Austria

National transposition of the NIS2 Directive (EU) 2022/2555. The Bundesamt für Cybersicherheit is the competent authority (§ 3a), and essential and important entities report significant incidents under § 34, with the significance criteria in § 35. Published as BGBl. I Nr. 94/2025; § 51 brings the central provisions into force on the first of the month after nine months from promulgation, which gives 1 October 2026 on RIS's recorded promulgation date and agrees with the Interior Ministry's magazine.

National implementing act for Regulation (EU) 2024/3005 on ESG rating activities, published as BGBl. I Nr. 28/2026 on 23.04.2026 together with an amendment to the FMABG that makes the FMA the competent authority. Art. 10 of the act brings it into force on 2 July 2026, as the FMA also states.

Revised guide published in March 2025 for the FMA's supervised entities on how to consider sustainability risks in their business; the first version dates from 2020. The FMA describes it as guidance for supervised entities, not a binding rule.

Gives effect to the EU Digital Operational Resilience Regulation. § 2 designates the FMA as the competent authority; further sections cover supervisory powers (§ 4), cooperation between the FMA and OeNB (§ 5), penalties (§§ 7-8) and publication of sanctions (§ 10). RIS gives 17 January 2025 as the general entry into force. Enacted as BGBl. I Nr. 112/2024; no later amendment is listed.

National act giving effect to the EU Markets in Crypto-Assets Regulation. § 1 names the FMA as the competent authority under Art. 93(1) MiCAR; §§ 3-9 set supervisory powers, including ordering crypto-asset services provided without authorisation to stop; §§ 11-15 deal with administrative penalties and § 18 with publication of measures and sanctions. The FMA says it entered into force on 20 July 2024. BGBl. I Nr. 111/2024, last amended by BGBl. I Nr. 5/2026.

Sets the conditions under which persons may provide payment services commercially in Austria and cites Directive (EU) 2015/2366 (PSD2). The licensing chapter for payment institutions runs from § 7 to § 15 and § 18 covers safeguarding of customer funds. BGBl. I Nr. 17/2018, last amended by BGBl. I Nr. 59/2026.

Stock exchange act covering market infrastructure and regulated markets, reporting and publication duties, and insider information and market manipulation, with administrative penalties (for example § 154). Passed as BGBl. I Nr. 107/2017; the latest amendment in RIS is BGBl. I Nr. 62/2026.

Insurance supervision act. Section 1 lists the undertakings it covers: domestic insurance and reinsurance undertakings, small insurers and mutuals, third-country and EEA undertakings, insurance holding companies and special purpose vehicles. Enacted as BGBl. I Nr. 34/2015 and last amended by BGBl. I Nr. 6/2026.

Implements the eIDAS Regulation (EU) No 910/2014 (except Chapter II). A qualified electronic signature satisfies the written-form requirement of § 886 ABGB (§ 4(1)), and the Telekom-Control-Kommission is the supervisory body (§ 12). In force from 1 July 2016 (§ 20(1)); BGBl. I Nr. 50/2016. The RIS amendment list is inconsistent about the latest amending act.

Sets money laundering and terrorist financing prevention duties for obliged entities in the financial market: risk analysis (§ 4), customer due diligence (§§ 5-6), reporting to the Geldwäschemeldestelle (§ 16), record keeping (§ 21) and internal organisation (§ 23). The FMA states it has applied since 1 January 2017. RIS shows BGBl. I Nr. 118/2016 as the original text and BGBl. I Nr. 151/2024 as the latest amendment.

Establishes the BAK and, in § 4, its tasks: nationwide security and criminal police matters for listed corruption and abuse-of-office offences, international police cooperation, corruption research and prevention, and investigation of certain deaths and mistreatment allegations involving federal police personnel. BGBl. I Nr. 72/2009, in force from 1 January 2010 (§ 13); RIS lists BGBl. I Nr. 50/2025 as the latest amendment.

Lets a court hold a legal person or registered partnership liable for an offence committed for its benefit or in breach of its duties, whether by a decision-maker or by an employee where management failed to take reasonable care (§ 3). The court imposes a fine in daily rates of EUR 50 to 30,000 for ordinary associations (§ 4). BGBl. I Nr. 151/2005, last amended by BGBl. I Nr. 65/2025.

Sets up the FMA as an institution under public law responsible for banking, insurance, securities and pension fund supervision (§ 1); the FMA names it as the law under which it enforces the supervisory laws. FMA sanction notices cite § 22 Abs. 2b for the accelerated end of penalty proceedings and § 22c Abs. 1 Z 2 for publication. BGBl. I Nr. 97/2001, last amended by BGBl. I Nr. 28/2026.

National data protection act supplementing the directly applicable GDPR, as the DSB puts it. Original enactment BGBl. I Nr. 165/1999, latest amendment shown BGBl. I Nr. 50/2025, in the RIS consolidated version of 16.10.2026; it sets up the Datenschutzbehörde (2. Abschnitt) and contains administrative penalty provisions (§ 62).

Makes the Arbeitsinspektion the authority responsible for employee protection (§ 3) in workplaces of all kinds, subject to exclusions such as private households and public teaching institutions (§ 1). Its tasks include checking working time, rest periods and the employment of children, young people and pregnant women. The Arbeitsinspektorate report to the Zentral-Arbeitsinspektorat (§§ 14, 16). BGBl. Nr. 27/1993, last amended by BGBl. I Nr. 66/2026.

Makes the OeNB a stock corporation and Austria's central bank within the European System of Central Banks (§ 2). Its legal relations are governed by the TFEU, the ESCB/ECB Statute and this act, with the Aktiengesetz 1965 applying otherwise (§ 1). It gives the OeNB the exclusive right to issue banknotes that are legal tender in Austria (§ 4(2)). BGBl. Nr. 50/1984, last amended by BGBl. I Nr. 7/2026.