Austria: technology regulation at a glance

Framework: EU Markets in Crypto-Assets Regulation (MiCAR, Reg. (EU) 2023/1114) implemented nationally by the MiCA-Vollzugsgesetz (MiCA-VG, in force 20 July 2024), supervised by the Austrian Financial Market Authority (FMA); supported by the FM-GwG (AML), the Income Tax Act (EStG §27b) and the Crypto Asset Reporting Act (Krypto-MPfG, in force 1 Jan 2026).

Crypto is fully legal in Austria and now sits inside a comprehensive, in-force EU framework. MiCAR has applied in full since 30 December 2024 and Austria designated the FMA as the sole competent authority via the MiCA-Vollzugsgesetz (20 July 2024); the FMA has already authorised major CASPs (e.g. Bybit EU, KuCoin EU, AMINA Bank) and existing Austrian VASPs must convert to MiCAR licences (transition window ends 1 July 2026, with services ceasing for unlicensed firms after 31 Dec 2025). Crypto income is taxed under a dedicated regime at 27.5% with KESt withholding by Austrian providers, and CARF/DAC8 reporting via the Krypto-MPfG took effect on 1 January 2026.

Framework: EU AI Act (Regulation (EU) 2024/1689), directly applicable; supplemented nationally by the KI-Servicestelle at RTR (KommAustria-Gesetz §20c / TKG 2021 §194a), the Austrian Data Protection Authority (DSB), and the AIM AT 2030 national strategy

As an EU member state, Austria is governed by the EU AI Act, which entered into force on 1 August 2024 with staged application (prohibitions from 2 February 2025, GPAI obligations from 2 August 2025, high-risk system rules by 2026/2027). Nationally, Austria has established the KI-Servicestelle (AI Service Desk) and KI-Beirat (AI Advisory Board) at telecom regulator RTR as the information and coordination hub, while the Datenschutzbehörde has claimed market-surveillance competence for biometric AI used in law enforcement; a full national implementation act naming all AI Act competent authorities is still pending. Austria also pursues a strategic layer through the AIM AT 2030 strategy and the Digital Austria Act 2.0 (adopted 2025), which prioritise trustworthy AI and digital sovereignty in the public sector.

Framework: EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) directly applicable, supplemented and implemented nationally by the Austrian Federal Data Protection Act (Datenschutzgesetz — DSG, BGBl. I Nr. 165/1999 as most recently amended by BGBl. I Nr. 70/2024). Supervised by the Austrian Data Protection Authority (Datenschutzbehörde — DSB).

Austria has a comprehensive personal-data protection regime built on the directly-applicable GDPR and the national DSG, which supplements the GDPR (constitutional right to secrecy of personal data in § 1 DSG, national derogations, processing of criminal data, and rules for authorities). The independent Datenschutzbehörde (DSB) is the primary supervisory authority under Art. 51 GDPR, and since 1 January 2025 a separate Parliamentary Data Protection Committee (Parlamentarisches Datenschutzkomitee) supervises legislative bodies. The framework is reinforced by directly-applicable EU instruments including the EU Data Act (applicable from 12 September 2025), the ePrivacy rules in the Austrian Telecommunications Act (TKG 2021), and NIS2/DORA.

Framework: Payment Services Act 2018 (Zahlungsdienstegesetz 2018 / ZaDiG 2018) transposing PSD2, E-Money Act 2010 (E-Geldgesetz 2010) transposing EMD2, and the Banking Act (BWG); supervised by the Financial Market Authority (FMA) with the Oesterreichische Nationalbank (OeNB) overseeing payment infrastructure.

Austria operates a clear, in-force licensing regime for payments and e-money as an EU member state, with PSD2 transposed via ZaDiG 2018 and e-money issuance regulated under the E-Geldgesetz 2010. The FMA is the sole competent authority for granting Payment Institution (PI) and Electronic Money Institution (EMI) licences, with EU passporting available and open banking obligations enforced through PSD2 RTS. The SEPA Instant Payments Regulation obligation to send/receive instant payments applied from October 2025, and the new Consumer Credit Act (VKrG 2026 / VerKrAG 2026) implementing EU Directive 2023/2225 brings BNPL within scope from 20 November 2026.

Framework: Settlement and Residence Act (Niederlassungs- und Aufenthaltsgesetz, NAG) administered by the Federal Ministry of the Interior (BMI); labour-market rules under the Employment of Foreign Nationals Act (AuslBG). No dedicated digital-nomad visa exists as of 2026.

Austria does not offer a dedicated digital-nomad or remote-work visa. Non-EU remote workers and relocators must fit into existing categories — most commonly the Red-White-Red Card for Self-Employed Key Workers, a freelance residence permit, or (for the financially self-sufficient) the 'Settlement permit — gainful employment excepted'. EU/EEA/Swiss citizens enjoy free movement and can live and work remotely without a special title.

Framework: EU Digital Services Act (Regulation (EU) 2022/2065), applied in Austria via the Digital Services Coordinator Act (Koordinator-für-digitale-Dienste-Gesetz, KDD-G) enacted through the DSA-Begleitgesetz; supervised by KommAustria (Austrian Communications Authority) with RTR-GmbH as the out-of-court dispute-resolution body. Content-related criminal offences and civil remedies are set out in the Hass-im-Netz-Bekämpfungs-Gesetz (HiNBG, in force since 1 Jan 2021).

Austria applies the fully harmonised EU DSA as its comprehensive online-platform and content-moderation regime, with the national KDD-G (in force 17 February 2024) designating KommAustria as the Digital Services Coordinator and providing enforcement, penalties, trusted-flagger certification, and dispute-resolution machinery. Austria's earlier national Communication Platforms Act (KoPl-G) was struck down by the CJEU in C-376/22 (9 Nov 2023) as incompatible with the E-Commerce Directive's country-of-origin principle and was repealed on 17 February 2024. A dedicated age-verification/minimum-age-for-social-media bill (minimum age 14) was announced for a June 2026 draft but is not yet in force.

Framework: Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026, BGBl. I Nr. 94/2025) transposing EU NIS2 Directive (2022/2555); currently NISG 2018 (NIS1) remains in force until 1 October 2026; supervised by the newly established Bundesamt für Cybersicherheit (BACS), with CERT.at as national CSIRT

Austria has a comprehensive cybersecurity regime built on EU law. The NISG 2018 (transposing NIS1) is currently in force covering ~1,000 designated operators of essential services, and will be replaced on 1 October 2026 by the NISG 2026, which transposes the NIS2 Directive after Austria's earlier NISG 2024 bill was rejected by the National Council in July 2024 and the country was subject to EU infringement proceedings. Sector-specific rules also apply, most notably the directly applicable EU DORA Regulation for the financial sector (supervised by the FMA since 17 January 2025).

Framework: Austrian Limited Liability Company Act (GmbHG) and Flexible Company Act (FlexKapGG, in force since 1 Jan 2024); Trade Regulation Act (GewO); Commercial Code (UGB). Company registration is handled via the Commercial Register (Firmenbuch) at competent regional courts; trade licences via the district authority through the Business Service Portal (USP/GISA).

Austria places no restrictions on foreign ownership — non-residents may fully own and manage a GmbH or the new FlexCo (FlexKapG). However, incorporation is still notary-based, requires a German-language notarised deed of formation, bank-deposited capital, and both Commercial Register and trade-licence registrations, so the process typically runs 3–4 weeks (World Bank benchmark: ~21 days, 8 procedures). A key constraint is that at least one managing director must be resident in the EEA or Switzerland; non-EEA founders also need a residence title permitting self-employment.