NIS2 October Deadlines: Austria Oct 1, Poland Oct 3

NIS2's October Deadlines Land in Under Three Weeks

Two national NIS2 milestones now sit inside the compliance window: Austria's NISG 2026 enters full force on 1 October, and Poland's registration deadline for essential and important entities falls 3 October — separate, country-set clocks, not a single EU date.

Why It Matters

NIS2 obligations bind through each member state's own transposition law, not through Directive (EU) 2022/2555 directly — so the dates that matter are national, and they are staggered. Austria's Network and Information System Security Act 2026 (NISG 2026), promulgated in December 2025, enters full force on 1 October 2026 (17 days), switching on its core security and incident-reporting obligations. Poland's amended National Cybersecurity System Act requires essential and important entities to complete registration by 3 October 2026 (19 days).

For compliance teams, CISOs and in-house counsel, the practical risk is treating NIS2 as one EU event. Registration and baseline-security duties attach on each national date, and missing a member-state window exposes an entity to that state's supervisory and penalty regime. Operators with footprints in multiple member states should map obligations jurisdiction by jurisdiction rather than assume a common deadline.

Action Items

Inventory in-scope entities — identify every operation in Austria and Poland that qualifies as an essential or important entity under each country's NIS2 law.
Register before the deadlines — complete Austrian NISG 2026 obligations by 1 October and Polish essential/important-entity registration by 3 October.
Assign a per-country owner — name someone to track each member state's transposition clock separately, not as one EU filing.

Get the full analysis. Pro subscribers receive the complete deep dive, all 5 action items, source documents, and jurisdiction-specific compliance checklists.

Upgrade to Pro