The ongoing infringement proceedings against Austria, Germany’s recent adoption of its NIS 2 legislation and the recent parliamentary motion have increased the pressure on the government: since yesterday, the new draft NISG 2026 has been before the National Council as a government bill. The government has decided not to conduct an extra-parliamentary review process. This is likely to be viewed critically by the opposition. As a result, it remains uncertain – once again – whether the draft in its current form will secure the required two-thirds majority. This is because the bill once again contains a constitutional provision due to competence-related reasons.
The Good: No Gold Plating, Implementation Deadline Remains Unchanged
In substance, Austria continues to remain closely aligned with the Directive. In addition, unlike in Germany, the transitional period for affected companies remains in place: NIS 2-obliged entities will have nine months after promulgation to implement the requirements. The obligations are therefore expected to apply from autumn 2026, provided the law is adopted before the end of this year.
The Bad and the Ugly: Important Restrictions and Clarifications Still Missing
The scope of application remains unchanged and broad: unlike Germany, Austria does not provide for a general exemption for negligible activities. Likewise, despite extensive criticism, the NISG 2026 does not include an exemption for purely intra-group services. This primarily affects IT service providers: if each group company manages its own IT, NIS 2 does not apply on the basis of that activity. If IT is centralised in one company, however, the rules will apply where the size criteria are met.
Restrictions or clarifications regarding the extremely broad definition of managed service providers have likewise not been included in the draft or the explanatory notes. As a result, these remain a major gateway for companies offering digital services.
The Clock is Ticking: Registration & Obligations
Companies must register within three months after the law enters into force. The areas covered by risk management measures are now set out directly in the legislative text – as a slimmed-down version of the previous Annex 3. However, this does not mean that fewer measures will be required. The national regulation will be decisive in this respect.
The authority’s supervisory and enforcement measures, as well as the range of penalties, have also been adopted unchanged: in the event of violations, companies may still face, among other things, substantial fines, a prohibition on exercising management functions and the publication of violations.
The Four Key Changes in the NISG 2026:
Need for Action for Companies
If the new draft is adopted as planned by the end of the year, the new obligations will enter into force as early as autumn 2026. Companies should therefore swiftly begin their applicability and gap analyses. The interaction with the Cyber Resilience Act and the Data Act should also be taken into account.
Our NIS 2 experts will be pleased to support you in a targeted and efficient manner with their extensive experience and practical know-how. We will, of course, continue to keep you informed of further developments.