NIS2 in Austria
What binds you in Austria is the national law transposing NIS2 — not the directive itself. Here is who supervises you, where you register, and where you report.
Reviewed . Verify against the national official journal before relying on this for a filing.
National transposition
Status of the national text · Promulgated, staged entry into force
Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026)
Promulgated in the Bundesgesetzblatt on 23 December 2025, with entry into force staged from 1 October 2026 — nine months later. Austria created a dedicated central supervisor, the Bundesamt für Cybersicherheit, rather than assigning the role to an existing body.
Who supervises you
Bundesamt für Cybersicherheit is the competent authority designated by Austria. It holds the article 32 and 33 supervisory powers: inspections and audits, requests for information and evidence, binding instructions, orders to remedy deficiencies, and administrative fines. For essential entities those powers are exercised ex ante — without needing any indication of non-compliance.
Incident notifications under article 23 normally go to CERT.at, though some member states route them through the competent authority instead. Confirm the channel before you need it: the 24-hour clock is not the moment to discover which portal applies.
What differs from the directive
Because NIS2 is a directive, Austria legislated its own version of it. The minimum measures of article 21(2) are common across the Union (“shall include at least”), and a member state may go further (article 5). What does differ:
- Registration. The portal, the information required and the deadline are national.
- Scope. Several member states extended coverage below the directive's size thresholds, or added sectors of national importance.
- Penalty calibration. Article 34 sets common floors for the maximum fine; the national maximum can be higher, and how the authority calibrates a fine is national.
- Reporting format. Deadlines are fixed by the directive; the form and the language are national.
Transposition is not complete here
That is not a reason to wait. The minimum measures of article 21(2) are set by the directive; national law settles the procedural detail and may go further (article 5). The European Commission sent letters of formal notice to 23 member states in November 2024 for missing the 17 October 2024 transposition deadline.
If you operate in several member states
You have one security programme and several compliance relationships. Registration, supervision and reporting are per-jurisdiction, and a cross-border incident can require filings in each affected member state. Article 26 sets jurisdiction rules — generally the member state of establishment, with specific rules for digital providers.