NIS2: does it affect your business?

Since 1 October 2026, Austria’s NISG 2026 has been in force – the national implementation of the EU’s NIS2 directive. It obliges several thousand companies and organisations to step up their cybersecurity. For most small businesses it doesn’t apply directly. It’s still worth a closer look: many will feel the requirements through their customers.

Who is directly affected

Two conditions have to be met: your business operates in one of the sectors the law lists, and it is at least a medium-sized company.

• Sectors of high criticality (Annex 1): among others energy, transport, banking, health, drinking water, waste water, digital infrastructure, ICT service management and public administration.
• Other critical sectors (Annex 2): among others postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research.
• Medium-sized means at least 50 employees, or more than 10 million euros in turnover and more than 10 million euros in balance sheet total.

For a few, the law applies regardless of size – such as providers of public communication networks, DNS services or qualified trust services. The quickest way to check whether your business is covered is the free NIS2 guide of the Austrian Economic Chamber (WKO).

What affected businesses have to do now

• Register by 31 December 2026 – via the business service portal (USP).
• Put security measures in place that match their own risk – they have applied since 1 October.
• By 30 September 2027, state in a self-declaration how far the measures have been implemented.
• Report significant incidents: an early warning within 24 hours, the notification within 72 hours and a final report after one month.

The competent authority is the new Federal Office for Cybersecurity. Responsibility lies with management – who also have to attend cybersecurity training themselves. The fines are high: up to 10 million euros or 2 % of worldwide turnover for essential entities, up to 7 million euros or 1.4 % for important ones.

Which measures the law requires

The NISG 2026 doesn’t prescribe particular products, but measures that match the risk. They include, among others:

• A risk analysis and clear responsibilities for IT security.
• A plan for security incidents: who does what when something happens?
• Backups as well as emergency and recovery plans.
• Security in the supply chain – which includes your IT service providers.
• Regular updates, training and basic cyber hygiene.
• Encryption, access control and multi-factor sign-in.

Why it concerns small businesses too

Affected companies have to prove the security of their supply chain – and pass that on to their suppliers and service providers through contracts, questionnaires or audits. If you make parts for a manufacturer, look after software for a group of medical practices or process data for an energy supplier, the question about your IT security may soon land in your inbox.

Anyone who can then show documented backups, updates, access rights and an emergency plan has a clear advantage – and protects their own business from outages along the way.

A good first step

Start with an honest inventory: which devices and services are there, who has access to what, how up to date is everything – and does the backup actually work? Most of the gaps NIS2 is about aren’t exotic attacks, but missing updates, weak passwords and backups that were never tested.

That’s exactly where we help: we look at your IT together, show you where you stand and put in place what makes sense for your business – from backups to multi-factor sign-in. It doesn’t replace legal advice, but it is the technical foundation customers and authorities want to see.