NIS2 in Austria — transposition status and what’s changed

Austria entered NIS2 on 1 October 2026 with the sharpest scope jump in the region relative to its starting point: NISG 2018 covered roughly 100 designated operators of essential services; NISG 2026 brings around 4,000 entities into scope, with obligations applying in full from day one. The delta is the Austrian mid-market: machinery and component manufacturers, food and chemical producers, logistics operators, regional utilities and healthcare providers, plus the Vienna-headquartered groups whose operations span central and eastern Europe. Most of the newly scoped population has never dealt with a cybersecurity supervisor — and in most cases nobody tells them they are in scope: under NISG 2026 entities assess their own classification, and the authority classifies by formal decision only in specific cases the act sets out.

Entities sort into essential and important, with genuinely different supervisory postures: essential entities face proactive, ex ante supervision, while important entities are supervised reactively, on occasion. The calendar is compressed either way — registration with the Bundesamt für Cybersicherheit by 1 January 2027, and a proactive self-declaration of implemented risk-management measures within twelve months of the registration obligation arising, which the authority dates to 30 September 2027. Austria transposed late; the schedule it adopted makes up the time.

The NISG 2026 was promulgated in the Federal Law Gazette (BGBl. I No. 94/2025) on 23 December 2025 — after a first transposition attempt, the NISG 2024, failed to reach the required two-thirds parliamentary majority in July 2024 — and has been in force since 1 October 2026, when the NISG 2018 and its small population of designated operators ceased to apply. The act established a new supervisory authority, the Bundesamt für Cybersicherheit (Federal Office for Cybersecurity), under the Federal Ministry of the Interior. It has published its registration procedure and FAQ, runs registration and incident reporting through the Unternehmensserviceportal, and issued the NISV 2026 — the ordinance that sets more detailed requirements for the risk-management measures and further criteria for a significant incident. Its § 2 applies the risk-management requirements of Implementing Regulation (EU) 2024/2690, which at EU level bind only the provider types it names, to every essential and important entity, the eight supplier-contract terms of Annex point 5.1.4 included. The operational CSIRTs are GovCERT Austria, HealthCERT for the health sector, and the national CSIRT — a role CERT.at carries on a transitional basis. Incident notification follows the directive ladder — early warning within 24 hours of becoming aware, full notification within 72 hours, a final report within a month, interim reports on request.

What distinguishes the Austrian regime is its explicit proof-of-compliance staircase: register by 1 January 2027, self-declare implemented risk-management measures within twelve months of the registration obligation arising (30 September 2027 for entities in scope on day one), and from October 2028 answer evidence requests on statutory clocks — essential entities have two months to evidence their operational and organisational measures, and a current ISO/IEC 27001 certification covering the whole entity can carry that part of the demonstration. Management accountability is personal: executive bodies bear responsibility for risk management, must complete cybersecurity training themselves, and, where an essential entity fails to comply with a supervisory order, can be temporarily barred from exercising managerial functions.

Austria’s timing creates a two-way asymmetry. Slovakia’s transposition took effect in January 2025, Czechia’s in November 2025, Germany’s in December 2025 — so Austrian suppliers selling into those markets were receiving NIS2-shaped evidence requests from regulated buyers well before their own law took effect on 1 October 2026. Meanwhile, Austrian buyers starting structured supplier programmes now find much of the domestic supplier base untouched by supervision: with the regulated population jumping from about 100 designated operators to around 4,000 entities, the supplier tier beneath is greener still.

Vienna’s role as a regional headquarters hub adds a structural pattern of its own: Austrian groups in banking, insurance, energy, and retail run subsidiaries across central and eastern Europe, so supplier inventories and intra-group service relationships cross borders in both directions. And the weight the Austrian regime gives relevant certifications — the authority names ISO/IEC 27001 as its example of a certificate that can evidence operational and organisational measures — makes certificates do more of the talking in Austrian evidence collection. Useful, but a supplier’s certificate is evidence about the supplier; it is not your documented assessment of the relationship, and that assessment duty stays with the buyer.

Vittnor — Supply Chain Assurance for the mid-market — produces the proof shape the Austrian regime is built around: structured, dated, reviewer-attributed records with a decision trace, exportable when the Bundesamt für Cybersicherheit asks. In a regime where implemented measures must be self-declared within twelve months and evidence requests run on statutory clocks — two months for essential entities’ operational and organisational measures — the working difference is between answering from records you already hold and attempting a reconstruction under deadline.

For the cross-border chains Austrian buyers actually run, the aim is one supplier file that supports the Austrian buyer’s questions and the supplier’s own German, Czech, or Slovak obligations — cross-buyer routing is planned for later versions. For mid-market entities without a dedicated CISO, the one-off NIS2 Supplier Exposure Assessment maps the supplier-risk landscape while the self-declaration clock is still running, and the platform then carries the ongoing programme the NISG 2026 now expects — the pilot is open today.