NIS2 and Municipalities: Who Is Covered and What Applies

• NoMunicipality as public administration

  Municipalities and municipal associations are not entities in the public administration sector (§ 24 para. 3 NISG 2026).

• ReviewMunicipal operations and associations

  Anyone who performs an activity listed in Annex 1 or 2, such as drinking water, wastewater, waste or energy, is covered from medium size upward, unless a restriction in the annex applies (§ 24 para. 1 no. 3, para. 2 no. 1, § 25).

• YesData protection and supply chain

  Security of processing under Art. 32 GDPR applies to every municipality. Covered partners must manage the security of their supply chain (§ 32 para. 4 lit. d NISG 2026).

The Federal Office for Cybersecurity answers the question in its FAQ as follows: municipalities, “and thus also cities,” and municipal associations are expressly excluded from the public administration sector, “but not generally excluded from the scope.” They are covered if they operate in another sector listed in Annex 1 or 2, such as drinking water, wastewater, waste management, energy, transport or digital infrastructure, and meet the size criteria for medium-sized or large enterprises.

Whether an entity is essential or important follows directly from § 24 NISG 2026; no administrative decision is required. Covered entities must register themselves (§ 29). In addition, the cybersecurity authority classifies smaller entities listed in Annexes 1 and 2 by administrative decision if one of the grounds in § 26 para. 3 applies.

The NISG 2026 (BGBl. I No. 94/2025) transposes the NIS 2 Directive and has applied since October 1, 2026 (§ 51 paras. 1 and 2). It classifies public administration by level, not by size. Under § 24 para. 3, entities in the public administration sector are entities that meet all three criteria:

• No. 1: They were established to perform tasks in the public interest that are not of an industrial or commercial nature.
• No. 2: They are subject to the supervision of the federal government or a state or are bound by the instructions of a supreme body, the majority of their management or supervisory body is appointed by federal or state bodies, the federal government or a state holds at least 50% of the capital, or they are members of the federal government.
• No. 3: They are authorized to issue administrative decisions that affect the rights of individuals in the cross-border movement of persons, goods, services or capital.

The paragraph ends with the words “with the exception of municipalities and municipal associations.” According to the explanatory notes to the government bill, the option to include the local level, which domestically means the municipalities, was “not used.” In one place, the explanatory notes go further (“In addition to the municipalities, educational institutions … are also not considered essential or important entities”). The text of the law is decisive, and it excludes municipalities only from the public administration sector; the BCS reads it the same way.

This is consistent with the NIS 2 Directive: it covers the public administration of central government and, following a risk-based assessment, the regional level, regardless of size (Art. 2(2)(f)). Member States may include public administration entities at the local level, but they are not required to (Art. 2(5)(a)).

Special case Vienna: The Vienna municipal authority also performs the function of the Office of the State Government (Art. 108 B-VG (Austrian Federal Constitutional Law)), which § 24 para. 5 names as an entity at the state level. According to the explanatory notes, this requires a “differentiated assessment,” “particularly since the ‘local level’ … is not meant to be covered by the public administration sector.” The law does not address this specifically; review Vienna entities case by case.

The exclusion appears only in the definition of the public administration sector. In the other sectors, the following applies: entities of a type listed in Annex 1 are essential if they operate a large enterprise (§ 24 para. 1 no. 3); entities of a type listed in Annex 1 or 2 are important if they operate a medium-sized or large enterprise (§ 24 para. 2 no. 1). An entity is any natural or legal person or registered partnership that can exercise rights and be subject to obligations in its own name (§ 3 no. 10). The Directive expressly refers to “public or private entities” (Art. 2(1)), and an enterprise is any entity engaged in an economic activity, regardless of its legal form (Art. 1 of the Annex to Recommendation 2003/361/EC).

According to the Federal Office for Cybersecurity (BCS), whether an activity is principal or ancillary generally does not matter. The law contains restrictions only for certain types: electricity producers (principal activity), drinking water suppliers whose general activity is the distribution of other commodities and goods, wastewater and road authorities (non-essential part of the general activity), and waste management (principal economic activity). Otherwise, according to the BCS, even subordinate activities can bring the entire entity, meaning the legal person, into scope. For wastewater, according to the explanatory notes, every activity of the undertaking counts toward its general activity, including non-economic ones; for waste management, non-economic activities are excluded from the outset.

Photovoltaics, recharging points, networks: Anyone who feeds surplus electricity from a photovoltaic system into the grid but generates primarily for their own use is generally not covered by the NISG 2026, according to the BCS. Publicly accessible recharging points, on the other hand, can fall under “operators of recharging points.” Whether a municipal fiber network is a public communications network depends on § 4 no. 9 TKG 2021 (Austrian Telecommunications Act 2021), to which § 3 no. 4 NISG 2026 refers; no size threshold protects you here.

• Employees are counted in annual work units; apprentices as well as maternity and parental leave are not counted (Art. 5 of the Annex to Recommendation 2003/361/EC).
• The most recent financial statements are decisive; a change in status only takes effect after two consecutive financial years (Art. 4(1) and (2) of the Annex).
• Linked enterprises count at 100%, partner enterprises proportionally from a 25% holding (Art. 3 and Art. 6(2) of the Annex).
• Public control of 25% or more does not rule out SME status, because Art. 3(4) of the Annex does not apply (§ 25 para. 1, Art. 2(1) NIS 2 Directive); ownership by the municipality alone does not make a municipal company large. However, sister companies controlled by the same municipality can count as linked (Art. 3(3) of the Annex). Whether the municipality’s own data counts is an open question.
• A municipality with an annual budget below €10 million and fewer than 5,000 inhabitants does not make an enterprise a partner enterprise, even with a holding of 25% or more, as long as it is not linked to it (Art. 3(2), second subparagraph, (d) of the Annex).
• Figures are not added if the entity is organizationally, technically and operationally independent with regard to its network and information systems (§ 25 para. 4). If an operation shares IT with the municipality, review this especially carefully.

Open question: If a municipality runs an operation itself, for example water supply without a separate company, the municipality as a legal person is the entity (§ 3 no. 10). Neither § 25 nor the explanatory notes expressly answer whether only the operation or the entire municipality then counts for size. According to the explanatory notes on § 24, a covered entity is classified in its entirety, and its obligations apply to all its services. Clarify such cases with your legal counsel or the cybersecurity authority.

• List of all legal entities with holdings, capital shares and voting rights
• Articles of association, partnership and association agreements, service descriptions of the operations
• Financial statements for the last two years: turnover, balance sheet total, employees in annual work units
• Overview of who operates and uses which IT, including IT service providers
• Documented result with date, rationale and legal references, acknowledged by the competent body

The review questions and the document list are a TOMORIS recommendation; legally decisive are §§ 24 to 26 NISG 2026 including Annexes 1 and 2. Repeat the review after each set of financial statements and whenever new activities are added.

Covered entities register within three months of entry into force; entities added later register within three months of meeting the requirements (§ 29 para. 3). The BCS gives two dates for initial registration: in its FAQ (as of September 25, 2026), December 31, 2026; on the “Registration” page (as of October 2, 2026), generally January 1, 2027, and at the latest January 4, 2027, due to § 33 para. 2 AVG (Austrian General Administrative Procedure Act). Register before the end of the year. Registration is done independently, without being asked, via “NIS2-Services” in the Business Service Portal (USP); for public administration entities, the BCS has announced a connection via the Portalverbund (Austrian portal network). Required information includes the sector, type of entity and thresholds, as well as a point of contact with telephone number and email address (§ 29 paras. 2 and 6).

• Governance: management bodies ensure and oversee the risk management measures and take part in cybersecurity training (§ 31).
• Risk management with at least the content of § 32 para. 4 lit. a to j; under § 2 NISV 2026 (Austrian NIS Regulation 2026), the Annex to Implementing Regulation (EU) 2024/2690 also applies to the other types of entities in Annexes 1 and 2.
• Self-declaration within twelve months after the registration obligation arises (§ 33 para. 1).
• Reporting of significant cybersecurity incidents to the CSIRT, early warning no later than 24 hours after becoming aware (§ 34 paras. 1 and 2).

No fines for municipalities: For authorities and other public administration bodies, including territorial authorities and bodies established under private law, the district administrative authority establishes non-compliance by decision and sets a deadline, in derogation from § 45. If it expires, the authority publishes non-compliance after finality and an opportunity to comment (§ 46 para. 2, constitutional provision). § 39 para. 4 (suspensions, prohibition of management functions) does not apply to these bodies (§ 39 para. 6); orders under § 39 paras. 1 to 3 remain possible. The explanatory notes say outsourced legal entities may also fall under this rule.

Regardless of the NISG 2026, the GDPR applies. Under Art. 32(1), the municipality as controller implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption (lit. a), confidentiality, integrity, availability and resilience of systems (lit. b), timely restoration after an incident (lit. c) and regular testing (lit. d). It reports personal data breaches to the supervisory authority without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk (Art. 33(1)); if the breach is likely to result in a high risk, it also notifies the data subjects (Art. 34(1)).

Covered entities must manage the security of their supply chain (§ 32 para. 4 lit. d NISG 2026). As guidance for contracts, the BCS names, among other things, cybersecurity requirements, the obligation to report incidents without undue delay, a right to audit and the remediation of vulnerabilities; a general reference in the terms and conditions is not enough. If municipal IT supports a covered association or operation, it should expect such requirements. If the municipal IT or a municipal IT company operates systems for other legal entities, such as associations, companies or neighboring municipalities, also review whether it is itself a managed service provider (Annex 1 no. 9).

1. 1

   Assign responsibility

   Municipal leadership determines who coordinates information security and provides time and resources. The BSI profile is aimed at the administrative leadership, which provides resources and is responsible for the security level and its risks (Section 5.1).

2. 2

   Create an overview

   Record tasks, specialized procedures, applications, IT systems, locations and service providers; for specialized tasks and applications, the BSI profile names an existing task structure plan as a possible starting point (Section 7.2).

3. 3

   Implement basic protection

   Start with data backup including tested restoration, timely updates, managed permissions and protection against malware, guided by the modules CON.3, OPS.1.1.3, ORP.4 and OPS.1.1.4 of the BSI profile.

4. 4

   Prepare for incidents

   Define who decides, whom you notify and how you assess the notification under Art. 33 GDPR. Entities outside the NISG 2026 can also report incidents to the national CSIRT voluntarily and without disclosing their identity (§ 37 paras. 2 and 3).

5. 5

   Review service providers and contracts

   Agree with IT service providers on incident reporting obligations, access, remote maintenance and subcontractors.

6. 6

   Train and practice

   Raise employee awareness regularly (BSI profile, module ORP.3) and practice for emergencies. For covered entities, training is mandatory (§ 31 para. 2 NISG 2026).

State law: We have not found a separate state law on the cybersecurity of municipalities (as of October 25, 2026). However, some state regulations contain requirements for the IT security of municipalities, for example:

• Upper Austria: If its municipalities or municipal associations make fully automated decisions as holders of private rights, the Oö. ITEG requires, among other things, documented data and information security measures, retention of logs and log files for at least six months, and data availability and integrity according to the state of the art (§ 1 no. 2, § 3 para. 3).
• Carinthia: The municipal service center provides ICT services and advises municipalities and municipal associations on IT security (§ 109 para. 1 lit. h and para. 2 K-GMG). The induction course for municipal employees covers ICT security and is mandatory for everyone who joined on or after January 1, 2012 (§ 4 para. 1 lit. e and para. 6 K-GAPV).
• Vienna: For mobile work, the use of private ICT devices is also permitted with the civil servant’s consent, provided ICT security is maintained (§ 26d para. 5 Dienstordnung 1994 (Vienna Civil Service Code 1994)).

The steps and guides are TOMORIS recommendations. Legally required for every municipality are, among others, Art. 32 to 34 GDPR, and for covered entities additionally §§ 31 to 34 NISG 2026; state law may contain further requirements. Under Recital 13 of the NIS 2 Directive, Member States should strive to ensure that excluded entities also achieve a high level of cybersecurity.