NIS2 obligations in Austria (NISG 2026)

Competent authority & CSIRT Legal ref: Chapter 1

• Bundesamt für Cybersicherheit (Federal Office for Cybersecurity) is the registration and supervisory authority. bundesamt-cybersicherheit.gv.at · 28 Oct 2026 · source-checked
• Federal Office for Cybersecurity, subordinate to the Federal Minister of the Interior. ecs-org.eu · 28 Oct 2026 · secondary source
• National Coordination Centre for Cybersecurity. ecs-org.eu · 28 Oct 2026 · secondary source
• GOV CERT. ecs-org.eu · 28 Oct 2026 · secondary source
• CERT.AT. ecs-org.eu · 28 Oct 2026 · secondary source
• ENERGY CERT. ecs-org.eu · 28 Oct 2026 · secondary source
• In the absence of a sector-specific CSIRT, the national CSIRT must perform the tasks of the relevant sector-specific CSIRT for the sector in question. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Chapter 1, Subsection 2; Annex 1, 2

• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Chapter 3, Section 2

• Essential and important entities must register via the Unternehmensserviceportal (USP) from 1 Oct 2026 until 31 Dec 2026 at the latest; entities that qualify later register within three months. Data per § 29(2) NISG 2026 (name, contacts, sectors/types, Member States, IP ranges, establishments, thresholds). Failure to register can be fined up to EUR 50,000 (EUR 100,000 for repeat) under § 45(4). bundesamt-cybersicherheit.gv.at · 28 Oct 2026 · source-checked
• Self-declaration (§ 33) reportedly due within 12 months of the registration duty arising (30 Sep 2027); independent audits may be requested from 1 Oct 2028. ris.bka.gv.at · 28 Oct 2026 · needs verification
• Essential and important entities must register within 3 months after the Federal Act’s entry into force (01/01/2027). The following information is requested: ecs-org.eu · 28 Oct 2026 · secondary source
• Name and registration number. ecs-org.eu · 28 Oct 2026 · secondary source
• Address and contact details. ecs-org.eu · 28 Oct 2026 · secondary source
• Subsector classification and type of establishment. ecs-org.eu · 28 Oct 2026 · secondary source
• List of EU Member States where the entity provides services. ecs-org.eu · 28 Oct 2026 · secondary source
• Address of the entity’s main office and any other offices in the European Union or if it is not established in the European Union, the address of the designated representative. ecs-org.eu · 28 Oct 2026 · secondary source
• IP address, if applicable. ecs-org.eu · 28 Oct 2026 · secondary source
• Entity classification thresholds. ecs-org.eu · 28 Oct 2026 · secondary source
• Entities have 12 months from the entry into force to complete the self-declaration (30/09/2027). They can access whether they fall under the law’s scope using a dedicated national platform: Link ecs-org.eu · 28 Oct 2026 · secondary source

Referenced documents: Link

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Chapter 3, Section 2

• Incidents are reported to the CSIRT in charge. Reporting requirements: ecs-org.eu · 28 Oct 2026 · secondary source
• Early warning within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident report within 72 hours plus an initial assessment of the impact. ecs-org.eu · 28 Oct 2026 · secondary source
• Interim report at the request of the national CSIR (if necessary). ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing) no later than 1 month after sending the incident report and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Chapter 5

• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover(important entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

Supervisory guidance

• Bundesamt für Cybersicherheit – registration FAQ bundesamt-cybersicherheit.gv.at
• Bundesamt für Cybersicherheit – legislation FAQ bundesamt-cybersicherheit.gv.at

Key dates

• 31 Dec 2026 Austria: registration deadline (USP) for entities in scope from 1 Oct 2026
  bundesamt-cybersicherheit.gv.at source-checked
• 30 Sep 2027 Austria: self-declaration under § 33 NISG 2026 (reported)
  ris.bka.gv.at needs verification

What changed recently

1. 1 Oct 2026
   NISG 2026 applies; USP registration window opens bundesamt-cybersicherheit.gv.at source-checked