The most important thing in brief:
- The NISG 2026 has applied since October 1, 2026. Austria's Network and Information System Security Act 2026 is in force. Around 4,000 companies across 18 sectors must register with the Federal Office for Cybersecurity by the end of December 2026 and submit a self-declaration by September 30, 2027.
- Management is personally liable. The NISG 2026 makes cybersecurity an explicit duty of the management body, including mandatory training and personal liability where those duties are neglected.
- The evidence requirement rests on IT documentation. Passing the self-declaration takes a documented asset inventory, a risk analysis and measures linked to both. Without that foundation the evidence is missing, however good the security controls themselves may be.
Austria's Network and Information System Security Act 2026 (NISG 2026), the country's new NIS law, has applied since October 1, 2026. Around 4,000 companies have to register with the Federal Office for Cybersecurity before the end of the year. If you're only starting now, you have less than ten weeks to handle registration, risk analysis and a documentation base that holds up as evidence.
This article sets out what the NISG 2026 requires, which deadlines are running, and how to meet the evidence obligations without a disproportionate effort.
What is the NISG 2026?
The NISG 2026 is Austria's transposition of the European NIS2 Directive (EU 2022/2555). It replaces the former NISG 2018 in full and has applied since October 1, 2026. The National Council passed the act on December 12, 2025 with a two-thirds majority, and it was promulgated in the Federal Law Gazette on December 23, 2025 (BGBl. I No. 94/2025).
At its core the law requires three things of affected organizations: implement technical and organizational security measures, report significant security incidents within 24 hours, and document every measure so that it stands up as evidence before the Federal Office for Cybersecurity at the Ministry of the Interior.
The change in scope is substantial. Where the NISG 2018 covered around 100 operators of critical infrastructure, the NISG 2026 extends the scope to roughly 4,000 companies across 18 sectors.
One note on terminology. When people in Austria talk about NIS2, what applies to companies is always the NISG 2026. The EU directive has no direct effect of its own, so the national act is what counts.
What changed in October 2026?
The picture for affected companies has sharpened considerably since October 1, 2026. All substantive duties now apply. Risk management, reporting obligations and documentation requirements took effect immediately, not from the point of registration. Alongside the act, the accompanying NIS Regulation 2026 (NISV 2026) also entered into force. It sets out the detailed requirements for risk management measures and defines the criteria for a significant cybersecurity incident.
Registration runs through the Business Service Portal (USP), which went live on October 1. The deadline is December 31, 2026. Because January 1, 2027 is a public holiday, Section 33(2) of the General Administrative Procedure Act moves the effective cut-off to the next working day, January 4, 2027.
In parallel, software vendors have started building NISG-specific rule sets into their ISMS modules, with objectives derived directly from the statutory text. That makes structured assessment and evidence for the self-declaration considerably easier.
Which companies are affected?
Two criteria decide whether the NISG 2026 applies to your organization: sector and size.
The act covers 18 sectors, among them energy, transport, healthcare, drinking water and wastewater, digital infrastructure, banking, public administration, food production, waste management, manufacturing and research. Annexes 1 and 2 of the act carry the full list.
In scope are medium-sized and large companies with at least 50 employees, or annual turnover or a balance sheet total above 10 million euros. Smaller companies below those thresholds are generally excluded, with one important qualification: sole providers of critical services, TLD name registries, DNS service providers and providers of public communications networks fall under the act regardless of size.
The NISG 2026 distinguishes two categories:
- Essential entities, large companies in sectors of high criticality such as energy, transport and health. They face stricter supervision and higher penalties.
- Important entities, medium-sized companies in those same sectors plus large and medium-sized companies in other critical sectors. Supervision here is primarily incident-driven.
Many companies underestimate indirect exposure. Even outside the 18 sectors, a supplier or IT service provider to an affected company can end up carrying contractual evidence obligations.
The Austrian Economic Chamber's NIS2 scope guide offers a first orientation. For a deeper analysis, see our article on who is affected by NIS2.
Which deadlines apply now?
The NISG 2026 timeline is fixed. Since October 1, 2026 all duties apply with no transition period, and the NISG 2018 together with the old NISV ceased to apply on the same day.
The next deadline is registration by December 31, 2026. Affected companies register with the Federal Office for Cybersecurity through the USP. Registration requires master data, sector, classification and IP address ranges. Any subsequent change has to be reported within two weeks.
Two further milestones follow:
- September 30, 2027, self-declaration. Affected companies submit a structured account of their risk management measures, the results of their risk analysis and their supply chain security to the cybersecurity authority.
- From October 1, 2028, regulatory audits. The authority can request evidence and order audits by independent bodies. Essential entities must demonstrate the organizational part within two months.
How is management liable?
The NISG 2026 makes cybersecurity a board-level matter, and not only figuratively. Under Section 31 of the act, management bodies are personally responsible for compliance with the cybersecurity requirements. That covers managing directors at limited companies and board members at stock corporations.
Three duties are written into the law. Management has to approve the risk management measures, oversee their implementation and attend cybersecurity training designed for management bodies. Neglecting any of them risks regulatory sanctions and recourse claims under company law.
Our main article on the NIS2 Directive, linked above, covers management liability and the parallels across the DACH region in more detail.
What penalties apply?
The sanctions regime is tiered and markedly tougher than under the previous act. Essential entities face fines of up to 10 million euros or 2 percent of worldwide annual turnover. On top of that, the authority can impose a temporary ban on individuals holding management responsibilities. For important entities the ceilings are 7 million euros or 1.4 percent of turnover.
Organizational breaches are treated separately. Failing to register or missing the self-declaration deadline carries fines of up to 50,000 euros, rising to 100,000 euros for repeat offenses.
Enforcement sits with the Federal Office for Cybersecurity at the Ministry of the Interior. Essential entities can be audited proactively at any time, while important entities face an incident-driven regime. No NIS2 fines have been issued in Austria so far, and observers expect the first proceedings once the registration deadline has passed.
Why does the supply chain matter so much?
The NISG 2026 does not stop at your own company boundary. Affected entities have to assess the cybersecurity of their direct service providers and suppliers and write security requirements into their contracts.
So even if the act does not apply to you directly, you can be caught indirectly as an IT service provider, managed service provider or supplier to an affected company. Large customers will ask for contractual evidence covering backup strategies, access concepts and incident response capability. If you can't document your infrastructure transparently, you risk more than a compliance problem, you risk the business relationship. The main NIS2 Directive article linked above goes into the supply chain obligations in depth.
How does NIS2 in Austria differ from Germany?
Both countries have transposed the NIS2 Directive, but on different timetables. Germany's NIS2 implementation act took effect on December 6, 2025 with no transition period. The NISG 2026 allowed nine months after promulgation. For a detailed comparison, see our article on the NIS2 Directive and its implementation in Germany.
The terminology differs in subtle ways. Germany speaks of “particularly important” and “important” entities, Austria of “essential” and “important” ones. The categories are broadly comparable but differ in the detailed rules.
Austria also took its own path on supervision. Instead of the Federal Office for Information Security (BSI), the Federal Office for Cybersecurity at the Ministry of the Interior holds the mandate. In Germany only around 11,500 of an estimated 29,500 affected companies had registered by March 2026. No comparable figures exist for Austria yet, since registration only opened on October 1, 2026.
This matters for groups operating on both sides of the border: two separate clocks are running, and a German parent cannot assume its Austrian subsidiary is covered by the same registration.
Switzerland, as a non-EU member, is not directly affected. Swiss companies with EU business relationships still feel the requirements through the supply chain obligation.
What do Austrian companies need to do now?
The duties apply. If you haven't started, these five steps deserve priority.
1. Clarify whether you're in scope. Check sector and size criteria to establish whether you qualify as an essential or an important entity. Factor in indirect exposure through the supply chain as well. The Economic Chamber guide linked above is a reasonable starting point.
2. Complete the registration. Registration runs through the Business Service Portal (USP) under “NIS2 Services,” with a deadline of December 31, 2026. You'll need master data, sector classification, your categorization as an essential or important entity, contact details for security incidents and IP address ranges.
3. Inventory your IT infrastructure. A complete record of every system, network, application and access right is the basis for both the risk analysis and the self-declaration. Neither holds up without it. Agentless inventory tools such as Docusnap make this a matter of hours rather than weeks.
4. Build the risk management. The NISG 2026 calls for risk analyses, backup strategies with tested restores, patch management, access concepts, contingency plans and staff training. Implementing Regulation (EU) 2024/2690 is a useful reference, since it already sets out concrete requirements for digital sectors.
Since October, the ISMS module in Docusnap365 has carried a dedicated NISG (Austria) rule set with 52 objectives derived directly from the statutory text. You activate the rule set, assess the objectives, link measures and attach evidence. That gives you the structured basis for the self-declaration due in September 2027, with a traceable maturity rating per objective.
5. Set up reporting processes. Define who decides, who reports and who communicates before an incident happens. The 24-hour early warning deadline leaves no room for improvisation.
How did the NISG 2026 come about?
The NISG 2026 had an unusually turbulent legislative history. The first draft failed in the National Council in 2024, a rare outcome for an EU transposition act, before a revised version passed at the end of 2025 with a broad majority.
- February 2024. The first draft (NISG 2024) fails in the National Council. The SPÖ, FPÖ and NEOS criticize drafting flaws and insufficient stakeholder consultation.
- December 12, 2025. The National Council passes the revised NISG 2026 with a two-thirds majority (ÖVP, SPÖ, NEOS and the Greens).
- December 23, 2025. Promulgation in the Federal Law Gazette (BGBl. I No. 94/2025).
- October 1, 2026. The act takes effect.
Compared with the failed 2024 draft, the NISG 2026 brings more workable deadlines, a sharper supervisory regime and the new Federal Office for Cybersecurity as the central authority. For the EU-wide picture, see the main article on the NIS2 Directive linked above.
FAQ NISG 2026 Austria
When did the NIS law take effect in Austria?
The NISG 2026 entered into force on October 1, 2026, nine months after its promulgation. It transposes the EU NIS2 Directive (EU 2022/2555) into Austrian law and replaces the former NISG 2018 in full. The old 2018 NIS law ceased to apply on the same day.
When is the registration deadline?
Affected companies register with the Federal Office for Cybersecurity through the Business Service Portal (USP) by December 31, 2026. Because January 1 is a public holiday, Section 33(2) of the General Administrative Procedure Act extends the effective cut-off to January 4, 2027. Any later change to the registered details must be reported within two weeks.
What is the self-declaration under the NISG 2026?
The self-declaration is a structured account that affected companies submit to the cybersecurity authority within twelve months of becoming subject to registration, which works out as September 30, 2027. It covers the network and information systems in use, the results of the risk analysis, the status of implemented measures and an assessment of supply chain security.
What is the difference between the NISG 2026 and the NIS2 Directive?
The NIS2 Directive (EU 2022/2555) is the EU-level framework. The NISG 2026 is its transposition into Austrian law, with its own deadlines, supervisory structures and detailed rules. For companies operating in Austria, the NISG 2026 is the binding instrument. Germany's equivalent is covered in our article on the NIS2 implementation in Germany.
What role does IT documentation play under the NISG 2026?
Without complete IT documentation there is no basis for the risk analysis, the self-declaration or an audit. The NISG 2026 requires companies to document their systems, permissions and security measures in a way that can be evidenced. Automated inventory keeps that documentation current beyond a single reporting date, which is what the ongoing obligation actually demands.
