NIS2 Applicability Assessment Austria: Self-Classification under the NISG Step by Step

Whether your company is covered by NIS2 is determined in Austria by the NISG 2026, which transposes EU Directive (EU) 2022/2555 (NIS2) into national law. The basic rule: medium-sized and large enterprises are covered, that is, organizations with 50 or more employees or with both annual turnover and annual balance sheet total above EUR 10 million, provided they operate in one of the 18 sectors covered. What is new is the shift to self-classification: you must determine your applicability yourself, no longer an authority by means of an official ruling.

This article walks you through self-classification with an assessment table, three case examples and the most important special cases. It provides professional orientation but does not replace legal advice.

• Size: 50 or more employees, or both annual turnover and annual balance sheet total above EUR 10 million (EU definition of medium-sized enterprises).
• Sector: Activity in one of the 18 sectors under Annex I or II of the NIS2 Directive.
• Procedure: Self-classification and self-declaration instead of an official ruling. Responsibility lies with the company.

Legal framework: NISG 2026 and the transposition delay

The NIS2 Directive (EU) 2022/2555 was required to be transposed into national law across the EU by 17 October 2024. Austria significantly exceeded this deadline. The first attempt, the NISG 2024, was rejected in the National Council on 3 July 2024 because the two-thirds majority required for parts of the act was not reached.

The revised draft, the NISG 2026, was finally passed by the National Council on 12 December 2025 and promulgated in the Federal Law Gazette on 23 December 2025. Under Section 51 NISG 2026, it entered into force on the first day of the month following the expiry of nine months, that is, on 1 October 2026. The obligations have applied directly since then. If you have not yet completed your self-classification, do it now: registration must take place within three months of entry into force (Section 29(3) NISG 2026).

The NISG 2026 brings several structural innovations compared with the 2024 draft:

• Establishment of a Federal Office for Cybersecurity within the Federal Ministry of the Interior (BMI) as the competent cybersecurity authority.
• A shift to self-classification and self-declaration instead of an official declaratory ruling.
• Supervisory bodies (for example supervisory boards) are expressly excluded from the concept of the "management body".
• A half-yearly (instead of annual) cybersecurity report.

The scope covers around 4,000 companies across 18 sectors. Members of the management bodies of essential and important entities must attend cybersecurity training designed specifically for them (Section 31(2) NISG 2026); an incident-response team must be set up.

The two categories: essential and important entities

Like the EU Directive, the NISG 2026 distinguishes between two categories of covered organizations. The classification results from the interplay of sector (Annex I or Annex II of the Directive), company size and statutorily defined criticality criteria.

• Essential entities are subject to more intensive, including proactive, supervision. Typically these are large companies in the particularly critical sectors of Annex I (such as energy, transport, banking, health, digital infrastructure). A company is large with 250 or more employees, or with annual turnover above EUR 50 million and at the same time an annual balance sheet total above EUR 43 million (Section 25(2) NISG 2026).
• Important entities are supervised primarily on an ex-post (incident-driven) basis: the authority acts above all following an incident or a tip-off. These include, among others, medium-sized companies in Annex I sectors as well as entities from the Annex II sectors.

Important for self-classification: both categories have obligations. Under the NIS2 logic, the responsibility of management does not apply only to essential entities. Article 20 of the NIS2 Directive requires the management body to approve the risk-management measures, oversee their implementation and be held accountable for breaches. Recital 137 makes clear that this responsibility can apply where the management body has failed to comply with its governance obligations, even without a successful attack. Liability therefore attaches to the breach of duty, not to the damage.

In Austria, sanctions are imposed not by the cybersecurity authority itself but by the district administrative authorities; the penalty framework is designed in line with the NIS2 requirements.

The assessment table: self-classification step by step

Work through the following criteria in order. Only when both size and sector apply (or a special case is triggered) is applicability likely.

The size thresholds follow the SME Recommendation 2003/361/EC, to which Section 25 NISG 2026 refers. The precise allocation of the 18 sectors to Annex I and Annex II, as well as the detailed rules on linked and partner enterprises, follow from the Directive and the NISG 2026. In borderline cases, a legal review is worthwhile.

Concrete example: three companies compared

Case A: Mid-sized IT service provider (managed services), Vienna. 70 employees, EUR 14 million turnover. Size criterion met (70 ≥ 50 employees, medium-sized enterprise). Managed services fall under the sector "ICT service management (business-to-business)" in Annex I. As a medium-sized enterprise in an Annex I sector, the provider is presumably an important entity. Result: covered. Registration and self-declaration required.

Case B: Regional energy supplier. 40 employees, EUR 9 million turnover. The pure size assessment would fall below both thresholds. Regardless of size, the supplier may still be covered. If it has been identified as a critical entity under the CER Directive (EU) 2022/2557, it counts as an essential entity (Section 24(1) NISG 2026). The cybersecurity authority can also classify it through an official ruling, for example because it is the sole provider of an indispensable service in Austria or because a disruption could significantly affect public order, safety or health (Section 26 NISG 2026). Result: applicability possible despite small size. Here the individual assessment is decisive, and a blanket all-clear would be wrong.

Case C: Advertising and marketing agency, 30 employees, EUR 6 million turnover. It neither reaches the size threshold nor operates in a covered core sector. Result: not directly covered. But beware the supply-chain effect: if the agency provides critical services for an essential entity, its client's contractual requirements may in practice oblige it to implement NIS2-compliant security measures, without the agency itself being subject to a registration obligation.

The cases illustrate the basic pattern: size and sector together form the rule, but special cases and supply chains can shift the outcome.

Registration obligation and next steps

If your self-classification results in applicability, you must register with the Federal Office for Cybersecurity within three months of entry into force on 1 October 2026 (Section 29(3) NISG 2026). If you only come within scope later, you have three months from that point. Within twelve months after the registration obligation arises, the self-declaration follows: you report to the authority which risk-management measures have been implemented (Section 33(1) NISG 2026). Since as a rule no official ruling is issued that actively informs you, the onus lies with you. An omitted or incorrect classification can be sanctioned.

A practical sequence if you have not yet classified your organization:

1. Record size and sector: document employees, turnover, balance sheet total and the specific activity.
2. Determine the category: essential or important entity, based on Annex allocation, size and criticality.
3. Review special cases and group structure: include linked enterprises in full and partner enterprises proportionally in the size calculation, check the independence exception, take supply-chain requirements into account.
4. Legal safeguarding in borderline cases: where sector allocation or holding structures are unclear.
5. Register: with the Federal Office for Cybersecurity, no later than three months after entry into force.
6. Set up governance: risk-management measures, incident-response team, training of the management body, reporting processes.

Note: This article does not constitute legal advice. The binding assessment of NIS2 applicability, in particular for borderline cases, sector allocation and supply-chain questions, requires an individual legal assessment by a lawyer.

For B2B decision-makers and agencies

For B2B decision-makers, self-classification is not a one-off act but a recurring obligation: if your company grows beyond a threshold or its activity changes, the classification can change. Anchor the assessment as a fixed part of your compliance routine and document the result in an audit-proof manner. Responsibility lies with the management body (Section 31(1) NISG 2026).

For marketing and digital agencies, a twofold view is worthwhile: most agencies fall below the direct applicability threshold but enter the supply chain via clients in regulated sectors. Anyone working for essential or important entities should factor security and evidence requirements into proposals and contracts at an early stage. This is increasingly becoming a selection criterion in the pitch. As an agency in Vienna, we support you in the structured preparation of your cybersecurity and content communication around NIS2. The legal classification itself belongs in the hands of specialized legal advisers.