NIS2 in Austria: what applies now

The Network and Information Systems Security Act 2026 (NISG 2026) has been in force since 1 October 2026. It transposes the European NIS2 Directive into Austrian law and replaces the previous act from 2018. The circle of obliged entities grows considerably. What is new is not only who is in scope, but also how precisely security has to be evidenced.

Who the act covers

Two questions decide: which sector does a company operate in, and how large is it? Healthcare and digital infrastructure, including telecommunications, are sectors of high criticality. Other critical sectors include parts of manufacturing and food wholesale.

Size is not measured by headcount alone. A company counts as medium-sized if it employs at least 50 people. The same applies if its annual turnover and its balance sheet total each exceed ten million euros. It counts as large if it employs at least 250 people. The same applies if its turnover exceeds 50 million euros and its balance sheet total exceeds 43 million euros. Sector and size together determine whether an entity is essential or important.

Falling below these thresholds does not mean being out of the picture. Entities in scope must assess the security of their supply chain, including their service providers and suppliers. The requirements thus travel down through contracts. They pass from hospital to laboratory, from factory to supplier, from telecommunications network to software house.

The deadlines

The obligations on risk management, reporting and management responsibility have applied from day one. Registration with the cybersecurity authority is due within three months of entry into force. That means by the turn of the year. Entities report, among other things, their sector, establishments, point of contact and size classification. If these details change, short deadlines of two weeks to three months apply.

Within twelve months of the registration obligation arising, the self-declaration follows. In it, each entity describes the measures it has implemented and its systems. It also covers the security of its supply chain and the outcome of its risk analysis.

From two years after entry into force at the earliest, the authority may require evidence from an independent body. Essential entities must then demonstrate operational and organisational implementation within two months. Valid relevant certificates are recognised for this.

When it gets serious

Significant security incidents are reported to the competent computer security incident response team, the CSIRT. An early warning is due within 24 hours. Within 72 hours follows the actual notification with an initial assessment of severity and impact. One month later comes a final report on causes and remedial measures. Meeting these deadlines requires responsibilities and procedures in place before something happens, not afterwards.

Ten areas, one yardstick

The act sets out minimum content for risk management:

• Risk analysis and security policies
• Incident handling
• Business continuity with backup and crisis management
• Supply chain security
• Security in acquisition, development and maintenance
• Assessment of effectiveness
• Cyber hygiene and training
• Cryptography
• Personnel security, access control and asset management
• Multi-factor authentication and secured communication

What is required is not the maximum, but what is appropriate. Measures are scaled to risk, size and the possible consequences of an incident.

Management is accountable

Management bodies must ensure and oversee implementation. They must attend cybersecurity training themselves. The company must regularly offer corresponding training to its staff. Cybersecurity is therefore not a task that can simply be handed over to IT.

What failures cost

Essential entities face fines of up to ten million euros or two percent of worldwide turnover. Important entities face up to seven million euros or 1.4 percent. The higher amount applies in each case. Notably, anyone who openly states in the self-declaration what is still missing is not fined for that alone. The act rewards openness. But it does expect the gaps to be closed.

Evidence, not folders

Most of the obligations are not new. What is new is that they must be evidenced, completely and on request. Organisations already working to ISO/IEC 27001 have a large part covered: the standard arranges 93 controls in four themes. Registration, reporting channels and management duties come on top. Those maintaining ISO 9001 or sector-specific standards will recognise many building blocks. These include the risk register, training records, supplier evaluation, internal audits and management review. Evidence kept properly once serves several standards at the same time.

What software can do, and what it cannot

No software makes a company NIS2-compliant. But it can make visible whether it is. SpiceQMS runs the management system in one shared data model instead of folders. Processes have owners and versions, documents have approval and read confirmation, and risks have measures. Audits and inspections of every kind, internal and external, are tracked with their findings through to closure. Supplier evaluation, management review and a legal register with owners and review dates complete the picture. Events run with deadlines and escalation. Standards and laws can be assigned per process and per site. Training and qualifications with their validity come from SpiceHCM, on the same platform.

Spice AI helps where routine eats up time. The AI drafts policies and checks existing documents against NIS2 and ISO/IEC 27001. Before an audit, it compiles the evidence. It suggests risks and measures. It answers questions from your own manual and cites the source. For a security incident, it suggests how to classify it and which reporting deadline is running. Every request is logged. The AI only sees what the signed-in person is allowed to see, and adopts nothing without confirmation. It works with the AI provider you connect yourself, and on request with a model in your own data centre. Reports from whistleblowers and compliance reports remain closed to Spice AI.

What comes next

This article opens a series. The next instalments cover supply chain security, the self-declaration in practice and the requirements of individual industries. How SpiceQMS handles compliance is shown on the Compliance page. What NIS2 means for your industry is set out on the relevant industry page.

This article provides an overview and does not constitute legal advice.