Austria's NISG 2026 takes effect on 1 October 2026

What changed

Austria transposed NIS2 through the Network and Information System Security Act 2026, the NISG 2026, published as BGBl. I Nr. 94/2025 in December 2025. Section 51 carries no date written out: it has the text enter into force on the first day of the month following the end of nine months from publication, which places it at 1 October 2026. That covers Section 1 and Section 46(2) as well as Sections 2 to 45, Section 46(1), Sections 47 to 50 and Annexes 1 and 2. On the same date the corresponding provisions of the 2018 NISG and its regulations cease to apply.

Who is affected

Entities in scope with an establishment in Austria, including Austrian subsidiaries of groups based outside the European Union. Anyone operating in both Germany and Austria deals with two separate national laws and two separate calendars, even though the source directive is the same.

What to do

Treat 1 October 2026 as the date from which the Austrian obligations start to exist, not as a final deadline for getting ready. Section 51 is worth reading in full, because it also settles what happens to decisions issued under the previous regime.

Related deadlines

• October 1, 2026. Entry into force of the NISG 2026 in Austria (Section 51, BGBl. I Nr. 94/2025).