NIS2 Check for Austria.

This is governed by § 24 NISG 2026. Essential are entities of Annex 1 that operate a large enterprise and, regardless of size, among others qualified trust service providers, TLD name registries, DNS service providers, public administration at federal level and critical entities under Directive (EU) 2022/2557. Important are entities of Annexes 1 and 2 that operate a medium-sized or large enterprise and are not already essential, and among others public administration at state level. A sector of Annex 2 leads to “important” at most, even for large enterprises.

Only from the public administration sector: municipalities and municipal associations do not belong to it (§ 24 para. 3 NISG 2026). If a municipality, an association or a municipal company carries out an activity of Annex 1 or 2, such as drinking water, waste water, waste or energy, it can still be essential or important depending on its size (§ 24 para. 1 no. 3 and para. 2 no. 1); in that case, choose this sector in the check. The areas named in § 24 para. 6, such as schools and higher education or the judiciary, are different: they do not count as essential or important entities, except as trust service providers. The guide “NIS2 and Municipalities” under Downloads goes through the cases one by one.

Under § 25 NISG 2026 in conjunction with Recommendation 2003/361/EC: large from 250 staff or with an annual turnover over EUR 50 million and an annual balance sheet total over EUR 43 million, medium-sized from 50 staff or with an annual turnover over EUR 10 million and an annual balance sheet total over EUR 10 million. Values of linked enterprises count in full, values of partner enterprises proportionally; without them, your figures only count as a lower bound. An empty field means “not stated” and is never counted as 0. Not covered is the exception in § 25 para. 4 NISG 2026: if your entity is organizationally, technically and operationally independent of partner or linked enterprises with regard to its network and information systems, their data are not added.

When your information yields neither a classification nor a clear result without classification: for example because the size cannot be determined, because a question was answered with “don’t know” whose “yes” would trigger a classification, because the level is open for public administration, or because the state of the main establishment has jurisdiction for your type of entity and that state is not Austria. “Don’t know” is never “no”. The result names every open point and what an answer would change.

Yes. Under § 26 NISG 2026, the cybersecurity authority must classify entities of Annexes 1 or 2 that are not covered because of their size as essential or important by decision if a ground under § 26 para. 3 applies: sole provider of an essential service in Austria, significant impact of a disruption on public order, safety or health, a significant systemic risk, or specific importance at national or regional level. The check asks about these grounds but does not anticipate the authority’s decision.

No. This result is an evaluation against a rule set and not legal advice, a legal guarantee or a certification. The legal assessment of whether the company is in scope and must register lies with the company or its legal advisers. The rule set nisg-2026 1.2.0-entwurf was approved by the approver on 21 October 2026, without a separate CISO and legal review. The classification is a legal consequence; the competent authority can decide differently.

No. Questions and evaluation run entirely in your browser; your information is neither transferred to TOMORIS nor to third parties and is not stored. Only if you choose “Discuss the Result” does the contact form take the result as its topic.