Does NISG 2026 apply to your company?

Two things decide it: what you do, and how big you are. The activity has to fall inside one of the 18 sectors in Anlage 1 and Anlage 2 of the NISG 2026, and the size threshold starts at 50 employees, or turnover and balance sheet total both above €10 million. Some providers are covered regardless of size — DNS service providers, TLD registries, qualified trust service providers and public electronic communications among them. What counts is what you actually do, not what the company name says.

No, and this is the part that surprises people. You have to assess it yourself and register yourself by 31.12.2026. The Bundesamt für Cybersicherheit can additionally classify an entity by formal notice in certain cases, but that is the exception — the rule is self-assessment, and a missed registration is a formal breach in its own right.

Not the obligations — those are the same. The difference is supervision and penalties. Essential entities can be examined without any particular trigger; important entities are supervised mainly when there is cause, such as a self-declaration that shows gaps. The penalty ceiling differs too: €10 million or 2% of worldwide turnover against €7 million or 1.4%.

In many cases yes, and this is the most common reason a company turns out to be affected when it expected not to be. Sizes are worked out on the EU SME definition: linked enterprises above 50% count in full, partner enterprises between 25% and 50% count proportionally. A 30-person subsidiary of a large group is frequently not a small enterprise in the eyes of the law.

Possibly. Anlage 1 Z 9 does carry an exemption, but a narrow one: managed services "operated and used exclusively by the entity concerned". It is written around the single entity, not the group — so a central group IT company that serves its sister companies is, on the wording, outside the exemption and can count as a managed service provider on its own account. Worth having examined rather than assumed; the assumption usually runs the wrong way.

§ 32 Abs. 4 names ten areas, from risk analysis and incident handling through supply chain, cryptography and access control to multi-factor authentication. The detail is left to a regulation. For digital providers, Implementing Regulation (EU) 2024/2690 already applies directly and is binding. For every other sector the national regulation has not been issued yet, and until it is the WKO recommends working to the EU regulation — which is what we do, saying in each report which part is binding and which is orientation.

Yes. § 31 requires the members of the management body to take part in cybersecurity training designed for them, and general staff awareness training does not normally satisfy it. The statute sets no separate deadline for it, which means it applies from 01.10.2026 like the rest of § 31 — together with the duty to ensure and supervise compliance that the same paragraph places on the same people. And a missed training is not a formal breach: § 45 Abs. 1 Z 1 puts it in the highest penalty band.

It is a strong foundation and covers a great deal of § 32 Abs. 4, but it does not cover everything the NISG 2026 asks for. Registration, the incident reporting deadlines, the self-declaration and the training of the management body are statutory duties that no certificate discharges. The useful exercise is mapping what your existing certification already evidences and naming what is left, rather than assuming either extreme.

No. What we produce is a reasoned assessment with the paragraphs it rests on, which is what you need in order to decide and to document the decision. It is not legal advice and it does not bind the authority. For genuine borderline cases we recommend a legal review, and we will say plainly when we think yours is one.