{"id":9297,"date":"2026-08-31T14:28:41","date_gmt":"2026-08-31T12:28:41","guid":{"rendered":"https:\/\/atb.law\/?post_type=blog-post&p=9297"},"modified":"2026-09-01T10:33:21","modified_gmt":"2026-09-01T08:33:21","slug":"nis2-in-austria-is-your-company-prepared","status":"publish","type":"blog-post","link":"https:\/\/atb.law\/en\/blog-post\/nis2-in-oesterreich-ist-ihr-unternehmen-vorbereitet\/","title":{"rendered":"NIS2 in Austria: Is your company prepared?"},"content":{"rendered":"

What is NIS2 and why is there the NISG 2026?<\/strong><\/h2>\n

Cyberattacks are no longer exceptional events. Ransomware, phishing, compromised credentials, or attacks via service providers can paralyze essential business processes within a very short time. The European NIS2 Directive is therefore intended to significantly increase cyber resilience in the European Union and, in particular, improve the ability of companies and public institutions to prevent, manage, and respond to security incidents.<\/p>\n

Austria is implementing these requirements with the NISG 2026.<\/p>\n

While the previous NISG 2018 covers only a comparatively small circle of companies, the scope of application is now being significantly expanded. Around 4,000 companies and institutions in Austria are expected to be directly affected.<\/p>\n

Depending on the activity and company size, this includes companies from the energy, transport, health, drinking water and wastewater, digital infrastructure, ICT services, postal and courier services, waste management, chemicals, food production, manufacturing, digital services, and research sectors, among others.<\/p>\n

Even companies that do not fall directly under the NISG 2026 can be indirectly affected: supply chain security is an explicit part of mandatory risk management. NIS2-relevant companies will therefore increasingly involve their service providers and suppliers in their cybersecurity requirements.<\/p>\n

October 1, 2026: The central obligations must be fulfilled by then<\/strong><\/h2>\n

A particularly important point is currently often overlooked: there is no general transition period after October 1, 2026, for the core obligations. As of this date, affected companies must, in particular, comply with the prescribed risk management measures and observe the statutory reporting obligations for significant cybersecurity incidents. The fact that later deadlines are provided for other obligations\u2014in particular for registration and self-declaration\u2014does not change this.<\/p>\n

Anyone who only begins implementation on October 1st is therefore starting too late.<\/p>\n

Management must also be trained\u00a0<\/strong><\/h2>\n

Particularly relevant for the remaining weeks: Section 31 Paragraph 2 of the NISG 2026 provides for a separate training obligation for management bodies. And a general cyber-awareness training for employees is not sufficient for this.<\/p>\n

Managing directors and board members must participate in cybersecurity training specifically designed for governing bodies. The specific aim is to provide them with the knowledge they need to assess cyber risks and fulfill their legal responsibility for risk management. Participation should be documented accordingly.<\/p>\n

In the case of multiple managing directors, it is also not sufficient to train only the managing director responsible for IT. The training obligation fundamentally applies to every member of the management body. For companies that have not yet trained their management accordingly, this item should therefore be at the top of the September agenda.<\/p>\n

What specific NIS2 obligations do companies have to implement?<\/strong><\/h2>\n

Key measures include, in particular:<\/p>\n