Lesson 1.2 · 7 min

The 18 sectors

Open in the coursewith narrated slides, a checklist to tick off and a quiz

At a glance

Eleven sectors of high criticality. Energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, IT services for businesses, public administration and space.
Seven other critical sectors. Postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research.
Manufacturing. Medical devices, electronics, electrical equipment, machinery, motor vehicles and other transport equipment, defined by NACE divisions 26 to 30.
IT service providers are a sector of their own. Anyone who installs, manages, operates or maintains IT for others is a managed service provider. So is the IT company within your own group.
A secondary activity counts too. Only for energy, drinking water, waste water and waste does the main activity matter. Otherwise even a small line of business can bring in the whole company.

In detail

Two annexes, 18 sectors

Whether a business can be covered depends first on whether it is an entity of a type listed in Annex 1 or 2 § 24(1) and (2) NISG 2026. For each sector, the annexes name the types of entity, mostly by reference to another law.

Annex 1: high criticality	Examples of types of entity
1. Energy	electricity (suppliers, grid operators, producers whose main activity it is, charge point operators), district heating and cooling, oil, gas, hydrogen
2. Transport	air, rail, water, road (traffic management, intelligent transport systems)
3. Banking	credit institutions
4. Financial market infrastructure	trading venues, central counterparties
5. Health	healthcare providers, EU reference laboratories, pharmaceutical research, pharmaceutical manufacturing (NACE 21), critical medical devices
6. Drinking water	suppliers of water intended for human consumption
7. Waste water	collecting, disposing of or treating it as an essential part of the business
8. Digital infrastructure	internet exchange points, DNS, TLD registries, cloud, data centres, content delivery, trust services, public communication networks and services
9. ICT service management (B2B)	managed service providers, managed security service providers
10. Public administration	entities at federal and state level
11. Space	operators of ground infrastructure

Annex 2: other critical sectors	Examples of types of entity
1. Postal and courier services	postal service providers, courier services
2. Waste management	where waste management is the main activity
3. Chemicals	manufacture and wholesale of substances under REACH, articles made from them, NACE 20
4. Food	food businesses in wholesale and in industrial production and processing
5. Manufacturing	medical devices and in vitro diagnostics; NACE 26 electronics and optics, 27 electrical equipment, 28 machinery, 29 motor vehicles and parts, 30 other transport equipment
6. Digital providers	online marketplaces, search engines, social networks
7. Research	applied research or experimental development for commercial purposes, excluding educational institutions

The tables summarise; what counts is the wording of the annexes (Annexes 1 and 2 NISG 2026). For chemicals and manufacturing, the NACE code of the activity decides; your ÖNACE classification is in the classification notice from Statistics Austria (Federal Office, FAQ).

Main or secondary activity

As a rule it makes no difference whether the activity is the main or a secondary one. Only in some sectors do the annexes look at the main activity: energy, drinking water, waste water and waste management. Unlike Germany, Austria has no exception for "negligible" activities; even a small line of business can bring in the whole legal person (Federal Office, FAQ).

Questions that come up often

IT service providers: a "managed service provider" is anyone who provides services around the installation, management, operation or maintenance of ICT products, networks, infrastructure or applications, on the customer's premises or remotely § 3 no. 23 NISG 2026. Only services the entity operates and uses exclusively for itself are excluded (Annex 1 no. 9). There is no group privilege: an IT company that works with administrative access for other companies in its group is a managed service provider. Selling hardware and installing the operating system once usually isn't (FAQ).
Food: only businesses active in wholesale and in industrial production and processing are covered; the Federal Office reads this as both together (FAQ).
Solar panels and charging points: a business that generates electricity mainly for itself and feeds in the surplus is not a producer in the sense of the annex. Charging points in a company car park for staff only are not publicly accessible (FAQ).
Health: healthcare providers are covered, care homes are not; for residential facilities it depends on whether care or medical treatment predominates (FAQ).
Software as a service: a SaaS product offered on its own can be a cloud computing service, even if it runs on another provider's infrastructure (FAQ).

If your business is in one of these sectors, the next step is its size: lesson 1.3.

Checklist

We have listed every activity of our legal person, side businesses included.
We have compared each activity with Annexes 1 and 2.
We know our ÖNACE code and have compared it with divisions 20 and 26 to 30.
We have checked whether we manage or operate IT for others, within our group too.
We have written down which type of entity we would be, or why none.

Quiz

A machinery maker also runs the servers of two sister companies in its group, with administrator access. What applies?

Only the sister companies must register
Nothing: work within a group is exempt
Only machinery counts, because it is the main activity
It can also be covered as a managed service provider (Annex 1)

Show the answer

The answer is D: It can also be covered as a managed service provider (Annex 1). There is no group privilege, and except for energy, water, waste water and waste, a secondary activity counts too (Federal Office, FAQ; Annex 1 no. 9 NISG 2026).

Sources

This lesson's statements rest on:

Not legal advice. What counts is the NISG 2026 and the NISV 2026 in the Federal Legal Information System and Implementing Regulation (EU) 2024/2690 (read on 6 October 2026). Not covered are the special rules for banks and financial entities (DORA), for critical entities under the RKE Act, for domain name registration services and for the public administration. Not an offer of the Federal Office for Cyber Security, a CERT or the Chamber of Commerce.