Austria NIS2 Implementation: NISG 2026 registration, self-declaration and fines

Austria's NISG 2026 has applied since 1 October 2026, so in-scope entities are now inside a registration window that closes at the end of 2026, with a self-declaration on their risk management measures due about a year later. The Network and Information Systems Security Act 2026 (BGBl. I No. 94/2025) replaces the old NISG, widens scope from roughly 100 operators to around 4,000 entities, and creates a new Federal Office for Cybersecurity (Bundesamt für Cybersicherheit) under the Ministry of the Interior. This guide covers scope, registration, the measures and management duties, reporting, the phased evidence timetable, sanctions, and what the measures mean for service accounts, API keys and AI agents. It is for CISOs, compliance leads and auditors with Austrian entities. The Directive is covered in the NIS2 Directive Guide and the cross-country status in the NIS2 Transposition Tracker.

Sources and status, checked 9 November 2026: the official text in the Austrian legal information system (RIS) could not be accessed during research, so this page is based on secondary sources: Schoenherr's NISG 2026 briefing, iC Consult's July 2026 summary, and the Ministry of the Interior's own magazine article on the new Federal Office. Each obligation is attributed, and figures are given only where two sources agree. Confirm against the official text before relying on it. This page is not legal advice.

Key takeaways

• Register by the end of 2026: Schoenherr gives a three-month window to 1 January 2027 and iC Consult a window from 1 October to 31 December 2026, via the Unternehmensserviceportal (USP).
• Self-declaration in autumn 2027: both summaries put the first self-declaration on implemented measures about 12 months after registration, around 30 September to 1 October 2027.
• Evidence comes later, but not much later: both summaries place the first evidence requests in 2028, and entities must be able to produce evidence on request.
• Management must train and supervise: executive bodies carry responsibility for risk management, must supervise implementation and must complete cybersecurity training.
• Identity and MFA are named: Schoenherr lists identity and access management with multi-factor authentication among the focus measures, which reaches service accounts, keys and AI agents.

Scope: who and what is covered

NISG 2026 follows the Directive's sector annexes and size rules. iC Consult estimates about 4,000 companies across 18 sectors, up from around 100 under the old law, and press coverage of the Federal Office's launch gives the same figure. There is no official notice of scope: entities classify themselves.

• Size: both summaries use the EU SME thresholds: medium from 50 employees or more than EUR 10 million turnover and balance sheet; large from 250 employees, or more than EUR 50 million turnover and more than EUR 43 million balance sheet.
• Public administration: the Ministry of the Interior article says federal and state government bodies are expressly included, with special rules to keep state functions running.
• Digital providers: Implementing Regulation (EU) 2024/2690 sets measures for DNS, cloud, data centre, managed service and similar providers. See the NIS2 Implementing Regulation 2024/2690 Guide.
• Financial sector: DORA applies to financial entities. See the DORA and NIS2 Overlap Mapping Guide.

The Federal Office for Cybersecurity

The Ministry of the Interior describes the Bundesamt für Cybersicherheit as the central national cybersecurity authority. It reports to the Federal Minister of the Interior but is organisationally independent, with nationwide jurisdiction, and was due to start operating on 1 October 2026. Its tasks include supervising entities, managing large-scale incidents, producing situation reports, running a central reporting point and single point of contact, and operating the public-sector Gov CERT. It can order audits and direct measures, and can refer serious violations to the district administrative authority (Bezirksverwaltungsbehörde).

Timeline

Treat 31 December 2026 as the working deadline for registration, since it satisfies both readings.

Key obligations

Risk management measures

Schoenherr lists the focus areas as information security, supply chain security, incident handling, identity and access management with multi-factor authentication, emergency and recovery plans, and training. The Ministry of the Interior adds that measures are technical, operational and organisational and that regular security reviews are required. Schoenherr notes that certifications such as ISO/IEC 27001 can help demonstrate the operational and organisational measures. See the ISO 27001 Certification Guide.

Management duties

• Responsibility: executive bodies, meaning natural persons at management or board level, bear responsibility for risk management and must supervise its implementation (Schoenherr). iC Consult adds that management bodies must approve and oversee the measures.
• Training: executive bodies must complete cybersecurity training, and employees should be trained regularly (Schoenherr; iC Consult).
• Who counts: Schoenherr notes that authorised signatories and roles such as the CISO are generally outside the "executive bodies" definition, so the duty cannot be parked with the security team.
• Recourse: iC Consult notes the company may seek internal recourse against managers for a breach. See the NIS2 Management Liability Executive Briefing.

Incident reporting

Both summaries give the Directive stages: early warning within 24 hours, full notification within 72 hours, and a final report within one month, with interim reports on request. The Ministry of the Interior article says significant incidents go to the competent CSIRT, which passes them to the Federal Office. Trust service providers have special rules. For the cross-regime picture, see the Cyber Incident Reporting Requirements Map.

Supervision and sanctions

• Supervision model: essential entities face ex ante supervision; important entities mainly ex post, ad hoc supervision (Schoenherr).
• Tools: disclosure and submission duties, ad hoc audits, security scans, appointment of a supervisory officer, and in severe cases revocation of business licences or a temporary ban on managerial functions (Schoenherr).
• Fines: both summaries give up to EUR 10 million or 2% of worldwide annual turnover for essential entities and up to EUR 7 million or 1.4% for important entities, whichever is higher.
• Registration failures: iC Consult and Born City both report fines of up to EUR 50,000 for a first breach of organisational duties such as registration, and up to EUR 100,000 for repeat cases. Born City adds that district administrative authorities impose fines on the Federal Office's application.
• Public bodies: Schoenherr reports that public authorities are not fined and face a public disclosure regime instead.
• GDPR overlap: Schoenherr notes there is no double penalty where the same conduct also breaches the GDPR.

What it means for AI agents and non-human identities

The self-declaration is the first time many Austrian entities will have to describe their measures in writing to a regulator. Identity and access management with MFA is a named focus, and machine identities are where MFA does not apply in the usual way, so expect questions about the compensating controls.

• Inventory: list service accounts, API keys, OAuth applications, certificates and AI agents per Austrian entity, with an owner. The Non-Human Identity (NHI) Guide sets out the categories.
• MFA for machines: where a non-human identity cannot use MFA, show the alternative: workload identity federation, short-lived tokens, certificate binding or network restriction.
• Agent identities: give each AI agent its own identity, scope it narrowly and log its actions, so an incident involving an agent can be reported within 72 hours.
• Supply chain: register credentials and OAuth grants held by suppliers and managed service providers.
• Review cadence: NHI Mgmt Group recommends quarterly review of privileged machine identities and annual review of the rest. This is our recommendation, not an Austrian rule.

Compliance steps

1. Classify each Austrian entity against the annexes and size thresholds and record the reasoning.
2. Register via USP before 31 December 2026.
3. Brief and train the executive body; minute approval of the measures.
4. Run a gap assessment against the focus areas, including MFA and machine identities.
5. Draft the self-declaration early in 2027 so evidence gaps surface in time.
6. Build an evidence pack you can hand over on request from 2028.
7. Rehearse 24-hour, 72-hour and one-month reporting to the CSIRT.

Common failure patterns

• Waiting for a notice: there is no scope letter; entities must self-classify.
• Delegating to the CISO: the management duty sits with the executive body.
• Self-declaration as paperwork: a declaration that overstates controls becomes a liability when evidence is requested.
• MFA for people only: service accounts and agents with static secrets and no compensating control.
• Group registration assumed: each legal entity registers on its own.

Practitioner checklist

• Classify every Austrian legal entity and keep the reasoning.
• Complete USP registration by 31 December 2026.
• Record executive body training and approval.
• Map measures to the focus areas, including IAM and MFA.
• Inventory machine identities and AI agents with owners.
• Document compensating controls where MFA does not fit.
• Plan the 2027 self-declaration and the evidence pack.
• Rehearse the reporting stages with the CSIRT route.

Standards and references

• Schoenherr: NISG 2026 (English briefing)
• iC Consult: NISG 2026, what Austrian companies face from 1 October
• Bundesministerium für Inneres: Öffentliche Sicherheit magazine, Bundesamt für Cyber-Sicherheit
• Born City: Austria's BCS starts on 1 October
• EUR-Lex: Directive (EU) 2022/2555 (NIS 2)

Related NHI Mgmt Group resources: NIS2 Directive Guide · NIS2 Transposition Tracker · Germany NIS2 Implementation Guide · NIS2 Readiness Checklist · Non-Human Identity (NHI) Guide. This guide summarises NISG 2026 as it stood on 9 November 2026 and is not legal advice.