Tools

Does my business fall under NIS2?

Ten questions on establishment, activity and size. The result classifies under the Austrian NISG 2026, with the source under every statement, the deadlines and what a form cannot decide. No sign-up, nothing is stored.

The problem

How do I know whether NIS2 concerns my business?

Large customers send questionnaires, “NIS2” is in the news, and nobody in the business can say whether their own company is meant. The Austrian NISG 2026 classifies by establishment, activity and size, in two annexes with sectors, and size counts according to the SME recommendation.

What the check does: The self-check follows the order of review in the law: establishment, activity under Annex 1 or 2, cases independent of size, size, classification. Under every statement is the reference in the law.

What it does not do: It does not replace a classification by the authority and expressly does not decide three things: the group question, the main establishment for digital services and the official notice.

Start the check · 3 min · free

My business is small. Is the check still for me?

Yes. Size is one of the questions, and some activities are covered regardless of size. And even those not covered are asked as suppliers.

Where do the statements come from?

From the Federal Law Gazette on the NISG 2026 and its Annexes 1 and 2, read on 10 September 2026; every statement in the result names its place.

What do I do with the result?

It is a placement to read and pass on, with the open questions a form cannot settle. The answer to the customer is the next step.

Question 1 of 10Where is your business established?The Austrian NISG 2026 applies to entities established in Austria (§ 28 para. 1). Other EU countries have their own transposition acts; there the tool can only classify by the Directive.

AustriaThe NISG 2026 applies to businesses established in Austria.

Source: Section 28 (1) NISG 2026. With several establishments in the EU, the question of the main establishment stays open; the result lists it as a reservation.

Another EU countryIn other EU countries the national transposition applies; the tool then classifies by the Directive only.

Directive (EU) 2022/2555 sets the frame, each country transposes it with its own act. Sectors and size thresholds come from the Directive, deadlines and authorities from national law.

Outside the EUThe tool only classifies businesses based in Austria or the EU.

Providers from third countries offering services in the EU are subject to separate rules the tool does not check (verify current status). Requirements often reach you through customers in the EU, see question 10.

Question 2 of 10What is your business’s main activity?What counts is the activity, not the industry label. The list shows the sectors of Annexes 1 and 2 NISG 2026; the result shows the exact wording of what is covered.

Question 3 of 10Do you provide any of these services?These services are covered regardless of the size of the business (§ 24 para. 1 items 1 and 2, para. 2 item 3 NISG 2026).

None of theseThe right answer for the vast majority of businesses.

Trades, retail, hospitality, office, consulting, construction, manufacturing: none of these services. Using a website, e-mail or a cloud does not mean providing these services, only using them.

Qualified trust service providerYou issue electronic signatures, seals or certificates and are qualified to do so.

Merely using such signatures does not make you a provider. Source: Section 24 (1) no. 1 lit. a NISG 2026 (essential, regardless of size).

Trust service provider (not qualified)You offer signature, seal or timestamp services without qualified status.

Rare. If you do not know what this is, you are not one. Source: Section 24 (2) no. 3 lit. b NISG 2026 (important, regardless of size).

TLD name registryYou manage an ending such as .at.

Merely registering or selling domains does not make you a name registry. Source: Section 24 (1) no. 1 lit. b NISG 2026.

DNS service providerYou run servers for others that resolve domain names into addresses.

Meant are providers that run the service for others, such as a hosting provider with its own DNS service. Source: Section 24 (1) no. 1 lit. c NISG 2026.

Public electronic communications network or publicly available communications serviceYou offer internet, telephone or mobile services to the public.

Meant are providers whose business is the network or telephone service. Source: Section 24 (2) no. 3 lit. a NISG 2026; as a medium-sized enterprise Section 24 (1) no. 2.

Question 4 of 10How many people does your business employ?In annual work units: part-time counted pro rata, apprentices not counted (Art. 5 of the Annex to Recommendation 2003/361/EC).

Fewer than 50Fewer than 50 full-time equivalents on annual average: a small or micro enterprise.

Source: Section 25 (3) NISG 2026 with Articles 2 and 5 of the Annex to Recommendation 2003/361/EC. Part-time counts pro rata, apprentices do not count.

50 to 249From 50 staff a business counts as a medium-sized enterprise, regardless of turnover.

Source: Section 25 (3) NISG 2026: "at least 50 employees" or turnover above 10 million and balance sheet total above 10 million euros.

250 or moreFrom 250 staff a business counts as a large enterprise.

Source: Section 25 (2) NISG 2026: "at least 250 employees" or turnover above 50 million and balance sheet total above 43 million euros.

Question 5 of 10What was the annual turnover in the last set of accounts?Excluding VAT, last approved accounts (Art. 4 of the Annex to the Recommendation).

Up to 10 million eurosBelow the threshold for medium-sized enterprises; headcount then decides.

Source: Section 25 (2) and (3) NISG 2026. Turnover excluding VAT from the last approved accounts (Article 4 of the Annex to Recommendation 2003/361/EC).

Over 10 up to 50 million eurosAbove 10 million: together with a balance sheet total above 10 million a medium-sized enterprise.

Turnover and balance sheet total must both exceed the threshold; otherwise only headcount counts. Source: Section 25 (3) NISG 2026.

Over 50 million eurosAbove 50 million: together with a balance sheet total above 43 million a large enterprise.

Turnover and balance sheet total must both exceed the threshold; otherwise only headcount counts. Source: Section 25 (2) NISG 2026.

Question 6 of 10What was the balance sheet total?

Up to 10 million eurosThe balance sheet total is the sum of all assets at the balance sheet date; here below the threshold.

Source: Section 25 (2) and (3) NISG 2026. The last approved accounts count (Article 4 of the Annex to Recommendation 2003/361/EC).

Over 10 up to 43 million eurosAbove 10 million: together with turnover above 10 million a medium-sized enterprise.

Turnover and balance sheet total must both exceed the threshold; otherwise only headcount counts. Source: Section 25 (3) NISG 2026.

Over 43 million eurosAbove 43 million: together with turnover above 50 million a large enterprise.

Turnover and balance sheet total must both exceed the threshold; otherwise only headcount counts. Source: Section 25 (2) NISG 2026.

Question 7 of 10Is your business part of a group, or does anyone hold 25 % or more of it (or it of others)?For partner and linked enterprises, figures are added pro rata or in full (Art. 3 and 6 of the Annex to the Recommendation), unless the network and information systems are independent (§ 25 para. 4 NISG 2026).

NoYour business stands alone: no parent, no subsidiary, no shareholder with 25 % or more.

Then only your own figures count. Source: Article 3 (1) of the Annex to Recommendation 2003/361/EC (autonomous enterprise).

YesThen the figures of the other companies may be added in part or in full.

Source: Articles 3 and 6 of the Annex to Recommendation 2003/361/EC; Section 25 (4) NISG 2026 exempts partner and linked enterprises if the network and information systems are independent. The tool does not calculate this; it lists the question as a reservation.

I don’t knowA look at the company register extract or the articles of association settles it.

It is about holdings of 25 % or more in either direction. The result lists the question as open.

Question 8 of 10Is your business subject to the DORA Regulation (financial sector, Regulation (EU) 2022/2554)?

NoThe right answer for most businesses outside the financial sector.

DORA is Regulation (EU) 2022/2554 on digital operational resilience for the financial sector.

YesBanks, insurers, payment and securities firms and their ICT service providers.

Source: Section 24 (7) and (8) NISG 2026: DORA takes precedence; ICT third-party service providers under Article 3 no. 23 DORA are also subject to the NISG 2026.

I don’t knowDORA concerns the financial sector. The result lists the question as open.

Anyone supervised by the Financial Market Authority usually knows DORA from its letters. Source: Section 24 (7) NISG 2026.

Question 9 of 10Has the cybersecurity authority issued a decision classifying your business as an essential or important entity?

NoThere is no letter from the cybersecurity authority classifying your business.

The authority can also classify entities without an application (Section 26 NISG 2026). As long as no decision exists, the classification under Sections 24 and 25 counts.

YesThen the classification in the decision applies, regardless of sector and size.

Source: Section 24 (1) no. 1 lit. e and (2) no. 3 lit. c NISG 2026 with Section 26. The tool can neither replace nor check a decision.

Question 10 of 10Do you have customers who may themselves be covered, such as energy suppliers, hospitals, banks, public bodies, industry?Covered entities must manage supply-chain security (Art. 21(2)(d) of the Directive) and pass requirements on to their suppliers.

YesCovered entities must secure their supply chain and pass requirements on.

Source: Article 21 (2) (d) of Directive (EU) 2022/2555. You are then not covered yourself but receive questionnaires and contract clauses. Handbook A3 covers exactly that.

NoYour customers are private individuals or small businesses; as a rule no NIS2 requirements come from there.

That can change with a new major customer; the check can be repeated at any time.

I don’t knowThink of your largest customers: energy suppliers, hospitals, banks, public bodies, industry.

Businesses from the sectors of Annexes 1 and 2 can be covered if they are medium-sized or large; the list is below the form.

The tool classifies, it does not decide. Whether a business is covered depends on the wording of the annexes, on size under the SME Recommendation and on questions only a case-by-case review can settle. It is not legal advice. Sources as of 10. September 2026, checked against the text of the act on 18. September 2026. The NISG 2026 has been promulgated (BGBl. I No. 94/2025); §§ 2 to 45 and Annexes 1 and 2 enter into force under § 51 para. 2 on 1 October 2026 (calculated). As of 18. September 2026 no regulation of the cybersecurity authority had been promulgated; future ones will appear in the Federal Law Gazette II (BGBl. II No. 270/2026). Verify the current position.

The sectors of Annexes 1 and 2 at a glance

Annex 1 · 1 Energy

Sub-sectors: Electricity · District heating and cooling · Oil · Gas · Hydrogen

Type of entity, in the wording of the Austrian annex (German; shortened with “…”, never reworded):

„Elektrizitätsunternehmen im Sinne des § 7 Abs. 1 Z 11 … ElWOG …, sofern diese Versorger gemäß § 7 Abs. 1 Z 74 ElWOG sind“
„Verteilernetzbetreiber im Sinne des § 7 Abs. 1 Z 76 ElWOG“
„Übertragungsnetzbetreiber im Sinne des § 7 Abs, 1 Z 70 ElWOG“
„Erzeuger im Sinne des § 7 Abs 1 Z 17 ElWOG, sofern es sich bei diesen Tätigkeiten um die gewerbliche oder berufliche Haupttätigkeit handelt“

Full wording: Anlage 1 NISG 2026 (BGBl. I Nr. 94/2025) · retrieved 10. September 2026

Annex 1 · 2 Transport

Sub-sectors: Air · Rail · Water · Road

Full wording: Anlage 1 NISG 2026 (BGBl. I Nr. 94/2025) · retrieved 10. September 2026

Annex 1 · 3 Banking

Type of entity, in the wording of the Austrian annex (German; shortened with “…”, never reworded):

„Kreditinstitute im Sinne des Art. 4 Z 1 der Verordnung (EU) Nr. 575/2013 …“

Full wording: Anlage 1 NISG 2026 (BGBl. I Nr. 94/2025) · retrieved 10. September 2026

Annex 1 · 4 Financial market infrastructures

Type of entity, in the wording of the Austrian annex (German; shortened with “…”, never reworded):

„Betreiber von Handelsplätzen im Sinne des § 1 Z 26 Wertpapieraufsichtsgesetz 2018 – WAG 2018 …“
„Zentrale Gegenparteien im Sinne des Art. 2 Z 1 der Verordnung (EU) Nr. 648/2012 …“

Full wording: Anlage 1 NISG 2026 (BGBl. I Nr. 94/2025) · retrieved 10. September 2026

Annex 1 · 5 Health

Type of entity, in the wording of the Austrian annex (German; shortened with “…”, never reworded):

„Gesundheitsdienstleister im Sinne des Art. 3 lit. g der Richtlinie 2011/24/EU …“
„EU-Referenzlaboratorien im Sinne des Art. 15 der Verordnung (EU) 2022/2371 …“
„Einrichtungen, die Forschungs- und Entwicklungstätigkeiten in Bezug auf Arzneimittel im Sinne des § 1 Abs. 1 … Arzneimittelgesetz – AMG … ausüben“
„Einrichtungen, die pharmazeutische Erzeugnisse im Sinne des Abschnitts C Abteilung 21 … (NACE Rev. 2) herstellen“
„Einrichtungen, die Medizinprodukte herstellen, die während einer Notlage im Bereich der öffentlichen Gesundheit als kritisch … eingestuft werden“

Full wording: Anlage 1 NISG 2026 (BGBl. I Nr. 94/2025) · retrieved 10. September 2026

Annex 1 · 6 Drinking water

Type of entity, in the wording of the Austrian annex (German; shortened with “…”, never reworded):

„Lieferanten von und Unternehmen der Versorgung mit „Wasser für den menschlichen Gebrauch“ im Sinne des § 3 Z 2 … LMSVG …, jedoch unter Ausschluss der Lieferanten, für die die Lieferung von Wasser für den menschlichen Gebrauch ein nicht wesentlicher Teil ihrer allgemeinen Tätigkeit … ist“

Full wording: Anlage 1 NISG 2026 (BGBl. I Nr. 94/2025) · retrieved 10. September 2026

Annex 1 · 7 Waste water

Type of entity, in the wording of the Austrian annex (German; shortened with “…”, never reworded):

„Unternehmen, die kommunales, häusliches oder industrielles Abwasser … sammeln, entsorgen oder behandeln, jedoch unter Ausschluss der Unternehmen, für die das Sammeln, die Entsorgung, oder die Behandlung solchen Abwassers ein nicht wesentlicher Teil ihrer allgemeinen Tätigkeit ist“

Full wording: Anlage 1 NISG 2026 (BGBl. I Nr. 94/2025) · retrieved 10. September 2026

Annex 1 · 8 Digital infrastructure

Type of entity, in the wording of the Austrian annex (German; shortened with “…”, never reworded):

„Internet-Knoten (Internet Exchange Point – IXP)“
„DNS-Diensteanbieter, ausgenommen Betreiber von Root-Nameserver“
„Namenregister der Domäne oberster Stufe (TLD-Namenregister)“
„Anbieter von … Cloud-Computing-Diensten“
„Anbieter von … Rechenzentrumsdiensten, mit Ausnahme von Rechenzentrumsdiensten, die ausschließlich von der betroffenen Einrichtung betrieben und genutzt werden“
„Betreiber von … Inhaltszustellnetzen (Content Delivery Network)“
„Vertrauensdiensteanbieter“
„Anbieter öffentlicher elektronischer Kommunikationsnetze oder Anbieter von Kommunikationsdiensten, soweit deren Dienste öffentlich zugänglich sind“

Full wording: Anlage 1 NISG 2026 (BGBl. I Nr. 94/2025) · retrieved 10. September 2026

Annex 1 · 9 ICT service management (business-to-business)

Type of entity, in the wording of the Austrian annex (German; shortened with “…”, never reworded):

„Anbieter verwalteter Dienste (Managed Service Provider – MSP), ausgenommen jener Fälle, in denen diese Dienste ausschließlich von der betroffenen Einrichtung betrieben und genutzt werden“
„Anbieter verwalteter Sicherheitsdienste (Managed Security Service Provider – MSSP), ausgenommen jener Fälle, in denen diese Dienste ausschließlich von der betroffenen Einrichtung betrieben und genutzt werden“

Full wording: Anlage 1 NISG 2026 (BGBl. I Nr. 94/2025) · retrieved 10. September 2026

Annex 1 · 10 Public administration

Type of entity, in the wording of the Austrian annex (German; shortened with “…”, never reworded):

„Einrichtungen im Sektor der öffentlichen Verwaltung auf Bundesebene“
„Einrichtungen im Sektor der öffentlichen Verwaltung auf Landesebene“

Full wording: Anlage 1 NISG 2026 (BGBl. I Nr. 94/2025) · retrieved 10. September 2026

Annex 1 · 11 Space

Type of entity, in the wording of the Austrian annex (German; shortened with “…”, never reworded):

„Betreiber von Bodeninfrastrukturen, … die die Erbringung von weltraumgestützten Diensten unterstützen …“

Full wording: Anlage 1 NISG 2026 (BGBl. I Nr. 94/2025) · retrieved 10. September 2026

Annex 2 · 1 Postal and courier services

Type of entity, in the wording of the Austrian annex (German; shortened with “…”, never reworded):

„Postdiensteanbieter gemäß § 3 Z 3 Postmarktgesetz (PMG) … und Anbieter von Kurierdiensten gemäß § 3 Z 4a PMG“

Full wording: Anlage 2 NISG 2026 (BGBl. I Nr. 94/2025) · retrieved 10. September 2026

Annex 2 · 2 Waste management

Type of entity, in the wording of the Austrian annex (German; shortened with “…”, never reworded):

„Unternehmen gemäß § 2 Abs. 6 Z 3 und 4 Abfallwirtschaftsgesetz 2002 …, mit Ausnahme jener Unternehmen, deren (wirtschaftliche) Haupttätigkeit nicht die Abfallbewirtschaftung darstellt“

Full wording: Anlage 2 NISG 2026 (BGBl. I Nr. 94/2025) · retrieved 10. September 2026

Annex 2 · 3 Manufacture, production and distribution of chemicals

Type of entity, in the wording of the Austrian annex (German; shortened with “…”, never reworded):

„Unternehmen im Sinne der Art. 3 Z 9 und 14 der Verordnung (EG) Nr. 1907/2006 (REACH) …, die Stoffe herstellen und die diese Stoffe oder Gemische im Großhandel vertreiben sowie Unternehmen, die Erzeugnisse … aus diesen Stoffen oder Gemischen produzieren, sofern diese in die Kategorie 20 … (NACE Rev. 2) fallen“

Full wording: Anlage 2 NISG 2026 (BGBl. I Nr. 94/2025) · retrieved 10. September 2026

Annex 2 · 4 Production, processing and distribution of food

Type of entity, in the wording of the Austrian annex (German; shortened with “…”, never reworded):

„Lebensmittelunternehmen im Sinne des Art. 3 Z 2 der Verordnung (EG) Nr. 178/2002 …, die im Großhandel und in der industriellen Produktion und Verarbeitung tätig sind“

Full wording: Anlage 2 NISG 2026 (BGBl. I Nr. 94/2025) · retrieved 10. September 2026

Annex 2 · 5 Manufacturing

Sub-sectors: Medical devices and in vitro diagnostics · Computer, electronic and optical products (NACE C 26) · Electrical equipment (NACE C 27) · Machinery and equipment (NACE C 28) · Motor vehicles, trailers and semi-trailers (NACE C 29) · Other transport equipment (NACE C 30)

Type of entity, in the wording of the Austrian annex (German; shortened with “…”, never reworded):

„Unternehmen, die eine der Wirtschaftstätigkeiten im Sinne des Abschnitts C Abteilung 26 [27, 28, 29, 30] … (NACE Rev. 2) ausüben“
„Einrichtungen, die Medizinprodukte im Sinne des Art. 2 Z 1 der Verordnung (EU) 2017/745 … herstellen, und Einrichtungen, die In-vitro-Diagnostika … herstellen“

Full wording: Anlage 2 NISG 2026 (BGBl. I Nr. 94/2025) · retrieved 10. September 2026

Annex 2 · 6 Digital providers

Type of entity, in the wording of the Austrian annex (German; shortened with “…”, never reworded):

„Anbieter eines Online-Marktplatzes gemäß § 1 Abs. 4 Z 10 … (UWG)“
„Anbieter einer „Online-Suchmaschine“ im Sinne des Art. 2 Z 5 der Verordnung (EU) 2019/1150“
„Anbieter einer Plattform, auf der Endnutzer … miteinander in Kontakt treten und kommunizieren sowie Inhalte teilen und entdecken können („Dienste sozialer Netzwerke“)“

Full wording: Anlage 2 NISG 2026 (BGBl. I Nr. 94/2025) · retrieved 10. September 2026

Annex 2 · 7 Research

Type of entity, in the wording of the Austrian annex (German; shortened with “…”, never reworded):

„Einrichtungen, deren primäres Ziel es ist, angewandte Forschung oder experimentelle Entwicklung im Hinblick auf die Nutzung der Ergebnisse dieser Forschung für kommerzielle Zwecke durchzuführen, die jedoch Bildungseinrichtungen nicht einschließt“

Full wording: Anlage 2 NISG 2026 (BGBl. I Nr. 94/2025) · retrieved 10. September 2026