Legal position and jurisdiction
The NISG 2026 was promulgated as Federal Law Gazette I No. 94/2025 and entered into force on 1 October 2026 under the timing rule in section 51. Entry into force is distinct from registration, evidence and reporting deadlines. Our Austrian rule path addresses this legal position, not events before 1 October 2026. RIS: NISG 2026, section 51.
Section 28 generally connects jurisdiction to an Austrian establishment. Public communications services, certain digital providers and public administration have specific rules. For digital providers, these concern the main establishment, a representative and, where relevant, services offered in Austria without an EU representative. An Austrian website or customer does not suffice for every entity type. § 28 NISG 2026.
The competent cybersecurity authority is the Federal Office for Cybersecurity (BCS). Section 34 routes incident reports to the competent sectoral CSIRT or, failing that, the national CSIRT. BCS: responsibilities and reporting channels.
Which entities are in scope?
Sections 24–26 distinguish essential and important entities. Relevant factors include the precise activity in Annex 1 or 2, size under section 25, cases covered irrespective of size and authority decisions. A sector name alone is insufficient. Group data and the statutory conditions for independent IT must be examined separately.
Federal and state administration have their own prerequisites. Municipalities are excluded from the public administration sector; their own annex activities and separate companies need individual consideration. Exemptions for educational and certain state entities do not apply to trust service providers. Jurisdiction under section 28 still needs to be established. §§ 24–28 NISG 2026.
Distinguish obligations and deadlines
- Registration: Section 29(3): initially within three months of entry into force. The BCS states 1 January 2027 in principle and, under section 33(2) AVG, 4 January 2027 at the latest. Entities entering scope later must register as soon as possible, within three months of meeting the prerequisites. “NIS2-Services” is available through the business service portal.
- Measures and management: Sections 31–32 govern management responsibility and risk management. Section 33(1) requires a self-declaration within twelve months after the registration duty arises. This does not provide a general postponement of all obligations.
- Incidents: Sections 34–35: report significant cyber incidents without undue delay, with an early warning within 24 hours and generally an incident notification within 72 hours of awareness. The incident notification limit is also 24 hours for affected trust services. A final report is generally due within one month of notification; ongoing incidents require a progress report and have a separate final deadline.
BCS: registration, updated 2 October 2026; §§ 29, 31–35 NISG 2026. The actual reporting duty depends on the incident and the statutory prerequisites.
Useful next steps
Open the Germany and Austria scope check. Choose the legal context explicitly. The classification is based on your answers; unresolved prerequisites remain unresolved. It is not an authority decision.
The existing checklist, liability and incident reporting guides, and the readiness percentage concern Germany. They are not an Austrian catalogue of measures. Use the linked RIS and BCS sources for Austria.
Our free technical checks provide selected external findings. They assess neither the entire organisation nor fulfilment of national obligations. An ISO certificate, a self-assessment and a technical report each have a distinct scope. View technical checks.