In short: Austria's NISG 2026, its transposition of the EU NIS2 Directive, has applied since 1 October 2026. Your company is usually covered if it works in a sector from Annex 1 or 2 and has at least 50 employees, or over 10 million euros turnover and over 10 million euros balance sheet total. Some providers are covered regardless of size. You carry out the assessment yourself, the authority does not classify entities. The first deadline is registration by 31 December 2026.

How do I check whether the NISG 2026 applies to my company?

Two questions are enough for a first view: what does the business do, and how large is it? Click through the flow, which follows § 24 and § 25 of the NISG 2026. Your answers stay in your browser and are not stored anywhere. The result is a reading aid and not a classification.

The self-assessment needs JavaScript. The diagram and the text version below work without it.

The NISG 2026 as a flow: from self-assessment to obligationsAt the top the path runs through type of activity and size to essential entity, important entity or not covered under the basic rule. Below, covered entities follow registration, training, risk management, self-declaration, proof and the reporting loop for a significant incident. The same steps appear as text below the diagram.SELF-ASSESSMENTOBLIGATIONSYour businessSpecial caseregardlessof sizeAnnex 1highcriticalityAnnex 2other criticalsectorsNo sectornot evenon the sidelargefrom 250*mediumfrom 50*large/mediumfrom 50*smallbelowpoints toessentialpoints toimportantbasic rulenot coveredRegisterby 31 December 2026 · § 29Deadline missed: up to 50,000 eurosTrain the managementoffer training to employees · § 31Implement risk managementten areas, NISV 2026 · § 32Not implemented: fines, § 45Self-declarationby 30 September 2027 · § 33(1)Proof on requestfrom 1 October 2028 at the earliest · § 33(2)Ongoing operation: keep details currentSignificant incident · § 3424 hoursearly warning72 hoursnotification1 monthfinal report* Employees, counted in annual work units.Turnover and balance sheet total count as an alternative, see § 25.
The diagram as text

What does your business do? Secondary activities usually count. Public administration has its own rules in § 24(3) to (6).

  • Trust services, DNS, TLD, public communications networks or services, or a decision naming you a critical entity
  • Annex 1: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, cloud and data centres, managed services, space
  • Annex 2: postal and courier, waste, chemicals, food, medical devices, electronics, mechanical engineering, vehicle manufacturing, online marketplaces, search engines, social networks, research
  • None of these

How large is the entity? Counted with linked and partner enterprises, apprentices do not count. The latest annual accounts are what matters.

  • Large: at least 250 employees, or over 50 million euros turnover and over 43 million euros balance sheet total
  • Medium: at least 50 employees, or over 10 million euros turnover and over 10 million euros balance sheet total
  • Below that
  1. Register: Through the Austrian business service portal (USP), without being asked by the authority. The Federal Office names 31 December 2026 in its FAQ and 1 or 4 January 2027 on its obligations page. Plan for 31 December. Missing the deadline risks up to 50,000 euros under § 45(4), up to 100,000 euros for a repeat.
  2. Train the management: Every member of the management needs its own training, and attendance is documented. Employees must be offered training regularly (§ 31(2)). The Act sets no fixed interval.
  3. Implement risk management: § 32(4) lists ten areas, from risk analysis and incident handling through backup and supply chain to multi-factor authentication. The NISV 2026 regulation sets out the details. If implementation is missing, the fines in § 45(1) to (3) apply.
  4. Self-declaration: By 30 September 2027 you report through the portal what is in place, using a form with short questions. Under § 45(1) a gap is not punishable if the authority knows of it only from the self-declaration.
  5. Proof on request: The authority can ask from 1 October 2028 at the earliest. You then have two years for proof by an independent body. Essential entities prove the operational and organisational part within two months. A valid certificate such as ISO 27001 can do for that part, provided the scope fits.
  6. Ongoing operation: You report changes within two weeks or three months, depending on the detail (§ 29(4)). The measures remain ongoing work.
  7. Significant incident: The deadlines run from the moment you know, weekends included: early warning within 24 hours, notification within 72 hours, final report no later than one month after the notification (§ 34(2)). Then you are back in ongoing operation.

For the detailed assessment the Federal Office for Cybersecurity points to the NIS2 online guide of the Austrian Economic Chamber, in German. The assessment is made per entity, meaning per legal person. There is no joint registration for a group.

Which sectors fall under the NISG 2026?

Annex 1 lists the sectors of high criticality: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration and space. Annex 2 lists the other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research.

Three points from the Federal Office's FAQ are easy to miss:

  • Secondary activities count. Austrian law has no exception for negligible activities. Only for energy, drinking water, waste water and waste does the main activity matter.
  • Internal IT counts. A group company that looks after the systems of other group companies with administrative access counts as a managed service provider.
  • For food, wholesale and industrial production must come together. In manufacturing, the NACE code often decides.

How is company size calculated?

A company is medium from 50 employees, or with over 10 million euros turnover and over 10 million euros balance sheet total. It is large from 250 employees, or with over 50 million euros turnover and over 43 million euros balance sheet total (§ 25(2) and (3)). Staff are counted in annual work units, apprentices do not count. The latest annual accounts are what matters. Crossing a threshold takes effect only if it lasts two financial years in a row.

Take care with group attribution: linked enterprises count in full, partner enterprises at 25 to 50 percent pro rata, including those abroad. The only exception is an entity whose IT is organisationally, technically and operationally independent (§ 25(4)).

What separates essential and important entities?

The obligations are essentially the same. The difference lies in supervision, proof and fines. The authority can check essential entities on its own initiative, and acts on important entities when it has indications of a breach (§ 38). Essential entities must also prove the operational and organisational part within two months of a request (§ 33(2)).

What is due under the NISG 2026, and by when?

  • Registration through the business service portal: by 31 December 2026 according to the Federal Office's FAQ. Its obligations page names 1 or 4 January 2027. I would plan for 31 December.
  • Training and risk management (§ 31 and § 32): the Act has applied since 1 October 2026 and sets no separate date. The NISV 2026 regulation sets out the details.
  • Self-declaration: by 30 September 2027 (§ 33(1)).
  • Proof by an independent body: first request from 1 October 2028 at the earliest, then two years (§ 33(2)).
  • Significant incident: early warning within 24 hours, notification within 72 hours, final report no later than one month after the notification (§ 34(2)).
  • Changes to your details: within two weeks or three months, depending on the detail (§ 29(4)).

Registering without measures behind it achieves little. The order in the flow above makes sense: register, train the management, carry out a risk analysis, then prioritise the measures. For the data protection side of the same work, see the GDPR roadmap for SMEs.

What does the management have to do personally?

The management must ensure and supervise the measures and take part in training designed for it (§ 31). This applies to every member of the management, and employee training is not enough. Attendance is documented. According to the Federal Office, the Act sets no administrative fines for managers personally, though damages may be possible. The Austrian Economic Chamber lists courses.

What fines does the NISG 2026 set?

For a missed registration up to 50,000 euros, up to 100,000 euros for a repeat (§ 45(4)). For missing measures, training or notifications up to 10 million euros or 2 percent of worldwide turnover for essential entities, and up to 7 million euros or 1.4 percent for important ones, whichever is higher (§ 45(2) and (3)). Under § 45(1) a gap is not punishable if the authority knows of it only from the self-declaration.

We are not covered. Does it still affect us?

Often yes, through your customers. Covered entities must secure their supply chain as far as it concerns their network and information systems. According to the Federal Office, a general reference in the terms and conditions is not enough. It asks for specific contractual duties, such as reporting incidents without delay, audit rights and fixing vulnerabilities. So expect questionnaires and contract amendments, even as a small business.

That SMEs find this hard is also described in research. A literature review by Maastricht University and the Norwegian University of Science and Technology notes that SMEs often lack the resources, expertise and incentives for cybersecurity, and that research specifically on SMEs is rare (source: Chaudhary et al., “A quest for research and knowledge gaps in cybersecurity awareness for small and medium-sized enterprises”, Computer Science Review 2023). Researchers at Greek universities modelled 14 barriers to NIS2 implementation from the literature and expert input. Lack of awareness and the changing threat landscape act as drivers there, while technical complexity and tight budgets pass the pressure on (source: Mentzelou et al., “Identifying and Modeling Barriers to Compliance with the NIS2 Directive: A DEMATEL Approach”, Journal of Cybersecurity and Privacy 2025). This is a model built on expert judgement and not a measurement in Austria. It still fits the first step: get clear on whether and how the Act applies.

Is there funding for this in Lower Austria?

According to TIP Lower Austria, the Austrian Economic Chamber offers its members an 8-hour cybersecurity quick check, funded at 100 percent. You will find the details there, in German. digi4wirtschaft does not cover cybersecurity. An overview of other programmes is on the funding page.

Frequently asked questions on the NISG 2026

Does the NISG 2026 apply to small businesses?

Usually not. Below 50 employees and without reaching the turnover and balance sheet threshold, a business is not covered under the basic rule. Exceptions exist for providers such as DNS, trust services or public communications, and where the authority issues a decision.

By when do I have to register under the NISG 2026?

The Austrian Federal Office for Cybersecurity names 31 December 2026 in its FAQ. Anyone covered later has no more than three months from that point.

Who decides whether my company is covered?

The company itself. According to the Federal Office, the authority does not classify entities. As non-binding help it points to the online guide of the Austrian Economic Chamber (WKO).

Is ISO 27001 enough as proof?

For the operational and organisational part a valid certificate can do, provided its scope covers the whole entity. According to the Federal Office, the technical part needs an audit by an independent body.

Is there a certificate for the NISG 2026?

No. According to the Federal Office, there is no general certificate that proves the NISG 2026 requirements.

As of 31 October 2026. Sources: NISG 2026, Federal Law Gazette I No. 94/2025, NISV 2026, Federal Law Gazette II No. 290/2026, FAQ of the Federal Office for Cybersecurity, all in German. This article does not replace legal advice. I am a management consultant and not a lawyer, so please take questions of interpretation to a lawyer.