Netz- und Informationssystemsicherheitsgesetz (NISG), Incident Notification Obligations
NISG, BGBl. I Nr. 111/2018, §§ 19 und 21
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 28 December 2018.
A vulnerability and incident reporting rule binding public and private bodies.
As of 14 September 2026.
What it requires
- This binds a digital service provider that is an online marketplace, online search engine or cloud-computing service within the scope described on this jurisdiction's companion security-measures row, and only where the provider has access to the information needed to assess a security incident's impact; the wider operator-of-essential-services class is not flagged here for the same reason given on the companion row.
- Notify your competent Computer-Notfallteam (CERT), or, absent one, the national CERT or GovCERT, without delay of a security incident affecting the service you provide.
- Include in the notification every relevant detail known at the time, including the suspected or actual cause, the affected information technology, and the type of entity or facility affected; report later developments in follow-up and final notifications.
- Expect this duty, together with the rest of this Act's Sections 2 to 31, to be repealed and replaced on 1 October 2026 by the Netz- und Informationssystemsicherheitsgesetz 2026's own fixed reporting clock, documented on this jurisdiction's companion row.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Section 26 makes a failure to notify a Verwaltungsübertretung (administrative offence) carrying a fine only; no provision reviewed here makes it a criminal offence.
Penalty structure
Section 26(1)(5) sets a fine of up to EUR 50,000 for a failure to comply with the reporting duty of Section 19(1) (read with Section 19(3) and (4)) or Section 21(2); a repeat offence raises the fine to up to EUR 100,000. The schema records the base cap; this note carries the repeat-offence figure, which the shape has no separate field for.
- Rule
- Fixed only
- As of
- 14 September 2026
- Currency
- EUR
- Fixed cap
- 50,000
Who enforces it
Enforcement body
Bundesminister für Inneres (Federal Minister of the Interior) receives incident notifications through the competent CERT; an administrative fine for a failure to notify is imposed by the competent Bezirksverwaltungsbehörde (district administrative authority).
Settledness
No dedicated guidance page from the Bundesminister für Inneres or GovCERT.at addressing this specific duty was located as of this review; the Act's own text and the RIS consolidated register are the primary sources relied on.
- As of
- 14 September 2026
What it reaches
Obligation class
Reporting, Security
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Section 19 requires an operator of essential services to notify a security incident affecting an essential service it provides, without delay (unverzüglich), to its competent Computer Notfallteam (CERT), which forwards the notification to the Bundesminister für Inneres; the notification must contain every relevant detail known at the time, with later developments reported in follow-up and final notifications.
Section 21(2) places the equivalent duty on a digital service provider, limited to a case where the provider has access to the information needed to assess the incident's impact. Neither provision fixes a numeric notification clock: both require the report without undue delay rather than on NIS2's own 24-hour and 72-hour deadlines.
This is Austria's transposition of the original NIS Directive (Directive (EU) 2016/1148); the successor Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026) repeals Sections 2 to 31 of this Act, this provision included, on 1 October 2026, and replaces this notification duty with NIS2's own fixed clock, documented on this jurisdiction's companion rows.
When LexLint raises it
operates_social_platform