Introduction: Why the NISG 2026 belongs on the agenda now
The NISG 2026 transposes the European NIS 2 Directive into Austrian law and entered into force on 1 October 2026. It significantly expands the group of companies concerned and makes cyber security a management, organisational and compliance task.
For companies, this is therefore not just about firewalls, back-ups or technical protection systems. What is required are traceable risk management measures, robust reporting processes, documented responsibilities and the active involvement of senior management. This article summarises who may be affected, which deadlines and sanctions apply and which steps companies should take now.
What is the NISG 2026 and when did it enter into force?
The Network and Information Systems Security Act 2026 (Netz- und Informationssystemsicherheitsgesetz 2026 – NISG 2026) is Austria’s transposition of the EU NIS 2 Directive. It entered into force on 1 October 2026 and imposes binding cyber security requirements on considerably more organisations than the predecessor directive (“NIS 1”; NISG 2018).
The regulatory approach is risk-based: entities concerned must take the technical, operational and organisational measures that are appropriate to their specific cyber risks. The Act therefore does not call for an isolated IT project, but for a managed and documented security programme embedded in corporate governance.
What are the objectives of NIS 2 in Austria?
The NISG 2026 aims to increase the resilience of key economic and administrative sectors against cyber attacks and system failures. Companies are expected to identify risks early, manage security incidents in a structured manner and be able to provide information and submit reports to the cyber security authority within short deadlines.
Which companies fall under the NISG 2026?
The scope expands from seven to 18 sectors. As a result, numerous medium-sized and large companies that were previously not subject to the NISG 2018 may now be covered.
Whether a company actually falls within the scope and how it is to be classified must be assessed on the basis of its activities, its sector and its specific structure. A robust applicability analysis is therefore the starting point of every NISG 2026 implementation.
Which new and expanded sectors are affected?
| Expansion | Examples from the NISG 2026 context |
| Newly covered sectors | Waste water; ICT service management (B2B); space; postal and courier services; waste management; chemicals; food; manufacturing; research organisations. |
| Sectors with expanded scope | Energy, in particular district heating and hydrogen; digital infrastructure, in particular data centres, cloud services and trust service providers; public administration at regional (Länder) level. |
Sector classification cannot always be determined from a company’s name. What matters are the services actually provided and the company’s role in the respective value or supply chain.
What is the difference between essential and important entities?
The NISG 2026 distinguishes between “essential entities” and “important entities”. This classification primarily affects regulatory supervision and the range of sanctions.
| Category | Supervision | Maximum sanctions |
| Essential entities | Proactive regulatory inspections are possible even without a specific cause. | Up to EUR 10 million or 2% of worldwide annual turnover in the preceding financial year – whichever is higher. |
| Important entities | Inspections take place where there is reasonable suspicion. | Up to EUR 7 million or 1.4% of worldwide annual turnover in the preceding financial year – whichever is higher. |
Important in practice
The category should not be hastily derived from industry or company size alone. A case-by-case legal assessment provides clarity on applicability, classification and specific obligations.
Which deadlines must companies observe?
Three dates structure the preparation: 1 October 2026, 31 December 2026 and 30 September 2027. Companies should plan their internal work packages backwards from these key dates.
| Key date | Obligation or event | Consequence |
| 1 October 2026 | Entry into force of the NISG 2026; the Federal Office for Cyber Security commences operations. | The statutory obligations apply from this date. |
| 31 December 2026 | Deadline for registration with the cyber security authority. | Missing the deadline may result in fines of up to EUR 50,000; up to double that amount for repeat offences. |
| 30 September 2027 | Deadline for the self-declaration. | Structured presentation of the risk management measures actually implemented. |
Practical recommendation: Registration is not the starting point of implementation. Applicability, responsibilities, evidence and reporting channels should be clarified beforehand so that the company is able to act from the moment the Act enters into force.
Which risk management obligations does the NISG 2026 impose?
Entities concerned must implement risk-based technical, operational and organisational security measures. What is decisive is a coordinated overall system that identifies risks, prioritises measures and verifies their effectiveness in a traceable manner.
The requirements therefore extend beyond the IT department. Legal, compliance, information security, risk management, procurement, HR, communications and senior management must work together. Typical areas of implementation include:
- Risk assessment and action planning: Identify, assess and prioritise cyber risks and assign responsibilities and deadlines.
- Governance and responsibilities: Clearly define decision-making, reporting and escalation channels.
- Incident management: Put in place the organisational framework for the detection, assessment, internal escalation and regulatory reporting of significant incidents.
- Supply chain risks: Analyse dependencies on service providers and other partners and integrate them into the security concept.
- Documentation and evidence: Document measures, approvals, controls and improvements in a way that is traceable both internally and vis-à-vis the authority.
- Training and awareness: Prepare management bodies and relevant employees for their roles and raise their awareness on a regular basis.
What does “risk-based” mean in practical implementation?
Risk-based means that measures are not selected schematically, but in line with the threat landscape, business model, system landscape and potential consequences of damage. Companies therefore first need transparency about critical processes, systems, data, dependencies and existing controls.
Featured snippet answer
NISG 2026 risk management combines legal requirements with operational cyber security: risks are assessed, appropriate measures adopted, responsibilities assigned, controls documented and improvements continuously tracked.
How does the reporting obligation for cyber security incidents work?
A three-stage reporting procedure applies to significant cyber security incidents: an early warning within 24 hours, a full incident notification within 72 hours and a final report within one month of the early warning. These short deadlines require prepared procedures and clear decision-making powers.
| Timing | Reporting stage | Operational focus |
| Within 24 hours | Early warning | Classify the incident quickly, escalate internally and enable the initial notification to the authority. |
| Within 72 hours | Incident notification | Consolidate the facts available at that point and report them in a structured manner. |
| Within one month of the early warning | Final report | Conclusively document the incident, its impact and how it was handled. |
A company can only meet these deadlines if technical detection, legal assessment, management escalation and external communication work hand in hand. A robust incident response process should therefore provide for contact persons, deputies, approvals, documentation templates and a reporting channel that is available at all times.
How can the reporting process be robustly prepared?
- Define internal thresholds and criteria for escalating an incident.
- Appoint an interdisciplinary response team with clearly defined roles and deputies.
- Align decision-making and approval channels with the 24-hour and 72-hour deadlines.
- Prepare templates for the early warning, incident notification and final report.
- Test reporting procedures in exercises and close any gaps identified in a documented manner.
What responsibility does senior management bear?
Senior management bears personal responsibility for NISG 2026 compliance. It must approve the risk management measures, oversee their implementation and participate in cyber security training.
Cyber security can therefore not be fully delegated to IT, information security officers or external service providers. While operational implementation may be distributed, management bodies must ensure appropriate governance, take decisions in a traceable manner and supervise the effectiveness of the measures.
Which management tasks should be documented?
- Approval of the security and implementation programme, including priorities and resources.
- Regular reporting on risks, incidents, progress of measures and open deviations.
- Monitoring whether the measures adopted are implemented on time and effectively.
- Participation of senior management in appropriate cyber security training.
- Traceable handling of material residual risks and escalations.
Liability-relevant point
In addition to administrative penalties, breaches of duty may also give rise to questions of personal liability for management bodies. Robust documentation of decisions and oversight is therefore a central component of good governance.
What penalties apply for breaches of the NISG 2026?
The range of sanctions generally depends on the classification as an essential or important entity; only for minor breaches is no such distinction made. For essential entities, fines of up to EUR 10 million or 2% of worldwide annual turnover are possible; for important entities, up to EUR 7 million or 1.4%.
| Entity | Upper limit | Basis of calculation |
| Essential entity | EUR 10 million or 2% | Worldwide annual turnover in the preceding financial year; whichever amount is higher applies. |
| Important entity | EUR 7 million or 1.4% | Worldwide annual turnover in the preceding financial year; whichever amount is higher applies. |
| Failure to register | Up to EUR 50,000 | Up to double that amount for repeat offences. |
The range of sanctions is a strong compliance signal. For business practice, however, it is equally important to avoid business interruptions, reputational damage, liability risks and loss of trust among customers and business partners.
What role does the new Federal Office for Cyber Security play?
The Federal Office for Cyber Security (Bundesamt für Cybersicherheit) commenced operations on 1 October 2026 and reports to the Federal Ministry of the Interior. It is headed by Markus Kasinger.
How intensively the new authority will carry out inspections in practice remains to be seen. The basic division of tasks, however, is clear: essential entities may be inspected proactively and without a specific cause; for important entities, an inspection requires reasonable suspicion.
How should companies be prepared for a regulatory inspection?
Audit readiness is achieved through up-to-date, consistent and readily available documentation. This includes, in particular, a documented applicability and classification analysis, the risk assessment, measures adopted, responsibilities, management approvals, training records, incident processes and the status of outstanding improvements.
Inspection preparation
It is not merely the existence of individual documents that counts. The documentation should form a coherent overall picture and correspond to the organisation as it actually operates in practice.
Which practical steps should companies take now?
Companies should use the remaining time for a prioritised NISG 2026 programme. The most sensible starting point is a legal applicability analysis, followed by a documented gap analysis and a realistic implementation plan.
- Clarify applicability and classification. Assess whether the company falls within one of the 18 sectors and whether it is to be classified as an essential or important entity.
- Anchor responsibility at management level. Define the sponsor, project management, reporting lines and decision-making powers.
- Analyse the current status and gaps. Compare existing technical, operational and organisational measures against the NISG 2026 requirements.
- Prioritise measures. Bring together risks, deadlines, resources, dependencies and evidence in an actionable roadmap.
- Establish the reporting process. Prepare the 24-hour early warning, 72-hour incident notification and final report from both an organisational and a technical perspective.
- Assess supply chain risks. Identify critical service providers and dependencies and derive the necessary control or contractual measures.
- Prepare registration and self-declaration. Determine the responsible persons, required information and internal approvals in good time.
- Establish audit readiness. Consolidate documentation, make management decisions verifiable and test procedures.
How do legal compliance and technical implementation work together?
Effective NISG 2026 implementation requires both perspectives: the legal analysis clarifies applicability, obligations, responsibilities and evidence; technical implementation reduces specific cyber risks in systems and processes. Both should be linked through a joint roadmap, aligned priorities and consistent reporting.
Technical implementation with strong partners
KINDL.trusted supports implementation from a legal and compliance perspective and works with strong partners for technical implementation at IT level. This ensures that regulatory requirements and practical cyber security interlock effectively.
Why is early NISG 2026 compliance worthwhile?
Early preparation not only reduces the risk of missed deadlines and sanctions. It also strengthens operational resilience, protects critical business processes and builds trust among customers, business partners, employees and authorities. Well-designed cyber security governance thus becomes part of sustainable corporate management.
Conclusion: Implementing the NISG 2026 on time and audit-proof
Since 1 October 2026, the NISG 2026 has made cyber security a binding management task for considerably more Austrian companies. Those who prepare applicability, governance, risk management, reporting processes and evidence in a structured manner now will create a solid foundation for registration, self-declaration and regulatory inspections.
KINDL.trusted supports you with the legal applicability assessment, the classification of your specific obligations, compliance-side implementation, as well as with inspections and communication with the authority. Together with strong IT partners, technical implementation can also be integrated effectively.
Contact
Talk to us about the specific action required in your company.
Your contact from our KINDL.Legal Defense practice area:
Marc Julian MAYERHÖFER
Partner | Rechtsanwalt
