NISG 2026 and Institutional Cybersecurity Supervision in Austria

The NISG 2026 (Network and Information System Security Act 2026) is Austria's transposition of the EU NIS 2 Directive (EU) 2022/2555. It was passed by the National Council on 12 December 2025, promulgated on 23 December 2025 as Federal Law Gazette I No. 94/2025, and has applied since 1 October 2026. It defines cybersecurity obligations for around 4,000 companies across 18 sectors and, for the first time, establishes a dedicated Federal Office for Cybersecurity.

The three most important points up front:

• Late, but binding: Austria significantly missed the EU transposition deadline of 17 October 2024. The first draft (NISG 2024) failed to secure the two-thirds majority on 3 July 2024. Only the NISG 2026 creates the national legal framework, applicable since 1 October 2026.
• Self-assessment and registration: Whether a company is affected follows from its sector, the type of entity and its size. The act covers some types, such as qualified trust service providers or DNS service providers, irrespective of size (§ 24(1) no. 1 NISG 2026). The company assesses this itself and registers with the cybersecurity authority on its own. An administrative decision is only issued when the authority classifies an entity irrespective of its size (§ 26).
• The deadlines are running: Affected entities must register within three months of entry into force (§ 29(3) NISG 2026). The self-declaration of risk-management measures follows within twelve months after the registration obligation arises (§ 33(1)).

The road to the NISG 2026: a delay relative to the EU deadline

The NIS 2 Directive required all EU Member States to bring their national transposition laws into force by 17 October 2024. Austria is among the states that did not meet this deadline. The first attempt, the NISG 2024, was rejected by the National Council on 3 July 2024 because the two-thirds majority required for parts of the act was not achieved. As a result, the EU deadline passed unused.

Only after renegotiation and with amended content did the National Council pass the NISG 2026 on 12 December 2025. Promulgation in the Federal Law Gazette took place on 23 December 2025, and the act has applied since 1 October 2026 (§ 51 NISG 2026). Almost two years therefore lay between the expiry of the EU deadline and national applicability. For companies in Austria, the NIS 2 obligations only became binding with the NISG 2026.

The competent authority: Federal Office for Cybersecurity

The institutionally most important element of the NISG 2026 is the Federal Office for Cybersecurity. Since 1 October 2026 it has been the competent authority. It reports to the Federal Minister of the Interior and is organizationally separate from the Directorate General for Public Security (§ 3a NISG 2026).

A key feature of the Austrian construction concerns sanctioning: the cybersecurity authority does not itself impose fines. Administrative penalties fall within the remit of the district administrative authorities. The penalty range is aligned with the requirements of the NIS 2 Directive. This separation between the supervisory authority and the sanctioning body is a peculiarity compared with other jurisdictions in which the supervisory authority itself issues fines.

CSIRT, GovCERT and reporting channels

The NISG 2026 sets out the reporting channels itself. An entity reports significant cybersecurity incidents to the competent sector-specific CSIRT. Where there is none, the report goes to the national CSIRT. The CSIRT forwards it to the cybersecurity authority (§ 34(1) NISG 2026). The legislature designates two sector-specific CSIRTs itself. GovCERT Austria is set up at the cybersecurity authority and serves public administration (§ 8(4) NISG 2026). For the health sector, the law designates the Austrian HealthCERT as the sector-specific CSIRT, which the federal minister responsible for health must set up and operate. Entities in this sector report to it (Art. 3 Federal Law Gazette I No. 94/2025, § 8a Health Telematics Act 2012). The cybersecurity authority can authorize further sector-specific CSIRTs as needed and announces this publicly. For sectors without their own CSIRT, the national CSIRT takes over (§ 8(3) and (5)). Until a national CSIRT is authorized under the new act, for no more than two years from entry into force, the national CSIRT authorized under the NISG 2018 continues to perform its tasks (§ 51(6) NISG 2026). If no national CSIRT exists after that, GovCERT takes over these tasks (§ 8(4)).

Key facts of the NISG 2026

Compared with the failed 2024 draft (committee version, 2638 d.B.), the authority has changed, among other things: the draft made the Minister of the Interior itself the cybersecurity authority (§ 4(1)), while the NISG 2026 creates a separate federal office. The draft also required the self-declaration only on request; it is now mandatory within twelve months. The key facts at a glance, all sections from Federal Law Gazette I No. 94/2025:

Self-classification transfers responsibility for correctly determining applicability to the company itself. Anyone who wrongly assumes they do not fall within scope bears the risk. This matters most in corporate groups: for the size thresholds, § 25 NISG 2026 refers to the SME Recommendation 2003/361/EC, so data from partner and linked enterprises is generally added. Only if a company is organizationally, technically and operationally independent in its network and information systems does it stand on its own (§ 25(4)). A small group subsidiary can therefore exceed the thresholds. Under § 3 no. 11, the management body comprises the persons or bodies called to manage the entity's business. The definition does not mention supervisory boards, but the act contains no express exclusion either. The 2024 draft still included persons called to supervise the management within the entity (§ 3 no. 11 of the draft). Oversight still matters: under § 44(3) and (4), the entity itself can be fined if persons with control authority acted, or if a lack of supervision made the infringement possible.

Obligations of the management bodies

The management bodies of essential and important entities must ensure and oversee compliance with the risk-management measures. They must also attend cybersecurity training themselves (§ 31 NISG 2026). With this, the NISG 2026, like the entire NIS 2 architecture, lifts responsibility for cybersecurity out of the IT department alone and onto the leadership level. Governance responsibility cannot be fully delegated.

Practical example: a mid-sized energy provider

A hypothetical Austrian energy provider with 600 employees assesses its applicability in spring 2026. Energy is one of the 18 sectors; due to its size and activity, the company classifies itself as an essential entity in the course of self-classification. It registers with the cybersecurity authority on its own and does not wait for an administrative decision. The authority only issues one when it classifies an entity irrespective of its size (§ 26).

Its roadmap before and after the cut-off date of 1 October 2026:

```
Q1 2026 Scoping + self-classification (essential/important?)
Q2 2026 ISMS maturation, risk analysis, catalog of measures
Q2 2026 Designate incident-response team + define processes
Q3 2026 Document management-body training, tabletop test
Q3 2026 Reporting channels for early warning (24 h), notification (72 h) and final report
Oct 2026 Applicability, registration (3 months), self-declaration (12 months)
```

Because the cyber authority does not itself sanction, the competent district administrative authority conducts the administrative penalty proceedings for any infringements (§ 44(1)). The energy provider therefore documents everything from the outset: risk-approval records, training records, and incident-response tests. This chain of evidence is the practical core of any applicability assessment.

What companies should do now

The act has applied since 1 October 2026, and the first deadlines are running. These steps are due:

• Scoping and self-classification based on the 18 sectors and the size/activity criteria, documented and traceable.
• Registration with the cybersecurity authority within three months of entry into force (§ 29(3) NISG 2026).
• Building or maturing an ISMS as the organizational foundation of the risk-management measures.
• Self-declaration of the implemented risk-management measures within twelve months after the registration obligation arises (§ 33(1) NISG 2026). On request by the authority, implementation must be demonstrated through an audit by an independent body; the first request can come no earlier than 1 October 2028 (§ 33(2)).
• Designating an incident-response team, defining reporting channels, and testing response processes. Significant incidents go to the competent CSIRT as an early warning within 24 hours and as a notification within 72 hours; the final report follows no later than one month after the notification (§ 34 NISG 2026).
• Involving the management bodies: they oversee compliance with the risk-management measures and attend cybersecurity training, both documented (§ 31 NISG 2026).
• Reviewing the corporate structure, since linked enterprises generally count toward the size thresholds (§ 25 NISG 2026).

Note: this article is an expert editorial overview and not legal advice. The specific applicability, the correct self-classification, and individual obligations under the NISG 2026 must be clarified with qualified legal advisors. The cybersecurity authority has already specified the requirements for the risk-management measures: the NISV 2026 (Federal Law Gazette II No. 290/2026) of 1 October 2026 extends the risk-management requirements of Implementing Regulation (EU) 2024/2690 (Art. 2 and Annex) to those types of essential and important entities listed in Annexes 1 and 2 of the NISG 2026 that the Implementing Regulation does not cover itself (§ 2). It also sets criteria under which a cybersecurity incident always counts as significant (§ 5).

For agencies and B2B decision-makers

For DACH B2B decision-makers, the running deadlines matter most now; classification and documentation are the company's own responsibility. Anyone who operates supply chains in Austria or has Austrian subsidiaries should clarify their applicability promptly, since linked enterprises generally count toward the size thresholds. Marketing and digital agencies serving regulated clients from the 18 sectors should also consider their own role as a service provider in the supply chain and contractually map cybersecurity and reporting requirements cleanly. Blck Alpaca helps companies present compliance topics such as the NISG 2026 in an accessible way and translate them into content, knowledge, and communication structures: factual, up to date, and without legal overreach.