🇦🇹Austria

Overview

Austria's approach to AI regulation is marked by a comprehensive and forward-looking strategy, prioritizing the development and deployment of AI systems that are human-centered, trustworthy, and aligned with European values and fundamental rights. The nation views AI as a critical driver for economic competitiveness, research excellence, and public service modernization, while simultaneously addressing potential risks and societal impacts. This philosophy is articulated across several key policy documents, including the Artificial Intelligence Mission Austria 2030 (AIM AT 2030) and its subsequent Implementation Plan 2024, which collectively establish a high-level, agile roadmap for AI governance and adoption.A central tenet of Austria's strategy is digital sovereignty, aiming to reduce dependencies on non-European proprietary providers and strengthen European supply chains, particularly within the public sector. This is evident in the Digital Austria Act 2.0, which mandates measures for robust digital infrastructure, open standards, and the development of sovereign AI services for administrative use. Furthermore, Austria places significant emphasis on building digital competencies across all segments of society, from basic digital literacy to specialized AI skills, as outlined in the Digital Skills Initiative. This holistic approach underscores a commitment to fostering an informed citizenry capable of interacting safely and critically with AI-enabled services, while also nurturing a skilled workforce for the AI economy.

Regulatory approach

Austria's regulatory approach to AI is predominantly characterized by a blend of strategic policy frameworks and preparatory legislative measures, with a strong emphasis on soft law and guidance in anticipation of the binding EU AI Act. The initial phase has focused on establishing a robust governance architecture, fostering dialogue, and building national capacity rather than imposing immediate, standalone statutory regulations with direct penalties. This is exemplified by the KI-Maßnahmenpaket (AI measures package), which announced the establishment of the AI Service Desk (KI-Servicestelle) and a mandatory AI labelling concept, primarily as preparatory steps for EU-level compliance.The country adopts a risk-based orientation, mirroring the EU AI Act's framework, by categorizing AI systems based on their potential impact on fundamental rights, health, and safety. While direct national AI-specific binding statutes are limited, existing laws (e.g., data protection, procurement) are being adapted or interpreted to integrate AI considerations. The Digital Austria Act 2.0, for instance, proposes concrete amendments to procurement practices to embed digital sovereignty criteria, including exploring a "sovereignty bonus" for European or open-source solutions. This approach allows for flexibility and iterative refinement, ensuring that national measures remain agile and responsive to rapid technological advancements and evolving international standards, particularly those emanating from the European Union. Austria has established a multi-layered governance architecture for AI, primarily driven by policy and coordination, with specific bodies tasked with advisory, informational, and preparatory roles for future enforcement. The Federal Chancellery (Bundeskanzleramt), particularly its Digitalisation and E-Government section, plays a central strategic and coordinating role in developing and overseeing national digital and AI strategies, such as the Digital Austria Act 2.0 and the Digital Decade roadmap. It leads inter-ministerial coordination bodies like the AI Policy Forum and receives semi-annual implementation reports, ensuring alignment across federal ministries.The Rundfunk und Telekom Regulierungs-GmbH (RTR) hosts the KI-Servicestelle (AI Service Office), which was formally established through statutory amendments in early 2024. The Servicestelle acts as a central information and advisory hub, building competence for AI applications, providing guidance on regulatory frameworks (especially the EU AI Act), publishing studies, and coordinating the KI-Beirat (AI Advisory Board). While primarily an advisory and informational entity, its work explicitly supports national implementation of the EU AI Act and complements future enforcement by designated national authorities. The KI-Beirat itself is an eleven-member expert advisory body that provides independent advice to the Federal Government and RTR on technical, ethical, and societal developments in AI, assisting in policy prioritization and strategy development.Other key actors include the Austrian Data Protection Authority (Datenschutzbehörde, DSB), which has a statutory advisory and evaluative role under the Informationsfreiheitsgesetz, ensuring that information disclosures respect personal data rights and publishing guidance on data protection in the context of AI. The Austrian Research Promotion Agency (FFG) is crucial for implementing funding initiatives like "AI for Green," supporting AI research and development projects that align with national climate and innovation priorities. Furthermore, the OeAD (Austria's Agency for Education and Internationalisation) hosts the Digital Skills Office, coordinating efforts to enhance digital and AI literacy across the population.

Enforcement & penalties

Austria's current framework for penalties and enforcement in the AI domain largely relies on existing administrative and sectoral laws, with a strong anticipatory focus on the forthcoming EU AI Act. As many of Austria's AI-related regulations are policy documents (e.g., AIM AT 2030, Digital Austria Act 2.0, KI-Umsetzungsplan 2024), they primarily establish administrative tasks, reporting obligations, and coordination expectations within government rather than direct statutory sanctions for AI non-compliance. However, non-compliance with administrative conditions for publicly funded projects or grants, such as those under the "AI for Green" initiative, may trigger standard public funding rules, including repayment, project suspension, or termination.The establishment of the KI-Servicestelle at the RTR is a preparatory step towards robust enforcement. While the Servicestelle itself is an advisory body, the government has announced a two-step approach: the Servicestelle will eventually transition into a dedicated national AI authority responsible for market surveillance, conformity assessment, and certification duties once the EU AI Act becomes fully applicable. This future national AI authority will then be empowered to impose the significant fines and sanctions stipulated by the EU AI Act for non-compliance, particularly for high-risk AI systems. For general data protection breaches, the existing GDPR framework, enforced by the Austrian Data Protection Authority (DSB), already provides for substantial administrative fines. The Informationsfreiheitsgesetz, while not containing direct administrative fines for non-compliance by authorities, relies on judicial review, reputational pressure, and administrative follow-up, with appeals against negative decisions available to administrative courts.

Data protection

Austria's data protection framework is robust and deeply integrated with the European Union's General Data Protection Regulation (GDPR). The Austrian Data Protection Authority (DSB) serves as the national supervisory authority, ensuring compliance with GDPR principles and national data protection laws. This means that any AI system developed or deployed in Austria, especially those processing personal data, must adhere to stringent requirements concerning data minimization, purpose limitation, transparency, data subject rights (e.g., access, rectification, erasure), and security measures. The DSB actively advises on and evaluates the application of data protection rules, including in the context of new legislation.Complementing the GDPR, Austria's Datenstrategie für Österreich (Data Strategy for Austria) emphasizes responsible data use, the development of sustainable data infrastructures, and the activation of data potential across administration, science, and business, all while strictly adhering to data protection and fundamental rights safeguards. It highlights the need to open access to "protected" public data for research and innovation through secure, governed processes. Furthermore, the Informationsfreiheitsgesetz, while promoting transparency, foresees close coordination with data protection rules to ensure that the disclosure of public information respects personal data rights and legitimate confidentiality grounds. There are no explicit data localization requirements beyond what is mandated by GDPR for international data transfers, but the Digital Austria Act 2.0's focus on "souveräne Cloud" (sovereign cloud infrastructure under European jurisdiction) for sensitive public data indirectly promotes data residency within the EU.

Sector-specific rules

While Austria's AI regulatory approach is largely horizontal, several policy documents and initiatives outline sector-specific considerations and applications for AI, particularly within public administration, media, telecommunications, and environmental sectors.In public administration and citizen services, the Digital Austria Act 2.0 mandates the development of a shared large-language-model service for administrative use and tasks AI governance bodies to coordinate responsible AI deployment, aligning national oversight with the European AI regulatory architecture. The KI-Umsetzungsplan 2024 also sets out measures to make public services more efficient using AI, such as chatbots and translation tools, while emphasizing transparency and quality standards. For the media, telecommunications, and post sectors, the KI-Servicestelle, hosted at the RTR, is specifically mandated to provide information and advisory services relevant to these areas, supporting stakeholders in understanding and implementing AI regulatory obligations. This includes guidance on technical documentation, user information, cybersecurity, and data protection for AI deployments within these critical infrastructures.In the environmental and climate sector, the "AI for Green" funding initiative is a dedicated program to accelerate research and development of AI technologies that contribute directly to climate mitigation, adaptation, and broader environmental objectives. This initiative supports projects across energy, mobility, agriculture/forestry, and manufacturing, requiring applicants to integrate European AI ethics and regulatory guidance, including considerations for energy- and resource-efficient AI design. The KI-Umsetzungsplan 2024 further includes measures to foster AI adoption in agriculture, such as an Agricultural Data Space and competence center. While explicit "rules" are often in the form of funding conditions or policy guidelines, these sector-specific initiatives demonstrate a clear intent to apply AI strategically while addressing unique sectoral challenges and ethical considerations.

International alignment

Austria's AI regulatory strategy is profoundly shaped by its strong commitment to international alignment, particularly with the European Union's digital agenda. A cornerstone of this alignment is the proactive preparation for the national implementation of the EU AI Act. The Strategy of the Federal Government for Artificial Intelligence – Implementation Plan 2024 explicitly references and prepares for this, designating institutional arrangements and preparatory steps for national oversight bodies. The KI-Servicestelle, established within the RTR, is specifically tasked with supporting stakeholders in understanding their obligations under the EU AI Act and providing guidance to facilitate compliance. Furthermore, the KI-Maßnahmenpaket announced a two-step approach for national institutional capacity, with the Servicestelle eventually transitioning into a dedicated national AI authority to fulfill market surveillance and enforcement duties under the EU AI Act.Beyond the AI Act, Austria actively aligns with broader EU digital initiatives, such as the EU Digital Decade Policy Programme. The Nationaler strategischer Fahrplan für die Digitale Dekade Österreich (National strategic roadmap for the Digital Decade) establishes Austria’s national trajectory toward the EU’s 2030 digital targets, covering digital skills, infrastructure, business transformation, and public services, with biannual updates and progress reporting to the European Commission. The Datenstrategie für Österreich also situates Austria within European initiatives like the Data Governance Act, Gaia-X, and European Data Spaces, committing to international alignment and participation to ensure cross-border interoperability and legal consistency. Austria's policies consistently emphasize human-centered, trustworthy AI, reflecting principles laid out by organizations like the OECD, which are often referenced in national strategy documents like AIM AT 2030. This comprehensive international alignment ensures that Austria's national AI framework is not developed in isolation but is harmonized with broader European and global standards and values.

What's next

Austria's AI regulatory landscape is dynamic, with several key future developments anticipated, primarily driven by the ongoing implementation of national strategies and the overarching influence of the EU AI Act. A significant focus will be the evolution of the KI-Servicestelle into a fully empowered national AI authority. The KI-Maßnahmenpaket explicitly outlines this two-step approach, with the Servicestelle's current advisory role preparing the ground for future market surveillance, conformity assessment, and certification duties once the EU AI Act becomes fully applicable. This transition will involve further legislative and administrative adjustments to grant the necessary enforcement powers and resources to the designated body, ensuring Austria can effectively implement the binding provisions of the EU AI Act.Ongoing updates and refinements to existing policy frameworks are also expected. The Artificial Intelligence Mission Austria 2030 (AIM AT 2030) is designed as an agile, living document, with iterative evaluations and periodic updates coordinated by the AI Policy Forum. Similarly, the Nationaler strategischer Fahrplan für die Digitale Dekade Österreich commits to biannual updates and progress reporting to the European Commission, allowing for adjustments to national trajectories based on evolving EU targets and technological advancements. The Datenstrategie für Österreich also foresees legal and technical follow-up, including the potential for a national Data Access Act (Datenzugangsgesetz) and sectoral regulatory updates, to give certain strategic elements binding force. These continuous adaptation mechanisms underscore Austria's commitment to maintaining a responsive and effective AI governance framework that can address emerging challenges and opportunities in the rapidly evolving field of artificial intelligence.