Austria NISG 2026 Registration: 6 USP Steps and the Three Official Deadlines (31 Dec, 1 Jan, 4 Jan)

Short answer: every essential and important entity under Austria’s NISG 2026 (BGBl. I Nr. 94/2025) registers itself with the Bundesamt für Cybersicherheit through the “NIS2 Services” application in the Unternehmensserviceportal (USP). The app has been open since the law took effect on 1 October 2026. Section 29(3) gives you three months from that date, and the official pages turn this into three different deadlines: 31 December 2026, 1 January 2027 and 4 January 2027.

The date that follows from the statute is 1 January 2027, and the authority’s registration page allows until 4 January. You should still plan to finish by 31 December, because that date satisfies every official reading. The bigger risk isn’t the date. It’s how long it takes to get USP access if your company doesn’t have it yet.

This spoke of our NIS2 Austria guide covers who registers, why the dates differ, the six steps in the USP, and the fines for registering late.

Who has to register in the USP

In plain terms: if NISG 2026 classifies you as essential or important, you register without waiting to be asked. Section 29(1) also covers entities that provide domain-name registration services. Austria’s register implements Article 3(3)–(4) and Article 27 of the NIS2 Directive, so the data you submit mirrors what every Member State collects.

Your situation	Classification (NISG 2026)	Register by the initial deadline?
Annex 1 sector, large company (≥250 staff, or turnover > €50m and balance sheet > €43m)	Essential, § 24(1) no. 3	Yes
Annex 1 sector, medium company (≥50 staff, or turnover and balance sheet both > €10m); Annex 2 sector, medium or large company	Important, § 24(2) no. 1	Yes
Qualified trust service provider, TLD registry, DNS provider	Essential regardless of size	Yes
Critical entity under the RKE-Gesetz	Essential, § 24(1) no. 1(f)	Yes, unless already registered
Group with several in-scope subsidiaries	Assessed per entity	Each entity separately; there is no group-wide registration
Small or micro company outside the size-independent categories	Not in scope unless designated by the authority (§ 26)	No, but file your scoping note

One Austrian detail changes the size test for group companies. Section 25(4) says you do not add partner or linked-company figures if your entity’s network and information systems are organisationally, technically and operationally independent of theirs. A 30-person subsidiary with €5 million turnover inside a 2,000-person group can therefore stay outside scope, but only if its IT really is separate. Write that reasoning down: Section 29(2) no. 7 asks you to declare your thresholds and classification, and knowingly incomplete data is itself a fineable offence. Our size threshold guide walks through the EU counting rules underneath.

Three official dates, one safe deadline

In plain terms: the statute says “within three months”. Official pages have converted that into three dates, so aim for 31 December.

Date	Where it appears	Basis
31 December 2026	Bundesamt FAQ (updated 25 September 2026); WKO FAQ	No reasoning given; it appears to count 1 October as day one
1 January 2027	Interior Ministry NIS2 page; Bundesamt registration page	§ 29(3) NISG 2026 with the month-end rule in AVG § 32(2)
4 January 2027	Bundesamt registration page (updated 2 October 2026)	AVG § 33(2): a period ending on a holiday or weekend moves to the next working day

Here is how each date arises. Section 51(2) puts the law into force on the first day of the month after nine months from publication on 23 December 2025, which is 1 October 2026. Under AVG § 32(2), a period counted in months ends on the day of the last month that has the same number as the day it began. Starting from 1 October, that’s 1 January. The Interior Ministry’s NIS2 page says the same: registration “hat initial bis zum 1. Jänner 2027 zu erfolgen”.

New Year’s Day 2027 is a Friday and a public holiday, followed by a weekend. AVG § 33(2) moves a deadline that ends on such a day to the next working day, Monday 4 January. The Bundesamt’s registration page applies that rule itself: “grundsätzlich bis 1. Jänner 2027, aufgrund § 33 Abs. 2 AVG bis spätestens 4. Jänner 2027”.

The Bundesamt’s own FAQ still says “bis spätestens 31. Dezember 2026”, and so does the WKO’s NIS FAQ. When we compared the pages on 13 October 2026, the registration page was the more recently updated, and its dates are the ones that follow from the statute. A FAQ isn’t binding law, but it does show how the authority’s own staff may read the deadline. Registering by 31 December means none of these readings can be held against you. The 4 January date is only a safety margin.

The six steps in the USP

In plain terms: steps 1 and 2 take the longest. Filling in the form itself (step 5) is quick once the earlier steps are done.

Step 1: Confirm your classification and size figures (effort: Medium; owner: Legal/Finance)

Decide essential, important or out of scope, with the staff headcount, turnover and balance sheet figures you used and, for group companies, your Section 25(4) independence reasoning. The essential vs important comparison covers what each label means for supervision. Keep this note, because it’s the answer you give under § 29(2) no. 7.

Step 2: Secure USP company access (effort: Low to High; owner: Management)

If your company already uses Mein USP, you only need an administrator who can assign roles. If it doesn’t, this is the slow step. According to the USP registration guide, the company names a USP administrator who needs an ID Austria or EU-Login. Either a person with sole signing authority approves, or all signatories must agree. If nobody has sole signing authority, you also need a FinanzOnline supervisor account. Where the activation code (Freischaltcode) is sent by post, it goes to management by RSa letter (registered post). The USP’s activation instructions say the code and the registration lapse 28 days after the letter is sent.

Plan for postal delivery, the code being handed from management to the administrator, and holidays. If you have no USP account today, start before the end of November. That’s our planning estimate, not an official figure. Foreign companies first need an Austrian register entry: a branch goes into the Firmenbuch, and other companies go into the ERsB unless they already have an Austrian tax number. This is set out in the USP guide for foreign companies.

Step 3: Assign the NIS roles (effort: Low; owner: USP administrator)

The application has three procedure rights: “NIS Gesamt” (everything), “NIS Registrierung” and “NIS Meldung”. The USP help page on procedure rights warns that an assignment can take up to 60 minutes to apply, and the user then has to log out and back in. Give NIS Meldung to everyone who might file the 24-hour early warning, including deputies. The same app carries incident reports (see the Bundesamt’s reporting page), and the Interior Ministry notes that reporting has been mandatory since the law took effect. If a consultant will register for you, grant a time-limited authorisation through USP Vertretungsmanagement instead of sharing a login.

Step 4: Assemble the seven data points (effort: Medium; owner: Compliance with IT)

§ 29(2)	Data point	Where it goes wrong
No. 1–2	Name, address, current contact data	A personal mailbox as the contact. Use a monitored role address.
No. 3	Sector(s), subsector(s), entity type(s) per Annex 1 or 2	Listing only your main activity when a second one is also in scope
No. 4	EU Member States where you provide services	Forgetting cross-border customers served from Austria
No. 5	IP address ranges, where applicable	The FAQ means only static public ranges (domains and URLs can be added), not internal networks
No. 6	Main establishment and other EU establishments	Leaving out branches
No. 7	Size thresholds and essential/important status	Figures that don’t match the Step 1 note

Section 29(6) also requires a contact point with at least a phone number and an email address. The explanatory notes to NISG 2026 recommend it be reachable outside business hours too. A switchboard that closes at 17:00 meets the letter of the law but not that recommendation.

Step 5: Submit and keep proof (effort: Low; owner: Compliance)

File one registration per legal entity. A person with the right roles can register several entities from one USP login. Save the confirmation with its timestamp in your compliance file. Public-administration bodies will reach the same form through the Portalverbund once that connection is switched on, which the Bundesamt expected shortly after 1 October. Entities with no EU establishment that must name a representative under § 28(4) don’t use the USP. They email the Bundesamt’s representative form to post@bundesamt-cybersicherheit.gv.at.

Step 6: Keep it current and set the next deadline (effort: Low; owner: Compliance)

Section 29(4) gives you two weeks to report changes to items 1–5 (name, contacts, sector, Member States, IP ranges) and three months for items 6–7. Section 33(1) then requires a self-declaration on your implemented risk-management measures within twelve months of the registration obligation arising, which the WKO dates at 30 September 2027. Article 27 registries in other Member States work similarly; see our entity registration guide if you also register elsewhere.

Who does what before 31 December

Role	Owns	Our suggested finish date
Managing director / board	USP signatory approval; handing the activation code to the administrator	End of November if there’s no USP account
Compliance officer / legal	Classification note, data set, submission, proof, change log	Mid-December
CISO / IT lead	Static public IP ranges, out-of-hours contact point, NIS Meldung holders	Early December

What late or wrong registration costs

Offence (§ 45(4) NISG 2026)	Maximum fine
Not registering on time under § 29(3), or knowingly submitting false or incomplete data	€50,000; €100,000 for a repeat offence
Not reporting changes within the § 29(4) periods	€50,000; €100,000 for a repeat offence

These amounts sit outside the €10 million / 2% (essential) and €7 million / 1.4% (important) caps in § 45(2)–(3), which apply to failures in risk management, training and incident reporting. District administrative authorities impose the fines under § 44. Our Austria enforcement guide covers how the Bundesamt escalates. For which sector authority and CSIRT you’ll deal with after registering, see our Austria competent authority guide.

Frequently asked questions

Is the deadline 31 December 2026 or 1 January 2027?

The statute says three months from 1 October 2026. The Interior Ministry and the Bundesamt’s registration page give 1 January 2027, extended to 4 January by AVG § 33(2). The Bundesamt FAQ and the WKO say 31 December. Register by 31 December and the difference doesn’t matter.

Can our parent company register the whole group?

No. Each in-scope entity registers separately. One authorised person can file for several entities from the same USP login.

Do we need to register before we can report an incident?

Reporting has been mandatory since 1 October 2026 and runs through the same NIS2 Services app. Assign the NIS Meldung role now, even if you register later in the window. If the portal is down, the Bundesamt provides PDF fallback forms.

Are online “NISG-Betroffenheitsanalysen” official?

The Interior Ministry warns that most online “NISG-Betroffenheitsanalysen” are not official. It advises checking the operator’s legal notice before you share sensitive company data. Registration itself happens only in the USP.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

Sources

1. Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), BGBl. I Nr. 94/2025, published 23 December 2025. RIS, authentic federal gazette. §§ 24, 25, 26, 28, 29, 33, 44, 45 and 51.
2. Bundesministerium für Inneres: Cybersicherheit — NIS 2 Umsetzung startet, NISG 2026 und neues Bundesamt für Cybersicherheit.
3. Bundesamt für Cybersicherheit: Registrierung (last updated 2 October 2026).
4. Bundesamt für Cybersicherheit: Häufig gestellte Fragen — Registrierung (last updated 25 September 2026).
5. Allgemeines Verwaltungsverfahrensgesetz 1991 (AVG), § 32. RIS, consolidated federal law.
6. Allgemeines Verwaltungsverfahrensgesetz 1991 (AVG), § 33. RIS, consolidated federal law.
7. Unternehmensserviceportal: Registrierung für Mein USP — Anleitungen und häufig gestellte Fragen.
8. Unternehmensserviceportal: Abschluss der Registrierung zu Mein USP (Freischaltcode).
9. Unternehmensserviceportal: Registrierung für ausländische Unternehmen.
10. Unternehmensserviceportal: Verfahrensrechte verwalten.
11. Unternehmensserviceportal: Vollmachten vergeben.
12. Bundesamt für Cybersicherheit: Meldepflicht und Fristen.
13. Erläuterungen zur Regierungsvorlage NISG 2026 (308 der Beilagen XXVIII. GP), commentary on § 29. PDF published by the Bundesamt für Cybersicherheit, 6 October 2026.
14. Wirtschaftskammer Österreich: NIS FAQ — Registrierung und Selbstdeklaration.
15. Directive (EU) 2022/2555 (NIS2 Directive). EUR-Lex. Articles 3(3)–(4) and 27.