AustriaNetz- und Informationssystemsicherheitsgesetz (NISG), Incident Notification Obligations
NISG, BGBl. I Nr. 111/2018, §§ 19 und 21
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds a digital service provider that is an online marketplace, online search engine or cloud-computing service within the scope described on this jurisdiction's companion security-measures row, and only where the provider has access to the information needed to assess a security incident's impact; the wider operator-of-essential-services class is reached too, as on the companion row.
- Notify your competent Computer-Notfallteam (CERT), or, absent one, the national CERT or GovCERT, without delay of a security incident affecting the service you provide.
- Include in the notification every relevant detail known at the time, including the suspected or actual cause, the affected information technology, and the type of entity or facility affected; report later developments in follow-up notifications and ultimately in a final notification, without undue further delay.
- This duty, together with the rest of this Act's Sections 2 to 31, was repealed and replaced from by the Netz- und Informationssystemsicherheitsgesetz 2026's own fixed reporting clock, documented on this jurisdiction's companion row.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Section 26 makes a failure to notify a Verwaltungsübertretung (administrative offence) carrying a fine only; the Act creates no criminal offence for it.
Penalty structure
Section 26(1)(5) sets a fine of up to EUR 50,000 for a failure to comply with the reporting duty of Section 19(1) (read with Section 19(3) and (4)) or Section 21(2); a repeat offence raises the fine to up to EUR 100,000. The schema records the base cap; this note carries the repeat-offence figure, which the shape has no separate field for.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 50,000
Who enforces it
Enforcement body
Bundesminister für Inneres (Federal Minister of the Interior) receives incident notifications through the competent CERT; an administrative fine for a failure to notify is imposed by the competent Bezirksverwaltungsbehörde (district administrative authority).
Settledness
- As of
What this law does
Section 19 requires an operator of essential services to notify a security incident affecting an essential service it provides, without delay (unverzüglich), to its competent Computer Notfallteam (CERT), which forwards the notification to the Bundesminister für Inneres; the notification must contain every relevant detail known at the time, with later developments reported in follow-up and final notifications.
Section 21(2) places the equivalent duty on a digital service provider, limited to a case where the provider has access to the information needed to assess the incident's impact. Neither provision fixes a numeric notification clock: both require the report without undue delay rather than on NIS2's own 24-hour and 72-hour deadlines.
This is Austria's transposition of the original NIS Directive (Directive (EU) 2016/1148); the successor Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026) repealed Sections 2 to 31 of this Act, this provision included, with effect from and replaced this notification duty with NIS2's own fixed clock, documented on this jurisdiction's companion rows.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank or is a securities firm.
Back to the example · Lint your app
Page updated .