Austria AI Regulation Overview

Overview

Austria's regulatory landscape for artificial intelligence is characterized by non-binding national strategic frameworks, policy action plans, and targeted statutory amendments designed to prepare the country for European Union harmonization. The overarching strategy is anchored by foundational policy documents including the Artificial Intelligence Mission Austria 2030 (AIM AT 2030) and its updated KI-Umsetzungsplan 2024, alongside cross-governmental digital initiatives such as the Digital Austria Act and the Digital Austria Act 2.0. These frameworks prioritize human-centred, trustworthy AI deployment, public sector efficiency, research excellence, and technological sovereignty.

Complementing these strategic initiatives, Austria has enacted targeted legal amendments and established key institutional structures to operationalize national AI oversight and support compliance. In early 2024, federal amendments to the KommAustria-Gesetz (KOG § 20c) and the Telekommunikationsgesetz 2021 (TKG § 194a) via BGBl. I Nr. 6/2024 established the KI-Servicestelle (AI Service Office) housed within the Rundfunk und Telekom Regulierungs-GmbH (RTR), as well as an independent 11-member expert advisory board, the Beirat für Künstliche Intelligenz (KI-Beirat). Broader data governance and administrative transparency are supported by the Informationsfreiheitsgesetz (IFG) and the Datenstrategie für Österreich.

Regulatory Approach

Austria adopts a hybrid, soft-law-first regulatory approach supported by targeted statutory coordination and preparatory administrative bodies. Rather than passing a standalone, comprehensive domestic AI statute with distinct liability regimes, Austria relies on interministerial strategies, ministerial action plans, competence-building programs, and targeted R&D funding (such as the AI for Green funding initiative) to guide AI development and deployment in alignment with European rules.

This framework integrates horizontal principles—such as risk management, fundamental rights safeguards, transparency, and digital sovereignty—with operational tools like mandatory digital-readiness assessments ("Digi-Checks") for new legislation and the development of a "Souveränitätskompass" (Sovereignty Compass). Austria's regulatory focus centers on risk-based alignment with the EU AI Act, public sector lead-by-example deployments, transparency through AI labelling initiatives ("Kennzeichnungspflicht"), and structured advisory services provided through central competence hubs.

Key AI Legislation

• Informationsfreiheitsgesetz (IFG) (BGBl. I Nr. 5/2024): Enacts a constitutional framework for access to official information, replacing official secrecy ('Amtsverschwiegenheit') with a proactive publication duty via data.gv.at and a statutory right to request information from public bodies.
• KommAustria-Gesetz (KOG) & Telekommunikationsgesetz 2021 (TKG) Amendments (BGBl. I Nr. 6/2024): Inserted § 20c KOG and § 194a TKG 2021 to statutorily establish the KI-Servicestelle at RTR and mandate the creation of the expert KI-Beirat to advise the Federal Government and RTR on AI developments and EU AI Act coordination.
• Digital Austria Act 2.0 (2025): Strategic policy framework setting measures for public administration digital sovereignty, open-source adoption, a sovereign cloud and PaaS architecture inside the BRZ, a shared administrative LLM service, and embedding sovereignty criteria in procurement (§ 20 BVergG).
• KI-Umsetzungsplan 2024 (2024): Implementation supplement to AIM AT 2030 detailing 47 concrete ministry-level measures to operationalize trustworthy AI, prepare for national execution of the EU AI Act, build the AI Hub Austria, and expand sectoral pilots.
• Digital Austria Act (2023): Whole-of-government digital work program consolidating 117 measures and 36 principles, establishing mandatory Digi-Checks for new laws, cybersecurity coordination, and public data strategy goals.
• Artificial Intelligence Mission Austria 2030 (AIM AT 2030) (2021): Austria's baseline national AI strategy outlining an agile roadmap for trustworthy AI, R&D positioning, economic competitiveness, and public sector modernization.
• Datenstrategie für Österreich (2024): Strategic national framework setting 45 measures to expand machine-readable metadata on data.gv.at, enable governed reuse of protected public data, and formalize public-sector data stewardship roles.
• KI-Maßnahmenpaket (2023): Policy package introducing the RTR KI-Servicestelle, an AI labelling/notification concept ("Kennzeichnungspflicht"), and targeted population-wide AI literacy measures.
• Digital Skills Initiative (Digitale Kompetenzoffensive - DKO) (2023): National competence strategy adopting the DigComp 2.3 AT reference model and establishing a Digital Skills Office at OeAD to coordinate workforce upskilling and AI literacy programs.
• Nationaler strategischer Fahrplan für die Digitale Dekade Österreich (2023): Strategic roadmap laying out 16 target paths and 66 lead measures aligned with EU Digital Decade 2030 objectives.
• AI for Green (2021): Dedicated national funding line under FFG's 'AI Ökosysteme' supporting R&D projects that apply trustworthy, energy-efficient AI to climate and environmental goals.

Governance & Enforcement Bodies

Institutional governance for AI in Austria is structured across interministerial steering groups, independent advisory councils, and specialized public administrative bodies. The Rundfunk und Telekom Regulierungs-GmbH (RTR) hosts the KI-Servicestelle, serving as a central public information, support, and guidance desk for AI regulation, technical documentation standards, and EU AI Act preparedness. Administrative supervision over the RTR's KI-Servicestelle activities is divided under § 18 Abs. 3a KOG among the Chairman of KommAustria (media regulatory aspects), the Federal Chancellor (general service tasks), and the Federal Minister for Finance (telecommunications and post).

Independent expert advice is provided by the 11-member Beirat für Künstliche Intelligenz (KI-Beirat), which counsels the Federal Government and RTR on legal, ethical, societal, and technological AI trends. Whole-of-government policy alignment is coordinated through the AI Policy Forum and the Federal Chancellery (Digitalisation section). Operational delivery relies on specialized entities, including the Bundesrechenzentrum (BRZ) for sovereign public cloud and shared LLM infrastructure, and the Digital Skills Office at OeAD for national skills frameworks.

Penalties & Enforcement

Because Austria's primary AI framework consists of strategic policy documents, ministerial action plans, and advisory service hubs—such as the Digital Austria Act 2.0, AIM AT 2030, Datenstrategie für Österreich, and the KI-Beirat—these instruments do not themselves establish standalone statutory administrative fine schemes or compulsory enforcement powers. Governance relies on administrative oversight, reporting requirements to the Federal Chancellery and Nationalrat, contractual conditions attached to public R&D grants, and procurement guidance under revised public procurement rules (§ 20 BVergG).

Statutory enforcement and binding penalties for AI systems will predominantly follow the harmonized enforcement regime of the EU AI Act once fully applicable, executed by designated national competent authorities and market surveillance bodies. Regarding administrative information access, the Informationsfreiheitsgesetz (IFG) provides judicial remedies through administrative court appeals (Verwaltungsgerichte) against authorities that deny information requests, rather than administrative monetary fines. Statutory protections against unlawful disclosure of protected official data remain codified under § 310 of the Austrian Criminal Code (StGB).

Data Protection Framework

Data governance and privacy obligations in AI deployments are anchored in European General Data Protection Regulation (GDPR) requirements and overseen by the national Data Protection Authority (Datenschutzbehörde, DSB). Under the Informationsfreiheitsgesetz (IFG), the DSB holds a statutory role (§ 15 IFG) to advise public bodies, issue guidance on handling personal data redactions, and evaluate the practical application of information access rules.

To support AI innovation while safeguarding protected personal or commercial information, the Datenstrategie für Österreich outlines framework mechanisms for governing "protected public data." This includes establishing secure processing environments (enclaves), appointing designated data stewards across federal administration, expanding discoverable metadata on data.gv.at, and aligning national data access legislation (Datenzugangsgesetz) with the EU Data Governance Act.

Sector-Specific Rules

Sector-specific AI guidelines and initiatives are operationalized through targeted ministerial projects detailed in the KI-Umsetzungsplan 2024 and related sectoral programs. In education and public administration, measures include piloting AI learning software in 100 schools, incorporating AI objectives into university performance agreements (2025–2027), and deploying administrative chatbots, translation tools, and document analysis systems under strict transparency standards.

In agriculture and environmental sectors, Austria has established specialized measures, including an Agricultural Data Space, a sector competence centre, and the AI for Green R&D funding program administered by the FFG and BMK to support energy optimization and sustainable AI model design. In media and telecommunications, regulatory oversight and sector guidance fall under the remit of RTR and KommAustria to ensure AI applications uphold media plurality and communication standards. The corpus contains no record of dedicated standalone domestic statutes governing financial AI, autonomous vehicles, or AI in employment.

International Alignment

Austria's AI regulation and digital transformation strategies are explicitly aligned with European Union regulatory frameworks and international benchmarks. Key national policy documents, including AIM AT 2030, the KI-Umsetzungsplan 2024, and the KI-Maßnahmenpaket, explicitly incorporate the EU AI Act's risk classifications, documentation standards, and compliance timelines, positioning national bodies like the RTR KI-Servicestelle to assist domestic deployers and providers with EU compliance.

Furthermore, national strategic targets are integrated into broader European and international initiatives. The Nationaler strategischer Fahrplan für die Digitale Dekade Österreich links 66 lead measures directly to the EU Digital Decade 2030 targets and Digital Compass metrics. Austria's Digital Skills Initiative adopts the European DigComp model (as DigComp 2.3 AT), and national R&D strategies support active participation in European multi-country projects such as EuroHPC and semiconductor initiatives.

Future Developments

Austria's strategic roadmap foresees an evolutionary expansion of national institutional oversight and technical infrastructure. As outlined in the KI-Maßnahmenpaket and KI-Umsetzungsplan 2024, the RTR-hosted KI-Servicestelle represents an initial advisory phase, with plans to build out or transition into a fully empowered national AI authority responsible for market surveillance, conformity assessment, and enforcement once required under the EU AI Act framework.

In public data infrastructure, the Digital Austria Act 2.0 sets specific milestones, including connecting all public register data to the Austrian Micro Data Center (AMDC) by 1 July 2026 to facilitate sovereign AI services. Additional upcoming steps include deploying a shared large language model (LLM) service for public administration, implementing the "Souveränitätskompass" across ministries, updating procurement rules under § 20 BVergG to evaluate digital sovereignty, and conducting biannual progress updates on the Digital Decade roadmap.

Enforcement Bodies