	NIS2 Implementation in the EU
	Austria
	(Europe) Firm CERHA HEMPEL Rechtsanwälte GmbH Contributors Hans Kristoferitsch Updated 29 Jan 2026
Status of the legislative process	Enacted
Status of the NIS2 Implementation Act	The Austrian NIS2 Implementation Act (Netz- und Informationssystemsicherheitsgesetz 2026, NISG 2026) came into force in December 2025.
Significant deviations of the National Implementation Act from the NIS2 Directive, if any	Closely modeled on the NIS2 Directive. There are some deviations as regards sector definitions and their interpretation. Furthermore, the NSIG 2026 additionally imposes an obligation to provide information on risk management measures implemented, in particular with regard to the network and information systems used and the security of supply chains, as well as the results of the risk analysis carried out (so-called self-declaration).The specific requirements for the audit also differ from those set out in the NIS2 Directive. Risk management measures are laid down in secondary legislation. The NISG 2026 provides, in this respect, that reference may also be made to European Union legal acts. These legal acts may also apply to sectors not covered by the European legal act. Similar to Germany, Sect 25 para 4 NISG 2026 excludes the attribution of corporate figures of affiliated and partner companies for the purposes of the Size-Cap-Rule, if an entity does not use a network and information system of affiliated or partner companies for the provision of services.
Date of entry into force of the Implementation Act	1 October 2026

NIS2 Implementation in the EU

Back XLS

Status of the legislative process

Enacted

Status of the NIS2 Implementation Act

The Austrian NIS2 Implementation Act (Netz- und Informationssystemsicherheitsgesetz 2026, NISG 2026) came into force in December 2025.

Significant deviations of the National Implementation Act from the NIS2 Directive, if any

Closely modeled on the NIS2 Directive. There are some deviations as regards sector definitions and their interpretation. Furthermore, the NSIG 2026 additionally imposes an obligation to provide information on risk management measures implemented, in particular with regard to the network and information systems used and the security of supply chains, as well as the results of the risk analysis carried out (so-called self-declaration).The specific requirements for the audit also differ from those set out in the NIS2 Directive.
Risk management measures are laid down in secondary legislation. The NISG 2026 provides, in this respect, that reference may also be made to European Union legal acts. These legal acts may also apply to sectors not covered by the European legal act.
Similar to Germany, Sect 25 para 4 NISG 2026 excludes the attribution of corporate figures of affiliated and partner companies for the purposes of the Size-Cap-Rule, if an entity does not use a network and information system of affiliated or partner companies for the provision of services.

Date of entry into force of the Implementation Act

1 October 2026