From October 1: What Austria's IT Reporting Obligation Means

TVS News AI, editorially supervised, presents From October 1: What Austria's IT Reporting Obligation Means.

From October 1, IT security in Austria gets serious: A new reporting obligation for IT incidents takes effect. It affects not just the biggest corporations – public authorities and a significantly larger circle of companies are now part of it, too. heise online reports on the changes that will apply starting in October.

The obligation is rooted in the EU's NIS-2 directive, which Austria is transposing into national law. Those who fall within its scope must register and report incidents going forward. The EU is responding to a threat landscape in which cyberattacks have long been part of everyday life.

What lies behind the reporting obligation?

The new regulation transposes the EU-wide NIS-2 directive into Austrian law. The goal: IT security incidents should no longer remain silent but become visible – and authorities should be able to step in faster in an emergency.

The NIS-2 directive brings registration obligations for companies and authorities to Austria. They are gaining a new addition: the Federal Office for Cybersecurity.

Who is affected?

According to heise online, the NIS-2 implementation significantly expands the circle of those obliged: not only traditional critical infrastructures, but also public authorities and many companies now fall under the registration requirement. More precise thresholds and sectors emerge from the respective national implementation.

New structure: Federal Office for Cybersecurity

At the same time, a new Federal Office for Cybersecurity is being established. This gives the reports a central point of contact – and those affected have a clear point of contact in an emergency rather than a patchwork of agencies.

What you should do now

If your company or public authority falls within the scope, the time until October is tight. Clarify early: Who is responsible for registration? Which incidents are reportable? And who documents what? A reporting obligation is always also a documentation obligation – and in an emergency, every hour counts.