Source: Safeguard Blog
Austria’s Netz- und Informationssystemsicherheitsgesetz 2026, or NISG 2026, took full effect on 1 October 2026, replacing the NISG 2018 on the same day. Published in the Federal Law Gazette as BGBl. I Nr. 94/2025 on 23 December 2025, the law is Austria’s long-delayed transposition of the EU NIS2 Directive. The Austrian Economic Chamber estimates that around 4,000 companies and organisations across 18 sectors are directly in scope, and the law’s supply chain provisions reach their software and service suppliers through contractual obligations.
No transition period for the core duties
There is no grace period for the substantive requirements. Risk management measures, including supply chain security, incident reporting duties and management training all apply from the start. Essential entities face fines of up to EUR 10 million or 2 percent of worldwide turnover, whichever is higher, while important entities face up to EUR 7 million or 1.4 percent. Management bodies are personally responsible for steering cybersecurity and must complete cybersecurity training, and organisations must be able to file an early warning within 24 hours of becoming aware of a significant incident, followed by a notification within 72 hours. Registration with the new Bundesamt für Cybersicherheit must be completed by 31 December 2026, with a self-declaration on implemented risk management measures due by 30 September 2027.
Suppliers are caught through the contract, not the statute
The definition of managed service provider in the law is broad, and central group IT functions can fall in scope where size criteria are met. Suppliers to Austrian entities in scope are not regulated directly, but customers are expected to bind them contractually to risk management measures, which means security clauses, questionnaires and audit rights are about to become a routine part of contract renewals. Vendors that can show a current component inventory, documented vulnerability handling and a patch policy per product will answer these requests in hours rather than weeks.
If your organisation operates in Austria or sells to Austrian customers in scope, and you want pragmatic help building NIS2-aligned risk management, incident reporting or supplier security that satisfies the Bundesamt für Cybersicherheit, contact Excello Digital at https://excello.digital/contact/. We help European businesses turn compliance obligations into security that actually holds up.