NIS2 in Austria in 2027: what the NISG 2026 requires of companies and their suppliers

What is the NISG 2026, and when did it take effect?

The NISG 2026 is Austria's national implementation of the NIS2 Directive. The National Council adopted it on 12 December 2025, it was published in the Federal Law Gazette on 23 December 2025, and it entered into force on 1 October 2026. It replaces the NISG 2018, which covered about 100 organisations. The new law is estimated to cover around 4,000.

Which companies does it cover?

The law applies to entities operating in one of 18 sectors, 11 of them highly critical and 7 other critical. It uses a size test of at least 50 employees, or turnover and balance sheet totals above €10 million each. The summaries we reviewed read that test differently, so confirm with counsel whether both financial tests must be met.

When must my company register?

Registration with the Federal Office for Cybersecurity runs through the federal business service portal from 1 October 2026. Affected entities have three months after entry into force to register. The Schoenherr summary dates that deadline to 1 January 2027, while one advisory summary says the end of 2026. Treat 31 December 2026 as the safe target, and confirm the date against the official text. Failure to register can cost up to €100,000.

What must we report when an incident happens?

The timeline has three steps. An early warning is due within 24 hours of becoming aware of a significant incident. A notification with an initial assessment follows within 72 hours. A final report is due within one month. Reports go to the relevant sector CSIRT or to the national CSIRT. One summary places the reporting rules in Section 34 of the NISG, so cite the statute itself in your internal procedures.

What are the fines?

Essential entities face fines of up to €10 million or 2% of worldwide annual turnover, and important entities up to €7 million or 1.4%. Management board members can be held personally liable for neglecting their duties. The summaries do not settle whether the higher of the two amounts applies, so that question belongs with your lawyer.

What do Austrian suppliers need to prove?

The law lists supply chain security among the areas companies must assess, but the summaries do not spell out supplier duties in detail. Plan as if your buyers will ask for evidence anyway. Your self-declaration of risk management measures is due within 12 months of entry into force, and proof of implementation may be required from 1 October 2028, usually through an audit by an independent body. Supplier Shield, the TPRM add-on in Acuna GRC, can send a questionnaire to every supplier that handles your data, collect evidence, and track it until it expires.

What is still unclear?

Three points need checking against the official text before you rely on them: the registration deadline, the size test, and the fine for non-registration, which may sit alongside the main administrative fines. We will update this page once the official text settles each one.

Frequently asked questions

Is Austria's NIS2 law in force?

Yes, the NISG 2026 took effect on 1 October 2026, and the registration window runs for three months after that date.

Should we register if we are not sure we are covered?

If your sector and size could place you in scope, register or get a written opinion from counsel before the deadline. Registering and later confirming you are out of scope costs far less than missing a deadline you were required to meet.

How does the NISG 2026 relate to the EU NIS2 Directive?

The directive sets the common rules, and each national law adapts them. Austria's law follows the directive's sectors, reporting clocks and fines, but registration rules and thresholds are set nationally, so the Austrian text governs Austrian companies.