NIS2 and the Austrian NISG 2026

What is NIS-2 and what is the NISG 2026?

The NIS-2 Directive (Directive (EU) 2022/2555, "Network and Information Security Directive 2") is the central EU legal framework for a high common level of cybersecurity across the Union. It replaces the first NIS Directive of 2016 and responds to its known weaknesses: too narrow a scope, inconsistent transposition, and weak enforcement. NIS-2 entered into force on January 16, 2023; the deadline for transposition into national law expired on October 17, 2024.

As a directive, NIS-2 does not apply directly to companies; the member states must transpose it into national law. Austria has done so with the Network and Information Systems Security Act 2026 (NISG 2026). The National Council passed it on December 12, 2025, and it was promulgated on December 23, 2025, as BGBl. I Nr. 94/2025. It has applied since October 1, 2026, and replaces the NISG 2018. Germany transposed NIS-2 with the Act Implementing the NIS-2 Directive (BGBl. 2025 I Nr. 301), which has applied since December 6, 2025. Both countries thus missed the EU deadline by more than a year. Switzerland is taking its own path that is not bound to NIS-2 (including a reporting obligation for critical infrastructure in the Information Security Act).

The strategic core: NIS-2 turns cybersecurity from a voluntary IT task into a legally mandatory, board-level governance requirement with personal accountability for management bodies.

What the NISG 2026 regulates in Austria

The NISG 2026 adopts the obligations of the directive and sets the authority, deadlines, and penalties for Austria. The key points according to the statutory text in the RIS:

• Authority: The competent authority is the Federal Office for Cybersecurity (Bundesamt für Cybersicherheit), which reports directly to the Federal Minister of the Interior (§ 3a).
• Registration: Essential and important entities register with the authority within three months of the act entering into force (§ 29(3)). They must provide, among other things, their sector, type of entity, contact details, and the thresholds that determine their classification.
• Self-declaration: Within twelve months after the registration obligation arises, entities submit information on their risk-management measures, including supply-chain security and the results of their risk analysis (§ 33(1)).
• Reporting obligations: An early warning within 24 hours and a notification within 72 hours of becoming aware of a significant cybersecurity incident, and a final report no later than one month after that notification (§ 34(2)).
• Management bodies: They must ensure and oversee compliance with the risk-management measures and attend cybersecurity training (§ 31). If an essential entity fails to comply with an official order, the authority can temporarily prohibit its management bodies from exercising management functions (§ 39(4)).
• Penalties: up to EUR 10 million or 2% of the previous year's worldwide turnover for essential entities and up to EUR 7 million or 1.4% for important entities. Other violations listed in § 45(4) carry fines of up to EUR 50,000, or up to EUR 100,000 for repeat offenses (§ 45).

The applicability assessment under the NISG shows how you check the classification for your organization. The article NISG 2026 and Institutional Cybersecurity Supervision in Austria explains how supervision is organized.

Who is affected? Essential and important entities

NIS-2 expands the scope massively compared to the old directive. Whether an organization is covered depends in principle on two criteria: sector and size.

NIS-2 distinguishes between essential entities and important entities. The sectors are set out in two annexes: Annex I covers sectors of high criticality (including energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management in B2B, public administration, space). Annex II covers other critical sectors (including postal and courier services, waste management, chemicals, food, manufacturing, digital providers such as online marketplaces, search engines, and social media platforms, research).

For the size threshold, the "size-cap rule" generally applies: it covers medium-sized and large companies, meaning those with 50 or more employees or an annual turnover or balance sheet total of more than EUR 10 million. Below this threshold, NIS-2 generally does not apply, with exceptions for certain critical providers (e.g., DNS services, TLD registries, qualified trust service providers, certain providers of public communications networks), which can be covered regardless of their size.

A key practical point: there is no prior classification by the authorities for each organization. Affected entities must determine for themselves whether they are covered and register within the national deadline. In Austria, that is three months from October 1, 2026. This self-assessment obligation affects many companies that have not previously considered themselves "critical infrastructure," such as manufacturers, food companies, or research organizations.

Cybersecurity and risk-management obligations (Art. 21)

The core of NIS-2 is Article 21: affected entities must take "appropriate and proportionate technical, operational and organizational measures" to manage the risks to their network and information systems. The standard is risk-based and follows the state of the art. NIS-2 explicitly lists a minimum catalog that includes at least:

• Risk analysis and policies for the security of information systems
• Incident handling (managing security incidents)
• Business continuity and crisis management (backup, recovery)
• Supply-chain security, including relationships with suppliers and service providers
• Security in the acquisition, development, and maintenance of systems, including vulnerability management
• Procedures to assess the effectiveness of the measures
• Cyber hygiene and training
• Cryptography and encryption
• Personnel security, access control, and asset management
• Multi-factor authentication (MFA), secured communication, and emergency communication

Operating AI agents falls within this framework in several ways: an AI agent is a network and information system within the meaning of the directive, it typically accesses other systems through tools, APIs, and MCP connections, and it potentially processes sensitive data. That makes access control, encryption, logging, vulnerability management, and supply-chain assessment directly relevant. If you run AI agents in an affected sector in production, you must integrate these components into your NIS-2 risk management as part of your regular security program, not as an add-on.

Reporting obligations: the 24/72-hour regime

NIS-2 establishes a tiered, tightly timed procedure for reporting significant incidents to the competent authority or the national CSIRT (computer security incident response team). Put simply, an incident is significant if it has caused or can cause severe operational disruption, financial losses, or considerable damage to others.

For AI agent operations, this means you need detection and escalation capabilities fast enough to meet the 24-hour early warning deadline. Incidents such as a successful prompt injection attack that drives an agent to make unauthorized tool calls or exfiltrate data, a compromised model endpoint, or a data leak through a misconfigured tool integration can be reportable. Logging, monitoring, and a defined incident response process for agent systems are therefore practical NIS-2 prerequisites.

Supply-chain security: how the obligations extend to AI and cloud providers

One of the most far-reaching changes is the explicit obligation to secure the supply chain. Affected entities must assess the security of their direct suppliers and service providers and feed the results into their risk management and their contracts. Factors to consider include the quality of the supplier's security practices, its development processes, and the specific risk profile.

For AI agent operations, this is central because the typical stack relies heavily on external components: LLM providers, cloud and hosting providers, vector databases, tool and API services, MCP servers, orchestration frameworks. These providers are often not directly subject to NIS-2 themselves, but the supply-chain obligation of the regulated customer organization effectively passes NIS-2 requirements on to them. In practice, that means security commitments in contracts (DPA, audit rights, sub-processor transparency, incident notification clauses), evidence such as ISO/IEC 27001 or SOC 2 reports, and a documented supplier assessment.

This is also where a DACH-specific link to the sovereign AI debate emerges: workloads in regulated or critical sectors, such as financial services under DORA or critical infrastructure under NIS-2, benefit structurally from EU-resident, sovereign AI platforms because these simplify data residency, sub-processor transparency, and supply-chain assessment. McKinsey expects sovereignty requirements to influence 30 to 40 percent of AI spending and puts this market at around USD 500 to 600 billion worldwide by 2030 (McKinsey, "Sovereign AI: Building ecosystems for strategic resilience and impact", March 2026). Regulation such as NIS-2, DORA, the EU AI Act, and the GDPR is one of the drivers of this demand.

Management responsibility and sanctions

NIS-2 explicitly addresses management bodies. They must approve the risk-management measures and oversee their implementation, and they are accountable for violations. The directive also provides for mandatory training for management bodies so that they can assess cyber risks and their impact. For serious violations, national authorities can, depending on the transposition, also order the temporary suspension of management functions.

The range of fines is significant: up to EUR 10 million or 2% of worldwide annual turnover (whichever is higher) for essential entities, and up to EUR 7 million or 1.4% for important entities. That moves cybersecurity to a board-level risk tier similar to the GDPR. Austria's NISG 2026 adopts these maximum amounts (§ 45). Supervision, procedures, and further penalty ranges are set by each national law; in Germany, that is the BSI Act newly enacted with the NIS-2 transposition.

Cybersecurity for AI agents within the NIS-2 framework

Autonomous AI agents expand the attack surface compared to conventional applications because they interpret inputs, make decisions, and act on real systems through tools. Within NIS-2 risk management, you should therefore address at least the following aspects:

• Prompt injection and data poisoning: the primary threat class. Content from emails, documents, or websites can lead an agent to take unintended actions. Countermeasures: input validation, separation of instruction and data context, output filtering.
• Least-privilege tool access: give agents only the minimum permissions they need, and secure sensitive tool calls (payments, deletions, external communication) with a human in the loop.
• Guardrails and policy enforcement: technical limits on permitted actions, rate limits, and allow/deny lists for tools and domains.
• Identity and access management: strong authentication (MFA), short-lived tokens, and clean secrets management for agent identities.
• Complete logging and auditability: traceability of every agent decision and every tool call, to meet reporting obligations and support forensics.
• Supply-chain hardening: securing model endpoints, MCP servers, and third-party tools.

These measures overlap with established security catalogs such as the OWASP Top 10 for LLM Applications and the OWASP list for agentic systems. NIS-2 does not prescribe these catalogs directly, but it provides the legal reason to anchor them as binding parts of your security program.

Distinction from the EU AI Act, GDPR, and DORA

NIS-2 is a cybersecurity regime and is not congruent with the parallel EU frameworks. A clear distinction prevents both gaps and duplicated effort:

In regulated industries, several regimes apply at the same time. As a sector-specific special regulation for the financial sector, DORA largely displaces the NIS-2 requirements but goes beyond them in places. In practice, it makes sense to use established management standards as a shared implementation baseline: ISO/IEC 27001 for the information security management system (ISMS) and ISO/IEC 42001 (AI management system, December 2023) for AI governance. As a certifiable management standard, ISO/IEC 42001 is not tied to any legal system and can therefore serve as a common foundation for several regimes.

Practical outlook and recommended actions

The status as of October 2026: the directive makes the NIS-2 obligations clear in substance, and the national laws apply, in Germany since December 6, 2025, and in Austria since October 1, 2026. Affected Austrian entities must now register within the three-month deadline; the self-declaration follows within twelve months after the registration obligation arises. There is no longer any grace period: the requirements apply, and sound risk management is not built in a few weeks.

Specifically, a three-step approach makes sense: first, an honest analysis of applicability and size for each sector (including the self-registration obligation); second, a gap assessment against the Art. 21 catalog of measures that explicitly includes AI agents and their supply chain; third, building an incident response process that can meet the 24/72-hour reporting window. For AI agents, this means planning for guardrails, least-privilege tool access, complete logging, and a documented supplier assessment from the start, ideally anchored in an ISMS (ISO/IEC 27001) and an AI management system (ISO/IEC 42001).