NIS2 in Austria

The law

The law took effect on 2026-10-01: 9 months after publication, on the next first day of a month.

Name

Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), BGBl. I Nr. 94/2025Network and Information Systems Security Act 2026

Published

2025-12-23

In force

2026-10-01

Text

Read the NISG 2026

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where Austria differs

• § 25 NISG 2026 Partner and linked company figures are not added when your network and information systems are organisationally, technically and operationally independent.

Registration

Entities in scope on 2026-10-01 must register within 3 months. Register by 2026-12-31 to be safe. Companies that come into scope later have 3 months from that point.

Portal

Bundesamt für Cybersicherheit (electronic channel)

Rule

Deadline counts from the day you come into scope

Deadline

2026-12-31

Later entrants

3 months after you come into scope

You need

Electronic filing over a secure channel set by the authority. Check the authority's announcements for the form.

Changes

Report changes to your data within 14 days

Incident reporting

1. 24 hEarly warning
2. 72 hIncident notification
3. 1 monthFinal reportafter the notification

Send the reports to the competent CSIRT.

Measures and proof

Essential

Send a self-declaration of your measures within 12 months after the registration duty starts. On request, prove your measures through an independent audit within 2 years. Essential entities must prove the operational and organisational part within 2 months.

Important

Send a self-declaration of your measures within 12 months after the registration duty starts. The authority can request proof by an independent audit. It acts on important entities mainly after indications of a breach.

The dates, in order

1. 2026-12-31 Registration deadlineDerived from a rule in the law Next
2. 2027-10-01 Self-declaration due (12 months after the duties start on 2026-10-01)Derived from a rule in the law
3. 2028-10-01 Earliest first request for independent proof

Fines

The ceiling is the higher of a fixed amount and a share of the worldwide annual turnover of the group.