NIS2 scope check for Germany and Austria — limited guidance

NIS2 is Directive (EU) 2022/2555. In Germany, national implementing provisions have applied since 6 December 2025. The BSIG covers certain entity types and regulates risk management, reporting and registration, among other matters. In Austria, the main duties under the NISG 2026 apply from 1 October 2026. The specific scope and sectoral exceptions require separate assessment.

§ 28 BSIG combines entity types from Annexes 1 and 2 with size criteria and special cases. Under the general size rule, at least 50 staff, or annual turnover and annual balance sheet total both above EUR 10 million, are sufficient. Different thresholds or size-independent conditions apply to particularly important entities. Enterprise links and sectoral exceptions must also be considered. In Austria, §§ 24 to 28 NISG 2026 govern classification: entity types in Annexes 1 and 2, size under § 25, size-independent cases such as DNS service providers or public administration, and exceptions such as those for educational institutions. The scope check maps confirmed conditions and expressly leaves unresolved cases open.

For certain infringements concerning measures, documentation and reporting, § 65 BSIG sets maxima of up to EUR 10 million (bwE) or EUR 7 million (wE). Where the worldwide total turnover of the undertaking concerned exceeds EUR 500 million, the turnover-based alternatives of 2% or 1.4% may apply. The infringement, attribution and assessment are decisive; personal responsibility is not categorically excluded. § 38(2) separately regulates liability for damage culpably caused to the entity itself by breaching the duties in subsection (1). The optional calculation illustrates only an applicable German statutory maximum, using separately confirmed information, rather than a sanction or personal liability. The scope check does not calculate amounts for Austria; the penalty ranges are in § 45 NISG 2026.

Germany’s NIS2 Implementation Act has been in force since 6 December 2025. Under § 33(1) BSIG, registration is generally due within three months of first or renewed coverage. The date of 6 March 2026 concerned entities already covered on 6 December 2025. The registration period is not a general grace period for risk management or incident reporting; special evidence and sectoral rules require separate attention. In Austria, NISG 2026 duties apply from 1 October 2026. Entities already covered that day register within three months of entry into force; the BCS states 1 January 2027 in principle and, under § 33(2) AVG, 4 January 2027 at the latest. Entities covered later register no later than three months after meeting the conditions (§ 29(3)).

Article 21 of the NIS2 Directive defines 10 areas of measures, implemented in Germany through § 30 BSIG: risk analysis, incident handling, business continuity, supply chain security, secure development, effectiveness assessment, cyber hygiene training, cryptography, access control, and authentication and secure communications. Management must implement these risk management measures and oversee their implementation (§ 38(1) BSIG). § 38(2) BSIG applies to damage culpably caused to the entity itself by a breach of these duties. The conditions and exceptions in the BSIG require separate assessment. Management must also regularly undertake training (§ 38(3) BSIG). In Austria, § 31 NISG 2026 regulates management body duties and § 32 regulates risk management measures.

No. The German and Austrian rule paths assess selected, expressly confirmed conditions from self-reported information, including the balance sheet total. They do not individually establish enterprise links, a legal characteristic, an exception or jurisdiction. Unknown information remains unresolved. No monetary amount is calculated for Austria; Switzerland and other EU Member States receive sources without a class or monetary amount. This page does not replace an administrative decision or a legal decision on scope, registration, liability or reporting.

The Austrian rule path applies the NISG 2026 as applicable from 1 October 2026: entity type under Annexes 1 and 2, public administration and exceptions under § 24, size under § 25 using the SME Recommendation, classification decisions under § 26 and § 11 RKEG, and jurisdiction under § 28. The result is an indication as an essential or important entity, a limited finding of no match, or a specified case requiring clarification. Events up to 30 September 2026 are generally governed by the NISG 2018 and are not assessed.