Austria's NISG 2026 Is Live: Registration Bites First, Supply Chain Bites Hardest

On 1 October 2026, the Netz- und Informationssystemsicherheitsgesetz (NISG 2026) came into force, implementing NIS2 for roughly 4,000 Austrian organisations across 18 sectors. The Bundesamt für Cybersicherheit now oversees a regime in which risk-management measures, supply-chain security and incident reporting are operational duties — not a future project. Austria is a late adopter by European standards: KPMG counts 1,354 days between NIS2's entry into force and the Austrian start date.

KPMG's analysis of 1,396 Austrian companies, run with the Sicherheitsforum Digitale Wirtschaft, puts the average NISG implementation score at 2.96 out of 5, with 16 per cent still below 2. That is the gap the next ten weeks have to close.

Registration buys time, but not much

Two administrative dates sit in front of every newly scoped organisation. Registration via the Unternehmensserviceportal must be completed by 31 December 2026. The self-declaration on implemented risk-management measures follows within 12 months, by 30 September 2027 in the WKO's FAQ; its timeline marks 1 October as the date it must be done. External proof is further out: the authority can only request an independent review from 1 October 2028, and for important rather than essential entities only where there are justified indications.

None of this creates a grace period. Since 1 October, the duty to maintain the measures themselves and to report significant cyber incidents is already in force.

Incident reporting is the first thing that can go wrong

The reporting cascade cannot be scheduled: an early warning within 24 hours of a significant incident becoming known, a fuller notification within 72 hours, and a final report within one month of the early warning, with intermediate updates on request. The same cadence is familiar from the Cyber Resilience Act's Article 14, which has applied since 11 September 2026. The clock starts on awareness, not on completion of forensics. If personal data is involved, GDPR duties run separately. A mid-sized team that first works out who calls whom during a live incident will miss the deadline, and neither the CSIRT nor the Bundesamt für Cybersicherheit needs to wait for an audit to start asking questions.

Management liability is the part directors feel first

The leadership organ — in a GmbH, the managing director — is responsible for compliance with and supervision of the measures, and must attend cyber-specific training. Penalties for essential entities run to €10m or 2 per cent of group turnover; for important entities, €7m or 1.4 per cent. Missing registration or the self-declaration carries fines of up to €50,000, or €100,000 for repeat offences. This is a personal, documented obligation of the people who run the company, not a risk that sits in the IT budget.

Scope still catches people out

NISG applies where two conditions meet: activity in a listed NIS sector and reaching the size threshold. A medium company exists from 50 employees, or turnover above €10m and balance-sheet total above €10m, as long as it is not large. Large starts at 250 employees, or turnover above €50m with a balance-sheet above €43m. Small companies stay outside with limited exceptions, but suppliers to in-scope firms get pulled in through contracts. The WKO's online guide is the quickest route to a real answer, and group structures need item-by-item review because each legal person is assessed separately.

Supply chain is where the data is worst

The NISG makes security of the supply chain a direct duty: organisations must assess the specific vulnerabilities of each direct supplier or service provider, including the security of their development processes. KPMG's survey shows why this matters. Supply-chain security scores 2.03 out of 5, against 3.62 for multi-factor authentication, and only 11 per cent of companies call their supply-chain measures complete and effective. One in five attacks on a supplier or service provider has led to an attack on the customer organisation, a share that has more than doubled in a year.

The accompanying NISV 2026 requires the risk analysis to cover technological, human, ICT-supply-chain and location risks, and allows compensating measures where a requirement cannot be met — provided they are documented and reviewed at least annually.

What Hungary and Croatia can teach Austria

Earlier adopters have not produced a clean template. In Hungary, the NIS2 process is caught up in a wider post-election rule review, with around 4,000 companies said to be affected; the political calendar is shaping the timetable. In Croatia, legislation is in place, but a GRC manager interviewed by Help Net Security said organisations are still waiting for the first audits to understand enforcement, and uncertainty over scope persists. Austria can skip that waiting period. The uncertainty is exactly what a scope exercise now can remove.

Where to start this week

Run the Spirity NISG scope check, put a named person in charge, and register before the end of the year. If you have no full-time CISO, the shortfall is not just expertise — it is an accountable management-level function. A virtual CISO service provides that function without a full-time hire, so the leadership organ keeps direction while the work actually gets done. Then ask your three most critical suppliers for their named incident contact and whether they can notify you within 24 hours. That one question will reveal more about your real NISG position than any generic checklist.