AustriaNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations
NISG 2026, BGBl. I Nr. 94/2025, §§ 34 und 35
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- It binds a wesentliche Einrichtung or wichtige Einrichtung on the same scope as this jurisdiction's companion risk-management row, which names an online marketplace, an online search engine and a social-networking-services platform provider expressly; the wider sector classes are reached as on that row.
- Notify your competent sector-specific computer security incident response team (CSIRT), or, absent one, the national CSIRT, of every significant cybersecurity incident: an early warning within 24 hours of becoming aware, stating whether it is suspected to result from unlawful and culpable acts or to have cross-border effects.NIST CSF 2.0RS.CO-02
- Follow with a fuller notification within 72 hours of becoming aware, updating the early warning with an initial evaluation of the incident's severity and impact and any indicators of compromise.NIST CSF 2.0RS.CO-02
- Submit an interim report on request, and a final report no later than one month after the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report no later than one month after you have finished handling the incident (Section 34(2)).NIST CSF 2.0RS.CO-03
- If you are a trust service provider, submit an incident notification within 24 hours of becoming aware of a significant cybersecurity incident that affects your trust services (Section 34(2)).NIST CSF 2.0RS.CO-02
- Treat an incident as significant where it has caused, or can cause, severe operational disruption or severe financial loss to your own operations, or has affected, or can affect, another person through considerable material or non-material damage.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Section 45's penalty regime for a Section 34 infringement is a Verwaltungsübertretung (administrative offence) carrying a fine only; the Act creates no criminal offence for it.
Penalty structure
The same Section 45(2) and (3) tiers that govern a Section 32 infringement govern a Section 34 infringement: up to EUR 10,000,000 or up to 2 percent of worldwide turnover for a wesentliche Einrichtung, whichever is higher, and up to EUR 7,000,000 or up to 1.4 percent for a wichtige Einrichtung, whichever is higher. Section 45(1)(4) names a failure to comply with the Section 34(1) and (2) reporting duty among the offences this penalty punishes.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Bundesamt für Cybersicherheit (Cybersicherheitsbehörde), an authority with nationwide competence, directly subordinate to the Bundesminister für Inneres and set up outside the Generaldirektion für die öffentliche Sicherheit, working with the sector-specific and national CSIRTs that receive notifications; an administrative fine is imposed by the competent Bezirksverwaltungsbehörde (district administrative authority).
Settledness
- As of
What this law does
Section 34 requires a wesentliche Einrichtung (essential entity) or wichtige Einrichtung (important entity) to notify its competent sector-specific computer security incident response team (CSIRT), or, absent one, the national CSIRT, of every significant cybersecurity incident (defined by Section 35) without delay: an early warning within 24 hours of becoming aware of the incident, stating whether it is suspected to result from unlawful and culpable acts or to have cross-border effects, followed by a fuller notification within 72 hours updating that assessment with an initial evaluation of the incident's severity and impact and any indicators of compromise.
It also requires an interim report on the CSIRT's or the Cybersicherheitsbehörde's request, and a final report no later than one month after the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report once it is resolved, transposing NIS2 Article 23.
Section 35 treats a cybersecurity incident as significant where it has caused or can cause severe operational disruption or severe financial loss to the entity, or has affected or can affect another natural or legal person through considerable material or non-material damage, judged against criteria including the dependency of other Annex 1 or Annex 2 sectors on the affected service, the entity's market share, and the incident's possible geographic and cross-border reach.
Section 24(7) gives the relevant provisions of Regulation (EU) 2022/2554 (DORA), and of the national provisions implementing it, precedence over this Act for an entity within DORA's scope.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .