Austria's Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026) took effect on 1 October 2026, replacing the NISG 2018 on the same day. The law, published as BGBl. I Nr. 94/2025 on 23 December 2025, is Austria's transposition of the EU NIS2 Directive. The Austrian Economic Chamber (WKO) estimates it covers around 4,000 companies and organisations in 18 sectors, and its supply chain rules reach their software and service suppliers through contracts.
What's affected
Who is regulated. Essential and important entities in the sectors listed in the law's annexes, generally from medium size upward under the EU size-cap rule. The Schoenherr law firm's analysis lists energy, transport, banking and financial market infrastructure, health, water, digital infrastructure, B2B ICT service management, public administration, space, postal services, waste, chemicals, food, manufacturing, research and digital providers. It also notes that neither the statute nor the explanatory notes narrow the broad definition of managed service provider, and that central group IT can fall in scope where size criteria are met.
What applies from 1 October 2026. According to the WKO and the FEEI industry association, risk management measures, including supply chain security, reporting duties and management training all apply from the start. There is no transition period for the substantive duties. A companion regulation, the NIS-Verordnung (BGBl. II Nr. 290/2026), sets out more detailed risk management requirements and criteria for significant incidents.
Key obligations, as summarised by Schoenherr and the WKO:
- Governance (§ 31): management bodies are responsible for steering cybersecurity and must take part in cybersecurity training.
- Risk management (§ 32): proportionate, risk-based, all-hazards measures, with particular focus on supply chain security, including requirements for direct suppliers and their development processes.
- Incident reporting (§ 34): early warning within 24 hours, notification within 72 hours, and a final or progress report within one month.
- Authority: the new Bundesamt für Cybersicherheit, under the Federal Ministry of the Interior.
- Fines: for essential entities up to EUR 10 million or 2% of worldwide turnover, whichever is higher. For important entities up to EUR 7 million or 1.4%. Organisational breaches such as missing registration or self-declaration can draw up to EUR 50,000, or EUR 100,000 for repeat offences.
Does this apply to you?
Answer these in order:
- Are you an entity established in Austria, in a sector listed in the NISG 2026 annexes, and at least medium-sized? If yes, you are likely an essential or important entity. The WKO's NIS2 guide at ratgeber.wko.at/nis2 helps confirm it.
- Do you provide managed IT or managed security services to Austrian businesses? The MSP definition is broad, so check carefully even if IT is not your main business.
- Do you sell software or services to an Austrian entity in scope? You are not regulated directly, but the WKO notes that service providers and suppliers of affected entities will be bound contractually to risk management measures. Expect security clauses, questionnaires and audit rights in renewals.
- Are you a group with central IT in Austria? Group IT services are not automatically exempt.
What to do now
- Now: if you are in scope, your risk management, reporting and training duties already apply. Confirm your incident process can produce an early warning within 24 hours of becoming aware of a significant incident.
- By 31 December 2026: register with the cybersecurity authority. The WKO and FEEI both give this date, three months after entry into force. The registration format is being set by regulation, so check the authority's guidance for the current procedure.
- By 31 December 2026: make sure every member of the management body has completed cybersecurity training, and keep the records.
- Q1 2027: review supplier contracts. Add security requirements for direct suppliers that cover their development processes, vulnerability handling and incident notification.
- By 30 September 2027: submit your self-declaration on implemented risk management measures to the authority, per the WKO and FEEI timelines.
- From 1 October 2028: the authority can ask for evidence from an independent body. Schoenherr notes recognised certificates such as ISO/IEC 27001 may count toward part of that evidence, subject to criteria the authority will set.
For suppliers to Austrian entities: get ahead of the questionnaires. Prepare a short pack covering your secure development practices, how you track vulnerable components, your patch timelines and your incident notification commitment.
Why it matters
Austria's law arrived with no grace period for the core duties. For entities, the practical pressure point is the registration and self-declaration sequence. For software vendors, it is § 32: the supply chain duty explicitly reaches into suppliers' development processes, so customers will want proof, not policies.
A vendor that can show a current component inventory and a documented vulnerability response for each product will answer these requests in hours. One that has to build that evidence from scratch will be answering them for weeks.
Try it yourself
Take your largest Austrian customer, or any customer in an NIS2 sector, and list what you would send if they asked tomorrow for evidence of secure development and supply chain controls. Note which items exist today and which would need to be created.
Click through it at your own pace, or open it full screen.
Quick check
When did the NISG 2026 take effect, and what did it replace?
1 October 2026. It replaced the NISG 2018, which ceased to apply at the same time.
What is the registration deadline for essential and important entities?
31 December 2026, three months after entry into force, according to the WKO and FEEI.
What are the reporting deadlines for a significant incident?
An early warning within 24 hours, a notification within 72 hours, and a final report, or a progress report for ongoing incidents, within one month.
