If you run security, IT or GRC for an essential or important entity in Austria, the eight supplier-contract terms of the EU's implementing regulation on NIS2 have applied to you since 2 October 2026. Until then they bound only the provider types that regulation names; for everyone else they were a reference. Austria's NISV 2026 ordinance changed that. Here is what it means for the contracts you already hold and the ones you sign next.
What changed on 2 October 2026
The Bundesamt für Cybersicherheit, Austria's authority under NISG 2026, issued NISV 2026 (BGBl. II Nr. 290/2026), its ordinance on risk-management measures, on 1 October 2026. Under its § 9 it entered into force at the end of that day. Its § 2 reads:
Die näheren Anforderungen an die Risikomanagementmaßnahmen gemäß Art. 2 samt Anhang der Durchführungsverordnung (EU) 2024/2690 […] ABl. Nr. L 2024/2690 vom 18.10.2024, sind auch auf die nicht von dieser Durchführungsverordnung umfassten in den Anlagen 1 und 2 des Netz- und Informationssystemsicherheitsgesetzes 2026 (NISG 2026), BGBl. I Nr. 94/2025, gelisteten Arten wesentlicher und wichtiger Einrichtungen anwendbar.In our translation: the detailed requirements for the risk-management measures under Article 2 together with the Annex of Implementing Regulation (EU) 2024/2690 also apply to the types of essential and important entities listed in Annexes 1 and 2 of NISG 2026 that the regulation does not cover. (In the German, […] stands for the regulation's full title.)
Implementing Regulation (EU) 2024/2690 sets out the risk-management measures in detail, and its Annex point 5.1.4 lists what supplier contracts specify. At EU level it binds only the provider types it names, such as cloud, data centre, DNS, managed service and trust service providers. § 2 adopts the Annex by reference and widens whom it binds. The text stays the EU's: Austria adds no list of its own.
The eight terms run from security requirements for the supplier and incident notification without undue delay to audit rights and exit duties; our post on the eight supplier-contract clauses explains each one.
Whom it binds
It binds every type of essential and important entity listed in Annexes 1 and 2 of NISG 2026. The provider types the regulation names were bound already; § 2 adds the rest. In plain terms: if your organisation is an essential or important entity in Austria, the eight terms apply, where appropriate, to its contracts with suppliers in the supply chain of its network and information systems. For a group with Austrian entities, look at each entity: those regulated in Austria as essential or important are bound. The Austria page has the Act, the authority and the deadlines.
Which suppliers count? The authority's FAQ on the supply chain, which is guidance rather than law, says not every supplier is covered, but IT providers alone would be too narrow: anyone in the supply chain of the network and information systems behind your services counts. Its example is the air conditioning for the server room.
"Where appropriate", and the record for a term you leave out
The terms keep their qualifier: contracts specify them "where appropriate". Not every contract needs all eight. Background checks, for example, don't fit a supplier whose staff never reach your systems or data.
Because § 2 applies Article 2 of the regulation as well as its Annex, the regulation's rule on reasoning comes with it, in our reading. Under Article 2(2), where you consider a term not appropriate, not applicable or not feasible for a contract, you document your reasoning "in a comprehensible manner". NISV 2026 § 4(4) adds that no compensating measures are owed for requirements under § 2 that apply only where appropriate, applicable or feasible. In our reading, what you owe for such a term is a written reason, not a substitute control.
A short written line per contract and term is a practical way to record it; the authority hasn't published a format. Note the term, why it doesn't fit this supplier (what the supplier touches, its tier), who decided, and when. For example: "(c) Background checks on the supplier's staff: not appropriate; the supplier's staff have no access to our systems or data. Decided by [role], [date]." The reason is what separates a term left out on purpose from one nobody thought about.
Contracts signed before 2 October 2026
We found nothing in NISV 2026, or in the transitional provisions of NISG 2026, on whether or by when supplier contracts already in force are to be amended (checked on RIS, 22 October 2026). The ordinance simply applied from the end of the day it was promulgated. Until the authority says more, this is the order of work we would suggest:
- Know the gaps now. Read each in-scope contract against the eight terms, with everything it refers to, and note for each term whether it is covered and where.
- Fix them at renewal. Note the renewal date, and record the fix as a condition of your decision on the supplier. Our contract post sets out the renewal-cycle approach.
- Record the reasoning today. In our reading, a term you consider not appropriate needs no renegotiation, only the written reason above.
For planning: the self-declaration of implemented risk-management measures is due within twelve months of the registration duty arising (NISG 2026 § 33(1)); the authority dates this to 30 September 2027 for entities in scope from the start.
New and renewed contracts
For contracts you sign or renew from now on, start from the eight terms and decide, per supplier, which are appropriate. The authority's FAQ makes one point on form: a reference is not a term. The requirements aim at "concretely framed, verifiable contractual obligations", and "a general reference to NISG 2026, for example in your general terms or purchasing conditions, does not meet these requirements" (our translation).
We would match the depth to the tier: the full set for your highest-tier suppliers; for a supplier that touches less, fewer terms, with a reason on file for each one left out. The wording itself is your counsel's work; this post is background for that conversation.
Where to start
Step 3 of the free NIS2 supplier review kit is the contract check: it lists the eight terms, has you note Yes, No, Partly or Not applicable and the clause for each, and plans the missing ones for the next renewal. Start with the suppliers you rated highest. The kit's policy builder has an Austrian version of its contract clause: new and renewed contracts cover the eight terms where appropriate, and you record your reasoning for any you consider not appropriate.
Sources: NISV 2026 (BGBl. II Nr. 290/2026), §§ 2, 4(4) and 9, and NISG 2026 § 33(1), as published on RIS; Implementing Regulation (EU) 2024/2690, Article 2(2) and Annex point 5.1.4; the Bundesamt für Cybersicherheit's FAQ on the supply chain (guidance, not law). The German quote was checked against RIS on 22 October 2026.