NIS-2 Directive in Austria: Overview and Deadlines for NISG 2026 and NISV 2026
Austria’s Network and Information System Security Act 2026 (Netz- und Informationssicherheitsgesetz, NISG 2026) entered into force on 1 October 2026, followed by its implementing regulation, NISV 2026, on 2 October 2026. Thus, Austria has implemented NIS 2, requiring medium-sized and large companies in sectors such as energy, transport, healthcare, and manufacturing to strengthen their cyber resilience. All incident prevention and reporting obligations are already in force, and organisations must register with the Austrian Cybersecurity Authority by 31 December 2026.
The following overview explains what the new regulations mean for your organisation, including their scope, key deadlines, risk management and reporting duties, and potential penalties of up to EUR 10 million:
What does the NISG 2026 cover?
The Network and Information System Security Act 2026 (NISG 2026) has been in effect since October 1, 2026. The accompanying regulation, the NISV 2026 (Federal Law Gazette II No. 290/2026), took effect one day later.
Under NISG 2026, critical and essential entities must implement measures to strengthen their cyber resilience. Non-compliance may result in substantial fines.
Which organisations are subject to NISG 2026?
NISG 2026 generally applies to medium-sized and large organisations operating in the following areas:
Electronic communications, energy, transport, banking and financial market infrastructure, healthcare, drinking water and wastewater treatment, digital infrastructure and ICT services, public administration, the space sector, postal and courier services, waste management, chemicals, food, manufacturing, digital services, and research.
Applicable obligations vary according to whether an organisation is classified as an essential or important entity.
NISG 2026: Key obligations and deadlines
Affected organisations must register with the new Cybersecurity Authority by 31 December 2026. Security and incident-reporting obligations are already in force.
| Date | Requirements | Legal basis |
|---|---|---|
| October 1, 2026 | NISG 2026 enters into force, and its obligations apply immediately. | Section 51 NISG 2026 |
| December 31, 2026 | Registration with the Cybersecurity Authority | Section 29(3) NISG 2026 |
| September 30, 2027 | Submit a self-declaration to the Authority detailing the measures implemented. | Section 33(1) NISG 2026 |
| Effective October 1, 2028 | The Authority may require supporting evidence or order an audit. | Section 33(2) NISG 2026 |
NISV 2026: New Risk Management Requirements
1 Requirements for Risk Management Measures (Section 2 NISV 2026)
Implementing Regulation (EU) 2024/2690 sets out detailed security measures. It previously applied only to DNS service providers, TLD name registries, content delivery network operators, and digital service providers such as cloud services and data centres.
NISV 2026 extends Regulation (EU) 2024/2690 to every organisation covered by NISG 2026. Its requirements include security policies, emergency plans, backups, supplier security, access controls, encryption, and employee training.
2 Risk assessment and mitigation (Sections 3 and 4 NISV 2026)
Each organisation must assess its risks, including technical threats, human error, supplier and IT service provider risks, and physical hazards such as fire or power outages.
If a risk-management requirement cannot be implemented temporarily or because of the organisation’s size, an equivalent compensatory measure may be used instead. It must be justified and documented in writing.
3 Significant cybersecurity incidents (Section 5 NISV 2026)
NISV 2026 sets the criteria for a significant cybersecurity incident under Section 35(1) NISG 2026. Only incidents meeting these criteria must be reported.
An incident is significant if it:
- causes or may cause a direct financial loss exceeding EUR 500,000 or 5% of the organisation’s total revenue in the preceding financial year, whichever is lower;
- causes or may cause the disclosure of the organisation’s trade secrets or information protected under Section 6 of the Freedom of Information Act (IFG);
- causes or may cause a person’s death;
- causes or may cause serious harm to a person’s health;
- involves successful or suspected malicious unauthorised access to network and information systems that is likely to cause serious operational disruption;
- is a repeated cybersecurity incident: it occurs twice within six months, has an apparent common cause and effect, and causes a cumulative loss of EUR 500,000 or 5% of annual revenue;
- causes or may cause service failure or limited availability for more than 100,000 users or 10% of users, whichever is lower, for more than 24 hours;
- causes or may cause service failure or limited availability across at least one federal state for more than 24 hours; or
- triggers crisis-management or disaster-recovery plans under business continuity management.
Scheduled service interruptions are not considered significant cybersecurity incidents.
NISG 2026: What Are the Consequences of Violations?
Breaches of training or reporting duties, or failure to implement risk-management measures, can expose essential entities to administrative fines of up to EUR 10 million or 2% of total worldwide annual turnover. Management responsibility is particularly important because executives may also incur personal liability.
Important entities may face administrative fines of up to EUR 7 million or 1.4% of total worldwide annual turnover.
A single breach of the registration requirement may result in a fine of up to EUR 50,000.
NISG 2026: Six key questions for businesses
With NISG 2026 in force since 1 October 2026, businesses should now consider these six questions:
- Am I even affected?
- What must management personally do?
- What needs to be implemented within the company?
- Which deadlines are already in effect?
- What are the consequences of noncompliance?
- How do I maintain compliance over the long term?
How Benn-Ibler can support your NISG 2026 and NISV 2026 compliance
Benn-Ibler can help your organisation understand and meet its obligations under NISG 2026 and NISV 2026. We assess whether the legislation applies to you, identify compliance gaps, allocate responsibilities, and establish auditable processes to help manage the personal liability exposure of senior management. Our support includes incident-reporting procedures, training for staff and management, reviews of contracts with IT service providers and suppliers, and liaison with the competent authorities. We also review cyber and D&O insurance policies for relevant obligations and potential gaps in cover. If a cyber incident occurs, we advise you throughout the response and recovery process and assist with pursuing any available claims.
This article provides general information only and is not a substitute for legal advice on specific matters.
