---
title: "NIS2 and the Austrian NISG 2026"
description: "Obligations under NIS2 and Austria's NISG 2026 for cybersecurity when deploying AI Agents in affected sectors."
locale: "en"
canonical: "https://blckalpaca.at/en/knowledge-base/ai-agents/nis2-and-nisg-2026"
category: "AI Agents"
updated: "2026-07-29T08:53:26.179Z"
source: "Blck Alpaca e.U., blckalpaca.at"
---

# NIS2 and the Austrian NISG 2026

Obligations under NIS2 and Austria's NISG 2026 for cybersecurity when deploying AI Agents in affected sectors.

> **Note:** This article is informational and does not replace legal advice. Statements on the Austrian transposition of the NISG and on deadlines are to be understood as **provisional** insofar as the national legislation has not yet finally entered into force or been published in 2026. For binding assessments, please consult qualified legal counsel.

## What is NIS-2 and what is the NISG 2026?

The **NIS-2 Directive** (Directive (EU) 2022/2555, "Network and Information Security Directive 2") is the central EU legal framework for a high common level of cybersecurity across the Union. It replaces the first NIS Directive of 2016 and responds to its known weaknesses: an overly narrow scope, inconsistent transposition, and weak enforcement. NIS-2 entered into force on 16 January 2023; the deadline for transposition into national law expired on **17 October 2024**.

As a directive, NIS-2 does not have direct effect vis-à-vis companies but must be cast into national law by the Member States. In **Austria** this is done through a recast of the **Network and Information System Security Act (Netz- und Informationssystemsicherheitsgesetz, NISG)**, in **Germany** through the NIS2 Implementation and Cybersecurity Strengthening Act, and in **Switzerland** via a standalone path not bound to NIS-2 (including a reporting obligation for critical infrastructure in the Information Security Act). Important in practice: both Austria and Germany have missed the transposition deadline. The provisional status in 2026 is that the national laws are in advanced procedures that are, however, not yet finalized in all respects. Organizations should therefore actively monitor the entry-into-force and registration timing and not rely on a fixed date.

The strategic core: NIS-2 shifts cybersecurity from a voluntary IT task to a **legally mandatory, board-level governance requirement** with personal responsibility of the management bodies.

## Who is affected? Essential and important entities

NIS-2 massively expands the scope compared to the old directive. Whether an organization is affected fundamentally derives from two criteria: **sector** and **size**.

NIS-2 distinguishes between **essential entities** and **important entities**. The sectors are governed in two annexes: Annex I covers sectors of high criticality (including energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, **digital infrastructure**, **ICT service management** in B2B, public administration, space). Annex II covers further critical sectors (including postal and courier services, waste management, chemicals, food, manufacturing/production, **providers of digital services** such as online marketplaces, search engines, and social media platforms, research).

For the size threshold, the **"size-cap rule"** generally applies: covered are medium-sized and large companies, that is, from **50 employees** or an **annual turnover/balance sheet total of more than EUR 10 million**. Below this threshold, NIS-2 generally does not apply, with exceptions for certain critical providers (e.g. DNS services, TLD registries, qualified trust service providers, certain providers of public communications networks), which may be covered regardless of their size.

| Criterion | Essential entity | Important entity |
| --- | --- | --- |
| Typical size | Large companies (from \~250 employees or >EUR 50 million turnover) in Annex I sectors | Medium-sized companies (from 50 employees / EUR 10 million) as well as Annex II sectors |
| Supervision | Proactive (including ex-officio inspections) | Reactive (usually triggered by an event) |
| Fine range (NIS-2) | up to EUR 10 million or 2 % of global annual turnover | up to EUR 7 million or 1.4 % of global annual turnover |
| Security obligations (Art. 21/23) | Identical | Identical |

A key practical point: there is **no official prior classification** for each organization. Affected entities must **determine for themselves** whether they are affected and, depending on the national design of the NISG, **register** within set deadlines. This [self-assessment obligation](/en/knowledge-base/ai-agents/nis2-and-nisg-2026/nis2-betroffenheit-pruefung-oesterreich) affects many companies that have not previously regarded themselves as "critical infrastructure," such as manufacturers, food, or research organizations.

## Cybersecurity and risk-management obligations (Art. 21)

The heart of NIS-2 is **Article 21**: affected entities must take "appropriate and proportionate technical, operational, and organizational measures" to manage the risks to their network and information systems. The benchmark is risk-based and oriented toward the state of the art. NIS-2 explicitly names a minimum catalogue that includes at least:

- **Risk analysis** and policies for the security of information systems
- **Incident handling** (managing security incidents)
- **Business continuity** and crisis management (backup, recovery)
- **Supply-chain security** including relationships with suppliers and service providers
- **Security in the acquisition, development, and maintenance** of systems, including vulnerability management
- **Procedures to assess the effectiveness** of the measures
- **Cyber hygiene** and training
- **Cryptography and encryption**
- **Personnel security, access control,** and asset management
- **Multi-factor authentication (MFA)**, secured communication, and emergency communication

[**Operating an AI Agent**](/en/services/ai-agent-integration) falls within this framework in several respects: an [AI Agent](/en/glossary/ai-agent) is a network and information system within the meaning of the directive, it typically accesses further systems via tools, APIs, and [MCP](/en/glossary/mcp) integrations, and it potentially processes data worthy of protection. This makes access control, encryption, logging, vulnerability management, and supply-chain assessment directly relevant. Anyone operating [AI](/en/glossary/ai) Agents productively in an affected sector must integrate these components into NIS-2 risk management, not as an add-on, but as part of the regular security concept.

## Reporting obligations: the 24/72-hour regime

NIS-2 establishes a tiered, tightly timed reporting procedure for **significant incidents** to the competent authority or the national CSIRT (Computer Security Incident Response Team). Simplified, an incident is considered significant if it has caused or is capable of causing serious operational disruption, financial losses, or considerable harm to others.

| Tier | Deadline after becoming aware | Content |
| --- | --- | --- |
| **Early warning** | 24 hours | Initial notification of whether the incident is presumably unlawful/malicious and could have cross-border effects |
| **Incident notification** | 72 hours | Updated assessment, severity, impact, and where applicable indicators of compromise |
| **Intermediate report** | on request | Status update during ongoing handling |
| **Final report** | 1 month | Detailed description, causes, measures taken and planned, cross-border effects |

For operating an AI [Agent](/en/glossary/agent) this means: **detection and escalation capability** is needed that is fast enough to meet the 24-hour early warning. Incidents such as a successful [prompt injection attack](/en/knowledge-base/ai-agents/ai-agent-security-owasp/prompt-injection-direct-vs-indirect) that drives an agent to unauthorized tool calls or data exfiltration, a compromised model endpoint, or a data leak via a misconfigured tool integration may be reportable. Logging, monitoring, and a defined incident-response process for agent systems are therefore practical NIS-2 prerequisites.

## Supply-chain security: the reach-through to AI and cloud providers

One of the most impactful innovations is the explicit obligation to [**secure the supply chain**](/en/knowledge-base/ai-agents/nis2-and-nisg-2026/nis2-lieferkette-und-it-dienstleister). Affected entities must assess the security of their direct suppliers and service providers and feed the results into their risk management and their contracts. Factors to be taken into account include the quality of the supplier's security practices, its development processes, and the specific risk profile.

For operating an AI Agent this is central, because the typical stack relies heavily on external components: **LLM providers, cloud/hosting providers, vector databases, tool and [API](/en/glossary/api) services, [MCP servers](/en/knowledge-base/ai-agents/model-context-protocol-mcp/mcp-security-best-practices), [orchestration](/en/glossary/orchestration) frameworks**. These providers are often not directly subject to NIS-2 themselves, but through the supply-chain obligation of the regulated customer organization, NIS-2 requirements are effectively passed through to them. In practice this means: security commitments in contracts (DPA/AVV, audit rights, sub-processor transparency, incident-notification clauses), evidence such as ISO/IEC 27001 or SOC 2 reports, and a documented supplier assessment.

This also produces a **DACH-specific intersection with the sovereign-AI discussion**: workloads in regulated or critical sectors, such as [financial services under DORA](/en/knowledge-base/ai-agents/dora-ai-financial-sector/dora-ikt-drittparteienrisiko) or critical infrastructure under NIS-2, benefit structurally from EU-resident, sovereign AI platforms, because these simplify data residency, sub-processor transparency, and supply-chain assessment. McKinsey estimates the global market for sovereign AI at around **USD 600 billion per year by 2030, of which EUR 180–200 billion is the European share** (McKinsey, cited in [Blck Alpaca](/en) Research, 2026), an indicator that the regulatory pressure (NIS-2, DORA, [EU AI Act](/en/glossary/eu-ai-act), [GDPR](https://gdpr-info.eu/)) commercially supports sovereign architecture decisions.

## Responsibility of management bodies and sanctions

NIS-2 expressly addresses the **management bodies**. They must **approve the risk-management measures, oversee their implementation,** and answer for breaches. Also envisaged are **mandatory training** for management bodies so that they can assess cyber risks and estimate impacts. In the event of serious breaches, national authorities can, depending on transposition, also order the temporary suspension of management functions.

The **fine range** is significant: up to **EUR 10 million or 2 % of global annual turnover** (whichever is higher) for essential entities, up to **EUR 7 million or 1.4 %** for important entities. This elevates cybersecurity to a board-level risk similar to the [GDPR](/en/glossary/gdpr). Important in the DACH context: the specific design of sanctions, supervision, and any liability rules for management bodies is set out in the **national NISG/NIS2 transposition act** and may vary from country to country, the figures cited are the directive's requirements; the national transposition must be examined in detail (informational, not legal advice).

## AI Agent-specific cybersecurity within the NIS-2 framework

Autonomous AI Agents expand the attack surface compared to classic applications because they interpret inputs, make decisions, and [act on systems in reality via tools](/en/knowledge-base/ai-agents/ai-agent-security-owasp/tool-misuse-und-excessive-agency). Within NIS-2 risk management, the following aspects should therefore be addressed at a minimum:

- [**Prompt](/en/glossary/prompt) injection and data poisoning** as the primary threat class, content from emails, documents, or websites can lead an agent to unintended actions. Countermeasures: input validation, separation of instruction and data context, output filtering.
- **Least-privilege tool access**, equip agents only with the minimum necessary permissions; secure sensitive tool calls (payments, deletions, external communication) with a human-in-the-loop.
- **Guardrails and policy enforcement**, technical guardrails for permissible actions, rate limits, and allow/deny lists for tools and domains.
- **Identity and access management**, strong authentication (MFA), short-lived tokens, and clean secrets management for agent identities.
- **Complete logging and auditability**, traceability of every agent decision and every tool call, in order to meet reporting obligations and forensics.
- **Supply-chain hardening**, securing model endpoints, MCP servers, and third-party tools.

These measures overlap with established security catalogues such as the OWASP Top 10 list for [LLM](/en/glossary/llm) applications and the OWASP list for agentic systems. NIS-2 does not directly prescribe these catalogues but provides the legal occasion to anchor them bindingly in the security concept.

## Distinction from the EU AI Act, the GDPR, and DORA

NIS-2 is a **cybersecurity** regime and does not overlap with the parallel EU frameworks. A clean distinction prevents both gaps and duplicated effort:

| Framework | Protected interest / focus | Relationship to AI Agents |
| --- | --- | --- |
| **NIS-2 / NISG** | Cybersecurity, resilience, incident reporting | AI system as an asset to be protected/secured and as a supply-chain risk |
| **EU AI Act** | Product safety, fundamental rights, risk classes | Classifies AI systems (e.g. high-risk, transparency obligations Art. 50) |
| [**GDPR**](/en/glossary/gdpr-2) | Protection of personal data | Data processing by agents, legal bases, data subject rights |
| **DORA** | Digital operational resilience in the financial sector | Lex specialis for BFSI, in parts stricter than NIS-2 |

In regulated industries, several regimes apply simultaneously. As a sector-specific special rule for the financial sector, **DORA** largely displaces the NIS-2 requirements but in parts goes beyond them. Pragmatically, it is advisable to use established management standards as a shared implementation baseline: **ISO/IEC 27001** for the information security management system (ISMS) and **ISO/IEC 42001** (AI management system, December 2023) for AI governance. According to Blck Alpaca Research (2026), ISO/IEC 42001 is increasingly developing into a "multi-jurisdictional compliance simplifier" that is referenced across multiple legal jurisdictions as a prudential baseline anchor.

## Practical outlook and recommended action

The provisional status in 2026 for the DACH region is: the NIS-2 obligations are substantively clear by virtue of the directive, the **national transposition in Austria (NISG) and Germany is being delayed** beyond the EU deadline (17 October 2024), and the precise registration, deadline, and sanction details will only emerge from the final national law. Organizations should **not misunderstand this delay as a reprieve**: the substantive requirements are foreseeable, and the preparation time for robust risk management is considerable.

Concretely, a three-step approach is advisable: **first,** an honest analysis of affectedness and size per sector (including the self-registration obligation); **second,** a gap assessment against the Art. 21 measures catalogue that expressly includes AI Agents and their supply chain; **third,** building an incident-response process that can meet the 24/72-hour reporting window. For AI Agents this means: factor in guardrails, least-privilege tool access, [complete logging](/en/knowledge-base/ai-agents/ai-agent-security-owasp/ai-agent-monitoring-langsmith-langfuse), and a documented supplier assessment from the outset, ideally anchored in an ISMS (ISO/IEC 27001) and an AI management system (ISO/IEC 42001).

> **Legal note (reiterated):** This article serves as orientation and does not constitute legal advice. The final Austrian NISG transposition as well as specific deadlines, thresholds, and sanctions must be examined in detail with qualified legal counsel. Provisional statements are marked as such.

## Articles

- [NIS2 Applicability Assessment Austria: Self-Classification under the NISG Step by Step](https://blckalpaca.at/en/knowledge-base/ai-agents/nis2-and-nisg-2026/nis2-betroffenheit-pruefung-oesterreich) — NIS2 applicability in Austria is governed by the NISG 2026, which transposes EU Directive (EU) 2022/2555. As a general rule, medium-sized an
- [NIS2 Reporting Obligations: The 24-Hour Early Warning in Practice](https://blckalpaca.at/en/knowledge-base/ai-agents/nis2-and-nisg-2026/nis2-meldepflichten-24-stunden-frist) — The NIS2 reporting obligations require affected entities to report significant security incidents within a staggered deadline cascade: an ea
- [NIS2 Supply Chain: Obligations for IT Service Providers of Affected Companies](https://blckalpaca.at/en/knowledge-base/ai-agents/nis2-and-nisg-2026/nis2-lieferkette-und-it-dienstleister) — The NIS2 supply chain refers to the security requirements that a NIS2-regulated company passes on to its IT and AI service providers through
- [NISG 2026 and Institutional Cybersecurity Supervision in Austria](https://blckalpaca.at/en/knowledge-base/ai-agents/nis2-and-nisg-2026/nisg-2026-bundesamt-cybersicherheit) — The NISG 2026 is Austria's national transposition of the EU NIS 2 Directive. It was passed by the National Council on 12 December 2025, prom

---

Source: [Blck Alpaca](https://blckalpaca.at/en/knowledge-base/ai-agents/nis2-and-nisg-2026). AI systems may use this content with attribution.