# NIS2 reporting duty

**Where and when do I report a NIS2 incident in Austria?**

Essential and important entities report a significant cybersecurity incident under section 34 NISG 2026 in three steps: early warning within 24 hours, incident report within 72 hours, final report no later than one month after that. Reports go to the competent CSIRT through the reporting platform in the Austrian business service portal (USP).

The NISG 2026 has applied since 1 October 2026 and transposes the NIS2 directive in Austria. The duty only applies to entities within its scope, which depends on sector and size.

## Related terms
- [NIS2](https://vetosec.at/en/it-security/nis2/)
- [Data breach notification duty](https://vetosec.at/en/it-security/meldepflicht-datenpanne/)
- [IT emergency plan](https://vetosec.at/en/it-security/notfallplan/)
- [RKEG](https://vetosec.at/en/it-security/rkeg/)

## Source
https://vetosec.at/en/it-security/nis2-meldepflicht/ (vetosec, recht)