Does NIS2 also apply to small businesses?

NIS2 directly covers, as a rule, medium-sized and large companies in certain sectors – as a guide: from around 50 employees or above a certain turnover and balance sheet size. Some areas, such as parts of the digital infrastructure, can be covered regardless of size. Very many smaller companies, however, feel NIS2 indirectly, because customers who are covered pass security requirements on to their suppliers.

Does NIS2 already apply in Austria?

NIS2 is an EU directive, and its obligations for companies generally only take effect through transposition into national law. What counts is therefore the Austrian implementing act in its current version – check the current status or seek professional advice.

What is the difference between essential and important entities?

At their core, both categories must implement the same security measures. The differences lie mainly in supervision: essential entities are supervised more strictly and can be inspected without a specific reason, while important entities are usually only inspected once there are indications of a breach.

My business is only a supplier to a large company – does NIS2 still affect me?

This does not create a direct obligation for you. Covered companies must, however, manage the security of their supply chain and pass requirements on by contract or questionnaire. If you want to keep supplying them, you will increasingly have to show how you organise information security.

What are the consequences of breaching NIS2 obligations?

The directive provides for substantial fines and explicit accountability of management. The exact details – amounts, procedures, responsible authorities – follow from the national implementing law and should be checked professionally in each individual case.

NIS2 and information security: does it affect my business?

NIS2 is the EU directive on network and information security (Directive (EU) 2022/2555), which lays down binding cybersecurity obligations for far more industries than its predecessor. Those directly affected are mainly medium-sized and large companies in certain sectors; many smaller companies are affected by NIS2 indirectly, because customers who are covered pass security requirements on to their suppliers. Important for Austria: the obligations for companies generally only apply through transposition into national law – you should keep an eye on its current status. This article outlines the basics and does not replace legal advice in an individual case.

In brief

NIS2 extends binding cybersecurity obligations to many sectors – from energy and transport to food and parts of manufacturing.
Whether a company is directly covered follows a simple logic of two questions: does it belong to a listed sector, and does it reach the size threshold?
The size threshold generally covers medium-sized and large companies – from around 50 employees or above a certain turnover and balance sheet size.
SMEs that are not covered also feel NIS2 through the supply chain: covered customers must assess the security of their suppliers and ask for evidence.
Management is explicitly accountable: it must approve and oversee the measures and take part in training itself.
In Austria, the NISG 2026 applies: in force from 1 October 2026, with registration of affected entities by 31 December 2026.

What is NIS2 in the first place?

NIS2 stands for the second EU directive on network and information security. Its aim is a uniformly high level of cybersecurity across the EU: companies and organisations whose failure would seriously hit supply or the economy are to manage risks systematically, report incidents and secure their supply chains.

You need to know two particular features to place NIS2 correctly. First: unlike the GDPR, for example, which applies directly as a regulation, a directive generally does not act directly on companies but must be transposed into national law by each member state. For Austrian companies, what counts is therefore the Austrian implementing act in its current version. Second: NIS2 distinguishes between “essential” and “important” entities. The security obligations are essentially the same; essential entities, however, are subject to stricter supervision, including inspections without a specific reason.

In Austria, the Network and Information System Security Act 2026 (Netz- und Informationssystemsicherheitsgesetz 2026, NISG 2026) transposes the directive. It was promulgated on 23 December 2025 and applies from 1 October 2026. Affected entities must register by 31 December 2026; the self-declaration follows within twelve months of registration. The Austrian Economic Chamber (WKO) publishes details and forms on an ongoing basis (wko.at) — if in doubt, professional advice is worthwhile.

Does NIS2 affect my business directly?

The logic for whether you are affected consists of two checks, which you can roughly go through in a few minutes.

Step 1 – sector: Does your company belong to one of the listed sectors? The directive distinguishes two groups:

Group	Examples of sectors
Sectors of high criticality	Energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure (e.g. data centres, cloud providers), ICT service management, public administration, space
Other critical sectors	Postal and courier services, waste management, chemicals, food (production, processing, distribution), manufacturing (including medical devices, electronics, machinery, vehicles), digital providers (online marketplaces, search engines, social networks), research

The “manufacturing” row in particular surprises many: a machine builder or a food producer can be covered even though they have never thought of themselves as “critical infrastructure”.

Step 2 – size: Does your company reach the size threshold? NIS2 generally targets medium-sized and large companies – as a guide: from around 50 employees or above a certain annual turnover or balance sheet total. Micro and small enterprises are, as a rule, exempt. There are, however, exceptions where size does not matter – for example for certain providers of digital infrastructure, or where an entity is the sole provider of a critical service. If you are close to the threshold or operate in a listed sector, you should have the classification checked professionally rather than “arguing it away” yourself.

Why does NIS2 also affect companies that are not covered at all?

The most important practical effect for Austrian SMEs is an indirect one: NIS2 obliges covered companies to manage the security of their supply chain. This means a covered industrial company or logistics firm must assess how things stand with the information security of its suppliers and service providers – from the software supplier to the maintenance firm to the parts supplier.

In practice, this reaches the SME as a questionnaire, a contract clause or an audit requirement: How do you secure your systems? Are there backups and emergency plans? Who is responsible for security? Are staff trained? If you cannot answer such questions, you risk losing orders in the medium term – entirely regardless of whether you fall under NIS2 yourself. Information security thus turns from an IT topic into a sales argument.

What obligations does NIS2 bring for covered companies?

The directive requires a bundle of risk management measures. In simplified form, these include:

risk analysis and security policies for the information systems,
procedures for detecting and handling security incidents,
backup management, emergency and crisis plans for business continuity,
supply chain security, i.e. the assessment of service providers and suppliers,
secure procurement, development and maintenance of systems,
procedures to assess the effectiveness of your own measures,
basic cyber hygiene and training for staff,
encryption as well as access control and multi-factor authentication, where appropriate.

On top of this come reporting obligations: significant security incidents must be reported promptly to the competent authority – the directive provides for a staged procedure with an early warning within 24 hours and a more detailed notification within 72 hours; the details are governed by national law.

The role of management is notable: it must explicitly approve the security measures and oversee their implementation, can be held accountable for breaches and must take part in training itself. Under NIS2, cybersecurity can therefore no longer be fully “delegated to IT” – an idea that, incidentally, is good business practice outside NIS2 too.

What should SMEs sensibly do now?

Regardless of the exact status of the Austrian implementation, there are steps that are neither premature nor wasted:

Roughly clarify whether you are affected: Go through the sector list and the size threshold. If you are unsure or a borderline case, get a professional assessment.
Take stock: Which systems are critical? Are there tested backups, updates, access control, multi-factor authentication? These basic measures pay off in any case – NIS2 or not.
Take supply chain requests seriously: Do not dismiss questionnaires from large customers as bureaucracy but treat them as early signs. If you can answer them soundly early on, you gain a head start.
Assign responsibility: Name one person who is responsible for information security – even in small organisations.
Build up documentation: Record policies, emergency plans and responsibilities in writing. Without documentation you will later be unable to prove anything, whether to customers or to authorities.
Follow the implementation: Keep an eye on the status of the Austrian NIS2 implementing act and derive deadlines from it – not from EU documents or rumours.

What does knowledge documentation have to do with NIS2?

More than it seems at first glance. Almost all NIS2 obligations come down to documented, findable and trained knowledge: security policies, emergency plans, reporting channels, responsibilities, training materials. In an incident, what counts is not that an emergency plan exists somewhere, but that the person on duty finds and understands it within minutes.

This is exactly where an AI knowledge base that answers from your own documents helps: asked “What do we do first in a ransomware incident, and who is informed?”, it gives the answer together with the source from your own emergency handbook – verifiable and up to date, instead of reconstructed from memory. Information security and data protection overlap strongly here: how server location, data processing and access control fit together when using AI is explained in the overview article AI and the GDPR in Austria.

The concrete next step: go through the two checks – sector and size – for your company and record the result in writing. And if you want to make your security and emergency documentation findable for good, the Process page shows how to do this without a big IT project.