TOOLBOX · DOWNLOAD
NIS2 andmunicipalities:what reallyapplies.
The NISG 2026 (Austrian Network and Information Systems Security Act 2026) has applied since October 1, 2026. Municipalities and municipal associations are expressly not part of the public administration sector (§ 24 para. 3). Their operations for drinking water, wastewater, waste or energy can still be covered. This guide explains the legal situation, the review questions for the municipality, association and operation, and what every municipality should do anyway.
Free PDF · Guide
NIS2 and Municipalities: Who Is Covered and What Applies
- Format
- PDF, A4
- Length
- 12 pages
- Size
- 148 KB
- Updated
- Oct 25, 2026
- Sources
- 18
- Usage
- Redistribution in unchanged form permitted
WHO IT IS FOR
Who This
Is for.
The exclusion under § 24 para. 3 NISG 2026, review questions for water, wastewater, waste and energy operations, and what every municipality should do anyway.
- Mayors, municipal office directors and municipal executive boards
- Municipal IT and IT service providers for municipalities
- Municipal associations, for example for water, wastewater and waste
- Management of municipal enterprises such as public utilities and supply companies
8 SECTIONS
What Is
Inside.
- 01
The short answer
As an administration, the municipality is not covered. Its operations can be, and data protection applies anyway.
- 02
The legal situation under § 24 NISG 2026
Public administration is classified by level, not by size. The law expressly excludes municipalities and municipal associations.
- 03
When municipalities and their operations are still covered
The exclusion applies only to the public administration sector. In the other sectors, activity and size count, not the owner.
- 04
Determining size correctly
Medium-sized enterprise from 50 employees or more than €10 million in turnover and balance sheet total, calculated according to the SME Recommendation.
- 05
Review questions for the municipality, association and operation
Six questions for each legal entity separately, plus the documents you need for the review.
- 06
If a legal entity is covered
Registration, the key obligations and the special rule of § 46 instead of fines for municipalities and public bodies.
- 07
What every municipality should do anyway
Data security under the GDPR, supply chain requirements, six first steps and two guides for orientation.
- 08
Common misconceptions
Five assumptions that lead municipalities and their operations to the wrong conclusions.
EXCERPT
The legal situation under § 24 NISG 2026
The NISG 2026 (BGBl. I No. 94/2025) transposes the NIS 2 Directive and has applied since October 1, 2026 (§ 51 paras. 1 and 2). It classifies public administration by level, not by size. Under § 24 para. 3, entities in the public administration sector are entities that meet all three criteria:
- No. 1: They were established to perform tasks in the public interest that are not of an industrial or commercial nature.
- No. 2: They are subject to the supervision of the federal government or a state or are bound by the instructions of a supreme body, the majority of their management or supervisory body is appointed by federal or state bodies, the federal government or a state holds at least 50% of the capital, or they are members of the federal government.
- No. 3: They are authorized to issue administrative decisions that affect the rights of individuals in the cross-border movement of persons, goods, services or capital.
The paragraph ends with the words “with the exception of municipalities and municipal associations.” According to the explanatory notes to the government bill, the option to include the local level, which domestically means the municipalities, was “not used.” In one place, the explanatory notes go further (“In addition to the municipalities, educational institutions … are also not considered essential or important entities”). The text of the law is decisive, and it excludes municipalities only from the public administration sector; the BCS reads it the same way.
| Level | Who is covered | Classification |
|---|---|---|
| Federal | Entities under para. 3 that handle matters of federal administration and are a federal authority or have legal personality | essential, regardless of size (para. 1 no. 1 lit. d, para. 4) |
| State | Offices of the state governments and district administrative authorities, as well as entities under para. 3 with legal personality that handle matters of state administration | important, also regardless of size according to the explanatory notes (para. 2 no. 2, para. 5) |
| Municipalities and municipal associations | expressly not part of the sector, according to the BCS this includes cities; § 24 para. 5 names only the district administrative authorities, not the municipal authorities of statutory cities | no classification as public administration (para. 3) |
| Other exclusions | predominantly national security, public security or law enforcement; universities, higher education and schools; the judiciary; the legislature; the Austrian National Bank | neither essential nor important, except as trust service providers (para. 6) |
This is consistent with the NIS 2 Directive: it covers the public administration of central government and, following a risk-based assessment, the regional level, regardless of size (Art. 2(2)(f)). Member States may include public administration entities at the local level, but they are not required to (Art. 2(5)(a)).
Special case Vienna: The Vienna municipal authority also performs the function of the Office of the State Government (Art. 108 B-VG (Austrian Federal Constitutional Law)), which § 24 para. 5 names as an entity at the state level. According to the explanatory notes, this requires a “differentiated assessment,” “particularly since the ‘local level’ … is not meant to be covered by the public administration sector.” The law does not address this specifically; review Vienna entities case by case.
SOURCES
Supported
by Sources.
- NISG 2026, current version in the RIS, including Annexes 1 and 2 (opens in a new tab)§§ 3, 24 to 26, 29, 31 to 34, 37, 39, 45, 46, 51, Annexes 1 and 2; version of October 25, 2026
- Government bill 308 d. B. XXVIII. GP, explanatory notes on the NISG 2026 (PDF) (opens in a new tab)On §§ 24, 25 and 46 and on Annex 1 nos. 5 and 7 and Annex 2 no. 2
- Federal Office for Cybersecurity: FAQ sectors (opens in a new tab)Municipalities, principal and ancillary activities, photovoltaics, recharging points, managed service providers, nursing homes; as of September 25, 2026
- Federal Office for Cybersecurity: FAQ supply chain (opens in a new tab)Contractual obligations of suppliers; as of September 25, 2026
- Federal Office for Cybersecurity: FAQ registration (opens in a new tab)Who is subject to the registration obligation?, form via USP or Portalverbund; as of September 25, 2026
- Federal Office for Cybersecurity: Registration (opens in a new tab)Initial registration, NIS2-Services in the USP, Portalverbund for public administration; as of October 2, 2026
- NISV 2026, BGBl. II No. 290/2026, in the RIS (opens in a new tab)§ 2 requirements for risk management measures, § 9 entry into force
- Directive (EU) 2022/2555 (NIS 2 Directive) (opens in a new tab)Recital 13, Art. 2(1), (2)(f) and (5)(a)
- Commission Recommendation 2003/361/EC concerning the definition of SMEs (opens in a new tab)Annex Art. 1 to 6
- Regulation (EU) 2016/679 (General Data Protection Regulation) (opens in a new tab)Art. 32 security of processing, Art. 33 and 34 notification and communication
- Abfallwirtschaftsgesetz 2002 (Austrian Waste Management Act 2002), § 2 in the RIS (opens in a new tab)§ 2 para. 6 nos. 3 and 4: waste collectors and waste treatment operators
- Bundes-Verfassungsgesetz (Austrian Federal Constitutional Law), Art. 108 in the RIS (opens in a new tab)Vienna: municipal authority is also the Office of the State Government
- Oö. Informationstechnologien-Einsatz-Gesetz (Oö. ITEG), LGBl. No. 46/2025, in the RIS (opens in a new tab)§ 1 no. 2, § 3 paras. 1 and 3
- Kärntner Gemeindemitarbeiterinnengesetz (K-GMG), § 109 in the RIS (opens in a new tab)Para. 1 lit. h and para. 2: ICT and IT security; in force since January 1, 2026
- Kärntner Gemeinde-Ausbildungs- und Prüfungsverordnung (K-GAPV), § 4 in the RIS (opens in a new tab)Para. 1 lit. e and para. 6: induction course including ICT security
- Wiener Dienstordnung 1994, § 26d in the RIS (opens in a new tab)Para. 5: private ICT devices for mobile work; in force since September 1, 2025
- Austrian Information Security Handbook (Federal Chancellery, A-SIT) (opens in a new tab)Version 4: foreword, preface, introduction and target group guides
- BSI: IT-Grundschutz profile Basis-Absicherung Kommunalverwaltung (opens in a new tab)Version 4.0 of November 13, 2023, Sections 5 to 7 and 9
This guide provides an overview and does not replace legal advice. The text of the law in its current version is decisive, in particular §§ 24 to 26 and Annexes 1 and 2 NISG 2026. The review questions, first steps and guides are TOMORIS recommendations.
TOOLBOX
Explore
Further.
- Kostenlos
NIS2 applicability check (German)
Am I affected? In 3 minutes
Check Now IT for municipalities
Operations, security and training for the municipal office, building yard and educational institutions, plus NIS2, freedom of information and accessibility.
Learn MoreIT for the public sector
An overview of NIS2 for federal and state governments, freedom of information, accessibility and data protection for administrations.
Learn MoreNIS2 reporting obligations
Deadlines, content and recipients of reports under the NISG 2026, with a preparation checklist.
Learn More
MUNICIPALITIES & PUBLIC SECTOR
More on
This Topic.
- PDF
Municipal Information Security Checklist
Basic protection for the municipal office to check off: responsibility, overview, accounts, updates, data backup, remote maintenance and service providers, incidents and Austrian reporting points.
View - PDF
Accessible Municipal Website
Which provincial law applies to your municipal website, what the accessibility statement must contain, which content is exempt, and what you check on the website.
View
YOUR NEXT STEP
From Paper
to Practice.
We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.