A few weeks ago I compared NIS2 implementation in Germany, Austria and Italy here. Since 1 October, Austria has moved from legislative text to live operation: through the Unternehmensserviceportal (USP, the business service portal), affected entities can register.
It is worth looking closely at the responsibilities, which are easily confused. Incident reports go to the competent CERT (such as CERT.at, GovCERT or sector-specific ones like the HealthCERT), in three stages: early warning within 24 hours, notification within 72 hours, final report after one month. The CERTs are not responsible for registration, however; that runs through the USP at the new Federal Office for Cybersecurity (Bundesamt für Cybersicherheit) in the Ministry of the Interior.
The point many people overlook: registration can wait until three months after entry into force (so around the turn of 2026/27), but the obligations cannot. Risk management measures and reporting obligations have applied since 1 October, and there is no general transitional period. Anyone who registers only at the turn of the year must still meet the substantive requirements already. The self-declaration (evidence of risk analyses and measures) has its own deadlines during 2027. Fines of up to EUR 50,000 apply, and up to EUR 100,000 for repeat offences.
In practice: clarify who in the company has access to the USP, and rehearse the reporting process so that it also works under time pressure. The 24 hours run from the moment you become aware of the incident.
Update/correction of 13 October 2026: Registration deadline made more precise (previously: 31 December 2026; now: within three months of entry into force) and self-declaration deadline made more precise (previously: 30 September 2027); incident reports go to the competent CERT. Unsubstantiated details on the "NIS2 Services" application, ID Austria and the PDF fallback removed; fine range added.
Related: NIS2 Supplier Risk Checklist (free · 10 questions · 5 minutes)
Research as of: October 5, 2026 — Regulation evolves quickly; this post does not replace individual legal or professional advice.
