Lesson 1.3 · 7 min
Medium-sized or large: working out the size
Open in the coursewith narrated slides, a checklist to tick off and a quiz
At a glance
- From 50 staff, or 10 and 10 million. A business is medium-sized if it has at least 50 staff, or more than €10 million annual turnover and also more than €10 million balance sheet total.
- From 250 staff, or 50 and 43 million. It is large with at least 250 staff, or more than €50 million turnover and also more than €43 million balance sheet total.
- In annual work units. Part-time counts proportionally. Apprentices and parental leave don't count. The last annual accounts are what matter.
- Linked and partner enterprises. Above 50 per cent ownership everything counts, from 25 per cent a share, abroad too. That makes many small subsidiaries medium-sized.
- Running your IT entirely independently. The group's figures are left out if the entity is organisationally, technically and operationally independent in its network and information systems.
In detail
The thresholds
Whether a business is medium-sized or large depends on staff, annual turnover and annual balance sheet total, calculated under Articles 1 to 6 of the Annex to SME Recommendation 2003/361/EC, without its Art. 3(4) § 25(1) NISG 2026.
| Staff | or: annual turnover | and also: balance sheet total | |
|---|---|---|---|
| large § 25(2) | at least 250 | over €50m | over €43m |
| medium-sized § 25(3) | at least 50 | over €10m | over €10m |
Watch the "or" and the "and": a business with 30 staff is medium-sized if turnover and balance sheet total are each above €10 million. A business with 50 staff is medium-sized even if its turnover is small. A business that is neither medium-sized nor large is covered only in the cases without a size threshold (lesson 1.4).
How to count
- Staff count in annual work units: part-time and seasonal work proportionally. Included are employees, people treated as employees, working owners and partners who work in the business regularly; not included are apprentices and periods of maternity or parental leave (Recommendation 2003/361/EC, Annex Art. 5; Federal Office, FAQ).
- Freelancers count if they are in effect employees, for instance because they are subordinate or economically dependent; genuinely self-employed people with several clients don't (FAQ).
- The reference date is the last annual accounts; turnover excludes VAT. Crossing a threshold, up or down, takes effect only once it has lasted two consecutive financial years. New businesses estimate in good faith (Recommendation, Annex Art. 4; FAQ).
Groups and shareholdings
The figures are not just your own company's (Recommendation, Annex Art. 3 and 6; Federal Office, FAQ):
| Relationship | Shareholding, roughly | What is added |
|---|---|---|
| autonomous | below 25% | nothing |
| partner enterprise | 25 to 50% | a share, in proportion to the holding |
| linked enterprise | over 50% or controlling influence | everything, at 100% |
This works both ways, for parent and subsidiary, and includes companies outside Austria and the EU (FAQ). A subsidiary with 35 staff in a group of 600 is therefore usually a large business.
The one exception
The figures of partner and linked enterprises are not added if the entity is organisationally, technically and operationally independent of them in the network and information systems it uses for its services § 25(4) NISG 2026. A business that shares IT, a network or an IT department with its group will hardly be able to rely on this. Write down why you claim the exception.
Checklist
- We have worked out staff in annual work units from the last annual accounts.
- We have turnover and balance sheet total from the last annual accounts.
- We have recorded every shareholding above 25 per cent, up and down, abroad too.
- We have compared the result with both thresholds.
- If we rely on § 25(4): the reasons are in writing.
Quiz
An autonomous limited company has 40 staff, €12m turnover and an €8m balance sheet total. Is it medium-sized?
- Yes, because turnover is above €10m
- Yes, because it has more than 25 staff
- No: under 50 staff, and the balance sheet total isn't above €10m
- The Federal Office decides
Show the answer
The answer is C: No: under 50 staff, and the balance sheet total isn't above €10m. § 25(3) NISG 2026: at least 50 staff, or turnover and balance sheet total both above €10m.
Sources
This lesson's statements rest on:
- Network and Information System Security Act 2026 (NISG 2026) § 25, Federal Legal Information System (RIS), in German, version of 6 October 2026
- Commission Recommendation 2003/361/EC, Annex Art. 1 to 6 (the SME definition), EUR-Lex (also in English)
- Federal Office for Cyber Security, FAQ: working out the size, in German (read on 6 October 2026)
- Federal Office for Cyber Security, FAQ: groups of companies, in German (read on 6 October 2026)
- Explanatory notes to the government bill for the NISG 2026 (308 d.B. XXVIII. GP), PDF, in German
Not legal advice. What counts is the NISG 2026 and the NISV 2026 in the Federal Legal Information System and Implementing Regulation (EU) 2024/2690 (read on 6 October 2026). Not covered are the special rules for banks and financial entities (DORA), for critical entities under the RKE Act, for domain name registration services and for the public administration. Not an offer of the Federal Office for Cyber Security, a CERT or the Chamber of Commerce.