Who is covered
Covered are essential and important entities in the NIS2 sectors, usually from medium size upwards, with some categories regardless of size. According to estimates by the Austrian Economic Chamber, around 4,000 companies are directly affected, many more indirectly through their customers. Companies classify themselves; responsibility for a correct classification lies with them.
Registration and self-declaration
Covered entities must register with the cybersecurity authority within three months of entry into force, i.e. by the end of 2026. Within twelve months of entry into force, a self-declaration of the risk management measures implemented must be submitted.
Risk management and reporting
The act requires appropriate technical, operational and organisational measures, including supply chain security. Significant security incidents must be reported following the NIS2 pattern: early warning within 24 hours, notification within 72 hours and a final report. The reporting duties have applied since entry into force.
Management duties
Management bodies must approve the measures, oversee their implementation and undergo training. Breaches can be sanctioned, and personal responsibility of management is provided for. Companies already running an ISMS under ISO 27001 have covered a good part of the requirements. Our NIS2 implementation in Germany and Austria offer supports classification and registration.