Austria: the NISG 2026 is in force today, and the registration deadline moved
· Cryptaguard · 5 min read
The Austrian transposition took effect on 1 October 2026, in one piece and with no staging. A brand-new supervisor opened the same morning, and it published a first-registration deadline that is later than either of the two dates in circulation: 4 January 2027, not 31 December 2026.
What happened
The Netz- und Informationssystemsicherheitsgesetz 2026 entered into force this morning. It was promulgated nine months ago, on 23 December 2025, as BGBl. I Nr. 94/2025, and its section 51 set commencement at the first day of the month following nine months after promulgation. That day is today.
The part worth being clear about is what section 51 does not do. It does not stage anything. Sections 2 to 50 and both annexes all take effect on this single date, and the split between its two paragraphs is constitutional rather than calendrical — section 1 is a Verfassungsbestimmung. Several trackers described Austrian entry into force as phased. It is not, and an entity that planned around later phases planned around something that does not exist.
A supervisor that did not exist yesterday
Austria did not hand NIS2 to an existing body. It created one. The Bundesamt für Cybersicherheit took up its work today as a subordinate agency of the Federal Ministry of the Interior, and its website went live the same morning. By its own description it coordinates the Austrian cybersecurity strategy, leads the national coordination structures, produces situation pictures, operates the single point of contact and GovCERT Austria, empowers CSIRTs, admits independent auditors, and exercises supervision and enforcement over essential and important entities.
One consequence of a supervisor this new: the detail arrives after the obligations, not before. The act works through implementing ordinances, and where they are published was settled only three weeks ago — a Chancellor's ordinance of 10 September 2026, BGBl. II Nr. 270/2026, directs them to Bundesgesetzblatt II, and it took effect today as well. Watch the gazette, not only the supervisor's guidance pages.
The registration deadline moved, and it moved later
Until today there were two dates in circulation. The statutory count of three months from entry into force under section 29(3) lands on 31 December 2026, which is what the WKO published. The USP notice worded the same obligation as initially by 1 January 2027. We told readers to treat 31 December as the date they were held to.
The supervisor has now published its own, and it is later than both.
Erstregistrierung. Initial: Grundsätzlich bis 1. Jänner 2027, aufgrund § 33 Abs. 2 AVG bis spätestens 4. Jänner 2027 (drei Monate nach Inkrafttreten).Pflichten für Einrichtungen — Registrierung
The reasoning is ordinary Austrian administrative procedure. Section 33(2) of the Allgemeines Verwaltungsverfahrensgesetz moves a deadline that falls on a Saturday, a Sunday or a public holiday to the next working day. 1 January 2027 is a Friday and a public holiday, 2 and 3 January are a weekend, so the last day is Monday 4 January 2027.
Nothing is lost by registering in December, and there is every reason to. But 4 January 2027 is the date the authority holds you to, and a compliance calendar that says 31 December is now four days stricter than the law. An entity that becomes an essential or important entity after today has its own three months from the day it meets the criteria, not the national date.
Two gaps the supervisor declares itself
Registration and incident notification both run through the NIS2-Services application in the Unternehmensserviceportal, which opened today. Two things about that channel are worth planning around, and both come from the BCS rather than from reading between the lines.
- Public administration entities cannot use it yet. The BCS records that a connection through the Portalverbund is still being built and is to be made available shortly after 1 October 2026. A public body registers when that opens.
- There is a documented fallback. For a temporary technical unavailability of the reporting portal, the BCS publishes notification forms for each notification type under Recht und Dokumente. An outage does not stop the 24-hour clock, so find those forms before you need them, not during an incident.
What is due now, and what is not
Incident notification is compulsory from today and goes to the entity's competent sectoral CSIRT: an early warning within 24 hours of becoming aware of a significant incident, which can only be submitted once, and a notification within 72 hours, under section 34(2) of the NISG 2026.
The risk-management measures are in section 32(4), as ten lettered points a) to j) in the order of article 21(2) of the directive. Austria adds no eleventh national measure, so an entity that built against the directive built against the Austrian article.
What Austria adds is not a measure but a dated proof obligation, and two of its deadlines are far enough out to be mis-provisioned in both directions:
- The self-declaration under section 33(1) — a structured statement of the measures actually implemented — is due within twelve months of the registration duty arising, not of the day you register. For an entity in scope today that is 30 September 2027, and registering late does not move it.
- Independent verification under section 33(2) is a separate stage, on request, and the first request cannot be made until two years after entry into force. Not before 1 October 2028. An audit budgeted for 2027 is budgeted for an exercise that cannot be demanded yet.
One more thing with a statutory expiry date on it: under section 51(6) the CSIRT empowered under the 2018 NISG continues the national CSIRT tasks only until one is empowered under section 8(2) of the new act, and for no longer than two years. Confirm the designation before you write an incident contact into a runbook.
A warning from the portal itself
The USP notice carries an unusual official warning alongside the practical steps: be careful with the "NISG-Betroffenheitsanalysen" widely offered online, particularly where they ask you to disclose sensitive company data, and check who is behind them. Scope is determined by sections 25 and 29(2) of the act and by annexes 1 and 2. Whoever helps you read them, the data you hand over is a decision of its own.
Where this leaves the 27
Austria was the last member state holding a transposition law that was adopted and promulgated but not yet applicable. With it in force, 24 of the 27 have NIS2 law in force and none is waiting on a commencement date.
That leaves three, and their lateness is of a different kind: Spain, France and Ireland do not have a text waiting for a date, they do not have the text. All three were referred to the Court of Justice of the European Union in the Commission's July 2026 infringement package, with a request for a lump sum and daily penalty payments. The French resilience bill was listed for the floor of the Assemblée nationale on 7 October, then withdrawn from the order of business on 6 October with no new date.