NIS2 implementation in Germany and Austria
Medium-sized and larger companies in the NIS2 sectors in Germany and Austria, including subsidiaries of Swiss groups.
Updated: 2026-11
In Germany the NIS2 implementation act has applied since 6 December 2025, in Austria the NISG 2026 since 1 October 2026. We establish applicability, prepare registration and implement the core duties: risk management, reporting within 24 and 72 hours, supply chain security and approval by management.
Many companies are regulated by NIS2 for the first time without knowing it. Classification depends on sector and size and must be done by the company itself. In Germany, entities already covered should have registered with the BSI by March 2026; in Austria the registration period runs to the end of 2026.
After registration the real work begins: documented risk management, reporting channels that work in an emergency, and management that approves and oversees the measures.
What you get
Applicability check
Reasoned classification as essential or important entity, or not covered, under German or Austrian law.
Registration documents
Compilation of the information for registration with the BSI or the Austrian cybersecurity authority.
Risk management
Catalogue of measures against the statutory minimum, with current state, gaps and plan.
Reporting process
Procedure for early warning, notification and final report with roles, contacts and templates.
Management documents
Template for management approval of the measures and a concept for management training.
How it runs
- 01
Classification
Assess sector, size and activities, document the classification, prepare registration.
- 02
Baseline
Compare existing security measures with the minimum requirements.
- 03
Measures
Prioritise gaps by risk, build the reporting process, involve suppliers.
- 04
Evidence
Documentation, management resolution and exercise of the reporting procedure; in Austria, preparation of the self-declaration.
Price framing
Classification and registration preparation with fixed scope; implementation as a project or ongoing support depending on the starting point.
Indicative, not a binding quote — the frame is confirmed during scoping.
Parent service: Cyber readiness & IT security
FAQ
How quickly must incidents be reported?
Germany and Austria follow the NIS2 pattern: early warning within 24 hours, notification within 72 hours and a final report within one month.
Is management personally liable?
Both laws require management to approve risk management measures and oversee their implementation, and provide for liability for breaches. Individual assessment belongs to legal advice.
Does NIS2 apply to Swiss companies?
Not to companies in Switzerland, but to their subsidiaries and branches in the EU. In Switzerland the ISA applies with its own reporting duty.
NIS2 implementation in Germany and Austria
Medium-sized and larger companies in the NIS2 sectors in Germany and Austria, including subsidiaries of Swiss groups.