Austria has implemented the EU's NIS2 directive and is standing up a federal cybersecurity authority, with an expanded duty to report IT incidents, heise reports, applying from 1 October.
NIS2 is the bloc's second Network and Information Security directive, and its real lever is scope. It replaces a narrower 2016 regime with one that reaches well past conventional IT: energy, transport, banking, health, drinking water, digital infrastructure, public administration, postal services, waste and chemicals management, food production, manufacturing of critical products, and digital providers such as cloud, DNS and online marketplaces. In practice that pulls thousands of mid-sized companies into a framework that used to touch mainly large operators and critical sectors.
The reporting obligations are what most firms feel first. Covered entities must register with the national authority, and once an incident occurs the clock is short: an early warning within 24 hours, a fuller notification within 72 hours and a final report within a month. Management is in scope too: NIS2 requires executives to own and oversee risk measures, and can hold them personally accountable on top of administrative fines against the company.
Two other requirements tend to reshape internal budgets. Supply-chain security means assessing and contractually controlling the security of suppliers, which turns procurement into a compliance function. And the obligations do not stop at the border: a company outside Austria supplying services there can still fall under the rules.
Austria was late transposing the directive — the EU deadline passed in October 2024, and the country was among those threatened with infringement proceedings — which is why the practical start date, rather than the directive itself, is the news. For affected organisations the useful first steps are unglamorous: map assets and services, test whether the thresholds are met, register, write an incident-response plan capable of producing a 24-hour warning, and train management. Details of the specific Austrian act were not available in the material reviewed for this story.
