NISG 2026: does NIS2 apply to your organisation in Austria?

Austria's NISG 2026 has applied in full since 1 October 2026. The form gives an indication of whether your organisation is likely in scope. It does not replace the Bundesamt für Cybersicherheit or the text of the Act.

Indicative only, not legal advice.

Check your organisation

Your answers stay in this browser. Submitting the form does not send them to a server, and the page does not store them.

Activity

Annex I is sectors of high criticality. Annex II is other critical sectors. If more than one activity fits, run the check again. Confirm the stricter result with the competent authority.

Size

Use annual figures in euro. Headcount is the number of employees (annual work units if you have them). Medium means 50 or more employees, or turnover and balance sheet total both above EUR 10 million. Large means 250 or more employees, or turnover above EUR 50 million and balance sheet total above EUR 43 million. Simplified: control can also arise from voting rights or the right to appoint the board, some investors at 25–50% don't count as partners, and a change of size category takes effect only after two consecutive years (Rec. 2003/361/EC Annex, Art. 3–4).

Linked and partner enterprises

Add 100 percent of a linked enterprise: a holding or control above 50 percent. Add only your share of a partner enterprise: a holding from 25 to 50 percent. A holding below 25 percent stays out of the total. This is the simple version of Recommendation 2003/361/EC. NIS2 says a public-sector shareholder does not by itself change the size test.

Country

Choose a Member State to see national notes. Austria, Belgium, Finland, Germany, Ireland, Italy, Luxembourg, the Netherlands, Poland, Slovenia and Sweden show national notes. Every other country says that national details are coming soon.

Possible national designation

Optional. Tick a box only if it might apply. The checker cannot see a Member State's list, so the result will tell you to check the designation.

Indicative result only. This is not a legal determination of your NIS2 status and not legal advice. Your status depends on national law and on any identification by your Member State. Confirm it with the competent authority or a qualified adviser.

Try the live demoBook a gap review

Install free from GitHub (self-hosted). Core is the free self-hosted edition.

Last checked: 1 November 2026.

NISG 2026 at a glance

The Netz- und Informationssystemsicherheitsgesetz 2026 is Article 1 of BGBl. I Nr. 94/2025, published on 23 December 2025. The Nationalrat adopted it on 12 December 2025. The main obligations apply from 1 October 2026. The NISG 2026 uses "wesentliche Einrichtung" for an essential entity and "wichtige Einrichtung" for an important entity (§ 24 NISG 2026).

Who is covered: sectors and size

Section 25 of the NISG 2026 sets thresholds. This checker uses the Directive's medium and large test. Simplified: control can also arise from voting rights or the right to appoint the board, some investors at 25–50% don't count as partners, and a change of size category takes effect only after two consecutive years (Rec. 2003/361/EC Annex, Art. 3–4). Confirm the Austrian annex with the Bundesamt für Cybersicherheit if your activity is near the edge of a sector.

The Bundesamt für Cybersicherheit

The competent authority is the Bundesamt für Cybersicherheit, under the Interior Ministry, in Vienna. Register on USP.gv.at ("NIS2 Services") by 31 December 2026 at the latest. Section 29(3) NISG 2026 requires registration within three months of the Act's entry into force on 1 October 2026; the Bundesamt für Cybersicherheit gives 31 December 2026, and the Interior Ministry's page says 1 January 2027. Entities that come into scope later must register as soon as possible and within three months. Late registration can be fined up to EUR 50,000, or EUR 100,000 for a repeat (section 45(4)). Data changes are due within two weeks.

Risk-management measures and training duties

The security measures apply from 1 October 2026. Article 20 of the Directive requires management approval, oversight and training. Keep training records and confirm the Austrian section with the Bundesamt für Cybersicherheit.

Incident reporting

Incident reporting applies from 1 October 2026. Confirm the channel with the Bundesamt für Cybersicherheit. The clocks are an early warning within 24 hours, a notification within 72 hours, and a final report no later than one month after the incident notification.

Next steps

Check another country. Read the NIS2 checklist for SMEs and the guide to NIS2 incident reporting deadlines. NIS2 compliance software and the self-hosted install are the product pages. Try the live demo or book a gap review.

Other country pages: Belgium, Finland, Germany, Ireland, Italy, Luxembourg, Netherlands, Poland, Slovenia, Sweden.

FAQ

When does the NISG 2026 apply?

The NISG 2026, BGBl. I Nr. 94/2025, has applied in full since 1 October 2026. It was published on 23 December 2025.

Is there a transition period?

Register on USP.gv.at ('NIS2 Services') by 31 December 2026 at the latest. Section 29(3) NISG 2026 requires registration within three months of the Act's entry into force on 1 October 2026. The Bundesamt für Cybersicherheit gives 31 December 2026, and the Interior Ministry's page says 1 January 2027. Entities that come into scope later must register as soon as possible and within three months.

Who is the competent authority?

The Bundesamt für Cybersicherheit, under the Interior Ministry, based in Vienna.

Do management bodies need training?

Article 20 of the Directive requires the management body to approve the risk-management measures, oversee them, and have its members follow training. The NISG 2026 uses 'wesentliche Einrichtung' for an essential entity and 'wichtige Einrichtung' for an important entity (§ 24 NISG 2026).

Is this checker legal advice?

Indicative only, not legal advice.

Directive text: Directive (EU) 2022/2555 on EUR-Lex. Size test: Commission Recommendation 2003/361/EC. Agency overview: ENISA.

Austrian sources: BGBl. I Nr. 94/2025 on RIS, Bundesamt für Cybersicherheit, legislation FAQ.