EA Digital Solutions

NIS2 compliance

NIS2: registration due by 31 December 2026. We get you through it.

Austria’s NISG 2026 has applied since 1 October 2026; Germany’s NIS2 implementation act since December 2025. We check with you whether your company is in scope, support the registration and implement the technical measures without bringing your business to a halt. Also if you only receive supplier questionnaires.

  • Austria and Germany
  • Technology and documentation from one team
  • Reply within 24 hours
Send a request

In short

The NISG 2026 implements the EU NIS2 directive in Austria and has applied since 1 October 2026. An estimated 4,000 companies in 18 sectors are in scope, medium-sized companies from around 50 employees or EUR 10 million turnover or balance sheet. They must register with the cybersecurity authority by 31 December 2026, implement risk management measures and report significant incidents within 24 hours. Management is liable.

Key facts

Austria: in force since 1 October 2026
The NISG 2026 was published on 23 December 2025 and replaces the NISG 2018.
Registration by 31 December 2026
Entities in scope register with the cybersecurity authority, followed by a self-declaration on the effectiveness of their risk management.
Reporting within 24 and 72 hours
Significant incidents: early warning within 24 hours, notification within 72 hours.
Management is liable
Management must approve the measures, oversee their implementation and take part in training.
Germany: since December 2025
The German NIS2 implementation act has applied since December 2025; BSI registration opened in January 2026 and the first deadline has passed.
Fines under the EU directive
Up to EUR 10 million or 2 % of worldwide turnover for essential, up to EUR 7 million or 1.4 % for important entities (Art. 34 NIS2).

As of 26 October 2026 · General information, not legal advice.

Who is in scope

  • Medium-sized and large companies in the sectors of the directive, such as energy, transport, health, digital infrastructure, ICT services, waste, chemicals, food, manufacturing, postal and courier services.
  • Certain entities regardless of size, such as DNS and trust service providers.
  • Suppliers and service providers of companies in scope: often not covered themselves, but they have to answer their customers’ security questionnaires and show their measures.

Whether your company is covered depends on sector, size and activity. In the first call we go through it with you against the law; if in doubt, a lawyer confirms the legal classification.

What we do for you

  1. 1

    Clarify scope

    Free first call: sector, size, customers. Afterwards you know whether you are in scope yourself or as a supplier, and what is due when.

  2. 2

    Support the registration

    We collect the information needed and support the registration with the authority.

  3. 3

    Gap analysis

    Comparison with the minimum measures of the directive: risk analysis, incident handling, backups and business continuity, supply chain, access control, multi-factor authentication, encryption, training.

  4. 4

    Implement the technology

    Multi-factor authentication, backups with restore tests, updates, logging, e-mail security (SPF, DKIM, DMARC), hardening of website and servers.

  5. 5

    Evidence and reporting

    Policies, responsibilities, a runbook for the 24-hour report and answers to your customers’ questionnaires.

For a complete information security management system or ISO 27001 certification we work with specialised partners.

Check for free first

Free checklist

NIS2 checklist: 15 points to registration and beyond

NIS2 checklist: 15 points to registration and beyond

Go through the points with your management and IT. Whatever stays open is your roadmap; the first three concern the Austrian deadline of 31 December 2026.

Scope, registration, minimum measures, incident reporting and supply chain: the 15 points to tick off for NIS2, as a printable PDF.

Enter your e-mail to read the whole thing

Download for free — enter your e-mail

You are also subscribing to our newsletter. Unsubscribe any time.

Frequently asked questions

Is my company in scope of NIS2?

That depends on sector, size and activity. Medium-sized companies from around 50 employees or EUR 10 million turnover or balance sheet are covered if they operate in one of the sectors; some entities regardless of size. We clarify this in the first call.

When do I have to register in Austria?

By 31 December 2026 with the cybersecurity authority. Within twelve months after that follows the self-declaration on the effectiveness of your risk management.

We are only a supplier. Does this affect us?

Usually not directly, but in practice yes: companies in scope must secure their supply chain and therefore ask their suppliers about their measures. Suppliers who can answer well keep their customers.

Is registering enough?

No. Registration is the first step; risk management measures, reporting processes and evidence follow.

Do you give legal advice?

No. We implement the technical and organisational measures and prepare the documents. For the legal classification we recommend a lawyer if in doubt.

Sources

Related services