Operates a social platform, in Austria

AMD-G § 54e (BGBl. I Nr. 84/2001) · Read the law's page

• Applies to the provider of a video-sharing platform established in Austria.
• Subject content of gratuitous violence, and content that mainly consists of the unreflective depiction of sexual acts, to effective access control by age verification.
• Make content that can impair the development of minors available only in a way that minors do not usually follow it, for example through parental control systems.
• Give users an easy function to rate that content.
• Offer users a transparent procedure to complain about inadequate implementation of these duties.

UrhG, BGBl. Nr. 111/1936, §§ 18c, 89a-89c · Read the law's page

• If you are a provider of a large online platform as section 18c defines it, obtain the permission of authors and neighboring-right holders for the works your users upload (sections 18c and 89a(1)).
• To avoid liability for an unauthorized use, show that, in light of proportionality, you made all efforts to obtain permission, made all efforts under high industry standards of professional diligence to keep unavailable the specific works for which rightsholders gave you relevant and necessary information, and acted without delay on a sufficiently substantiated notice from a rightsholder to block access to the work or remove it, and made all efforts to prevent its future upload (section 89a(1)).
• If your service has been available to the public in the Union for less than three years and your annual turnover does not exceed 10 million euro, you need only make all efforts to obtain permission and act without delay on a sufficiently substantiated notice by blocking access to the work or removing it; once your average monthly visitors exceed five million, you must also show that you made all efforts to prevent future upload of the works reported to you (section 89a(3)).
• Do not apply measures that make lawfully uploaded works unavailable, including works whose use is allowed under an exception or limitation, and do not identify individual users except in line with Directive 2002/58/EC and the GDPR (section 89b(1)).
• Make adequate information on how your measures work easy to find on your website and in your terms (section 89b(2)).
• Do not use automated means to block access to, or remove, a small excerpt of a work: where the user combines works of third parties to less than half with own content and the use of these parts does not exceed 15 seconds of a film, 15 seconds of a soundtrack, 160 characters of a text, or a photograph or graphic of 250 kilobytes; the exception is automated measures where the rightsholder shows for a specific period that without temporary measures the economic exploitation of the work would be significantly impaired and other provision is made so that permitted uses are not prevented (section 89b(3)).
• Where a user asserts before or at upload that the use is permitted, in particular for caricature, parody, pastiche or quotation, make the content accessible and inform the rightsholder, unless the assertion is immediately recognizable as abusive, and offer users online forms with instructions for that assertion (section 89b(4)).
• Set up a complaint procedure that lets users take effective and swift action, with reasons, against an unjustified block or removal: complaints can be filed through easy-to-find, always-available functions; complaints are handled without delay; the complaint respondent's statement is obtained without delay and the user is told of it; decisions are subject to human review and the user is told the result without delay; and procedures can as a rule be completed within two weeks (section 89b(5)).
• Where a user substantiates in the complaint procedure that the upload was permitted or that the complaint respondent lacks the claimed rights, ask the respondent for a statement without delay; if the respondent does not respond without delay or responds manifestly insufficiently, make the work accessible (section 89b(6)).

TIB-G, BGBl. I Nr. 80/2023, §§ 1-9 · Read the law's page

• As a hosting service provider, register without delay for delivery through a delivery service under sections 28b and 35 of the Zustellgesetz and state at registration that there are no periods in which delivery is excluded, so that removal orders can be handled securely and quickly (section 5).
• Send KommAustria, by 1 February of each year, your transparency report based on the requirements of Article 7(3) of Regulation (EU) 2021/784 (section 6(1)).
• After receiving a removal order from KommAustria, or from the authority of another Member State, remove the terrorist content or disable access to it in all Member States as soon as possible and in any case within one hour (section 7(3) Z 1 and 2).
• Comply with the other duties of Regulation (EU) 2021/784 that section 7(1) and (2) make administrative offences to breach: informing the authority of removal or blocking (Article 3(6)); restoring content after a decision finding a removal order infringing (Article 4(7)); terms-of-service provisions and specific measures (Article 5(1) to (3)) and a decision under Article 5(6); reporting on specific measures (Article 5(5)); preserving removed content and data with technical and organizational safeguards (Article 6); a policy on terrorist content in your terms of service and a transparency report (Article 7(1) to (3)); an effective complaint mechanism and informing the complainant (Article 10(1) and (2)); informing content providers (Article 11(1) to (3)); notifying law enforcement of an imminent threat to life (Article 14(5)); a contact point for removal orders (Article 15(1)); and a designated legal representative (Article 17(1), (2) and (4)).

ABGB, JGS Nr. 946/1811, § 20 Abs. 3 · Read the law's page

• Keep the conditions for the exclusion of responsibility under Articles 5 and 6 of Regulation (EU) 2022/2065 satisfied: an intermediary that meets them can be sued for an injunction or removal over an infringement of a personality right committed through its service only after a warning (Abmahnung).
• A provider of a mere conduit service within the meaning of Article 4 of Regulation (EU) 2022/2065 is not treated as an intermediary under this provision.

ECG, BGBl. I Nr. 152/2001, §§ 13-14 · Read the law's page

• On the order of a domestic court, give the court all information that allows the users of your service with whom you have agreements to transmit or store information to be identified, where that serves the prevention, investigation, clarification or prosecution of court-punishable offences (section 13(1)).
• On the order of a domestic administrative authority, give the authority the names and addresses of the users of your service with whom you have such agreements, where knowing them is an essential prerequisite for the authority's tasks (section 13(2)).
• On the request of a third person who shows an overriding legal interest in establishing the identity of a user and of a specific unlawful matter, and who also makes credible that the information is an essential prerequisite for pursuing a legal claim, give that person the user's name and address (section 13(3)).

KDD-G, BGBl. I Nr. 182/2023, §§ 1-10 · Read the law's page

• As a provider of an intermediary service, comply with Articles 9(1) and (5), 10(1) and (5), 11(1) to (3), 12(1) and (2), 13(1), (2) and (4), 14(1) to (4) and 15(1) and (2) of Regulation (EU) 2022/2065; section 5(1) KDD-G makes a breach of each of these an administrative offence.
• As a provider of hosting services, including an online platform, comply with Articles 16(1), (2), (4), (5) and (6), 17(1) and (4) and 18(1) of Regulation (EU) 2022/2065; section 5(2) KDD-G makes a breach of each of these an administrative offence.
• As a provider of an online platform or online search engine, subject to Article 19 of Regulation (EU) 2022/2065, comply with Article 24(2) and (3); section 5(3) KDD-G makes a breach an administrative offence.
• As a provider of an online platform, subject to Article 19 of Regulation (EU) 2022/2065, comply with Articles 20 (including paragraphs 3 to 6), 21(1), 22(1), 23(1), (2) and (4), 24(1), 25(1), 26(1) to (3), 27(1) to (3), 28(1) and (2) and 86(2); section 5(4) KDD-G makes a breach of each of these an administrative offence.
• As a provider of an online platform that allows consumers to conclude distance contracts with traders, subject to Article 29 of Regulation (EU) 2022/2065, comply with Articles 30(1), (2), (3), (5), (6) and (7), 31(1) to (3) and 32(1) and (2); section 5(5) KDD-G makes a breach of each of these an administrative offence.
• As a provider of a very large online platform or very large online search engine, comply with Article 14(5) and (6) of Regulation (EU) 2022/2065; section 5(6) KDD-G makes a breach an administrative offence.
• Comply with a measure or decision that KommAustria issues in exercising its investigation or enforcement powers under Article 51 of Regulation (EU) 2022/2065; section 5(7) KDD-G makes non-compliance an administrative offence.
• Cooperate in determining your turnover or income, and give KommAustria on request the information it needs within a reasonable time (section 6(3) KDD-G).

UrhG, BGBl. Nr. 111/1936, § 81 Abs. 1a · Read the law's page

• Keep the conditions for the exclusion of responsibility under Articles 4 to 6 of Regulation (EU) 2022/2065 satisfied: an intermediary that meets them can be sued for an injunction over an infringement of an exclusive right under the Urheberrechtsgesetz committed through its service only after a warning (Abmahnung).

PolWG, BGBl. I Nr. 21/2026, §§ 1-11 · Read the law's page

• As a publisher of political advertising, provide each political advertisement in the manner, and with all the information, that Article 11(1)(a) to (e) of Regulation (EU) 2024/900 and Implementing Regulation (EU) 2025/1410 prescribe, make sure the information on where the transparency notice can be retrieved is correct (Article 11(2)), and make sure the transparency notice contains the information Article 12(1)(a) to (m) and (2) lists, complete and correct, stays available in the prescribed manner and for the prescribed time (Article 12(3)) and is kept for the retention period (Article 12(4) and (5)); section 6(3) PolWG makes a breach of each of these an administrative offence.
• As a publisher of political advertising, give access to the information Article 13(3) of Regulation (EU) 2024/900 names when you block or remove a political advertisement, archive political advertisements published through an online service as Article 13(4) provides and on time, and where Article 14 applies include the information in an annex to the management report and give it to KommAustria (Article 14(1) and (2)); section 6(3) PolWG makes a breach of each of these an administrative offence.
• As a publisher of political advertising, have a notification procedure that meets Article 15(1) to (4) of Regulation (EU) 2024/900, meet the obligations under Article 15(6), process a notification within the time Article 15(7) sets, provide information on remedies (Article 15(8)) and meet the duty to inform without delay (Article 15(9)); section 6(3) PolWG makes a breach of each of these an administrative offence.
• As a publisher of political advertising, do not continue to provide a political advertisement once you have found or been told that the information in its transparency notice is incomplete or incorrect (Article 12(2), fifth subparagraph); section 6(6) Z 1 PolWG makes a breach an administrative offence.
• As a very large online platform or very large online search engine under Article 33 of Regulation (EU) 2022/2065, make sure every political advertisement is archived and made accessible in the content and for the time Article 13(2) of Regulation (EU) 2024/900 prescribes, have a notification procedure that meets Article 15(1) to (4) and meet the obligations under Article 15(5); section 6(6) Z 2 and 3 PolWG makes a breach an administrative offence.
• As a provider of political advertising services, comply with the duties of Articles 5(1) and (2), 6(2), 7(1), (2), (4) and (5), 9(1) to (3), 10(1) and (2), 16(1) to (5), 17(1), (3) and (5) and 21(1) and (3) of Regulation (EU) 2024/900 that section 6(1) and (5) PolWG list; a breach of each is an administrative offence.
• As a sponsor, make a truthful declaration (Article 7(1), second sentence), give complete and correct information and keep it updated (Article 7(3)), correct a declaration when asked (Article 7(4), second sentence) and pass on the information Article 9(1)(a) to (f) names to the publisher where it is the only provider of political advertising services (Article 10); section 6(2) PolWG makes a breach of each of these an administrative offence.
• As a controller, take appropriate measures to transmit free of charge the information Article 19 of Regulation (EU) 2024/900 names (Article 20); section 6(4) PolWG makes a breach an administrative offence.

NISG 2026, BGBl. I Nr. 94/2025, §§ 24, 25, 28 und 32 · Read the law's page

• Implement technical, operational and organisational risk-management measures, appropriate and proportionate to the risk, to reduce risks to the network and information systems you use for your operations or to provide your services, and to prevent or minimise the impact of a cybersecurity incident on your users and on other services.
• Cover at least: risk analysis and information-system security concepts; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security; security in the acquisition, development and maintenance of your systems, including vulnerability management and disclosure; effectiveness-assessment policies; basic cyber-hygiene practices and training; cryptography and, where appropriate, encryption policy; personnel security, access control and asset management; and multi-factor or continuous authentication.
• Have your management body implement and oversee these measures and attend cybersecurity training designed for it, and offer your staff regular training.
• Register with the Bundesamt für Cybersicherheit within three months of this duty applying (by 1 January 2027), and self-declare the risk-management measures you have implemented within twelve months of the day your duty to register arises (1 October 2026 for an entity already covered), not of the day you register; once the Bundesamt first asks for proof of operative and organisational implementation, which it cannot do before two years after this duty applies, give that proof within two months if you are an essential entity (Section 33).
• It binds a wesentliche Einrichtung (essential entity) or wichtige Einrichtung (important entity) under Section 24, which reaches an online marketplace, an online search engine and a social-networking-services platform provider expressly (Section 28(2)(2)) at the medium-enterprise threshold of Section 25 (at least 50 employees, or turnover and balance-sheet total each over EUR 10 million) or above; the wider sector classes Section 24 also reaches (energy, transport, banking, financial-market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT-service management, public administration, space, postal and courier services, waste management, chemicals, food, and manufacturing) are reached too, by declaring that you are an essential or important entity.

NISG 2026, BGBl. I Nr. 94/2025, §§ 34 und 35 · Read the law's page

• Notify your competent sector-specific CSIRT, or, absent one, the national CSIRT, of every significant cybersecurity incident: an early warning within 24 hours of becoming aware, stating whether it is suspected to result from unlawful and culpable acts or to have cross-border effects.
• Follow with a fuller notification within 72 hours of becoming aware, updating the early warning with an initial evaluation of the incident's severity and impact and any indicators of compromise.
• Submit an interim report on request, and a final report no later than one month after the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report no later than one month after you have finished handling the incident (Section 34(2)).
• If you are a trust service provider, submit an incident notification within 24 hours of becoming aware of a significant cybersecurity incident that affects your trust services (Section 34(2)).
• Treat an incident as significant where it has caused, or can cause, severe operational disruption or severe financial loss to your own operations, or has affected, or can affect, another person through considerable material or non-material damage.
• It binds a wesentliche Einrichtung or wichtige Einrichtung on the same scope as this jurisdiction's companion risk-management row, which names an online marketplace, an online search engine and a social-networking-services platform provider expressly; the wider sector classes are reached as on that row.

NISV 2026, BGBl. II Nr. 290/2026, §§ 2 bis 5 und 7 · Read the law's page

• Meet the technical and methodological risk-management requirements of Article 2 and the Annex of Implementing Regulation (EU) 2024/2690 whatever your sector, including where your type of entity is not one that Implementing Regulation names (Section 2).
• Base your risk analysis on at least technological, human, ICT supply-chain and location-related risks (Section 3).
• Where you cannot meet a Section 2 requirement, temporarily or because of your size, implement compensating measures suited to that requirement's purpose, document them with reasons and review their effectiveness at least once a year (Section 4).
• Report an incident as significant under Section 35(1) of the NISG 2026 when it meets any of the nine criteria in Section 5(1), or when incidents that are not significant alone meet the repeat-incident test in Section 7 (at least two within six months, same apparent cause and effect, together meeting the financial-loss criterion).
• If you are an essential or important entity under Section 24 of the NISG 2026, including an online marketplace, an online search engine or a social-networking-platform provider at the Section 25 medium-enterprise threshold, this ordinance binds you; the wider sector classes of Annexes 1 and 2 are reached too, by declaring that you are an essential or important entity.

Entwurf Bundesgesetz über die Haftung für ein fehlerhaftes Produkt 2026 (Produkthaftungsgesetz 2026 – PHG 2026) · Read the law's page

• If you develop or make software, or have it designed or made, you answer as its manufacturer; free and open-source software developed or supplied outside a business activity is outside the Act (§§ 2(1), 2(10) and 17 point 1).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control: a defect caused by software, by an update or upgrade, or by a missing necessary update is not excused because it arose after you put the product into circulation (§§ 2(5) and 8(2)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in judging whether it is defective (§ 5(2) point 6), and failing a binding requirement that protects against the injury suffered presumes it defective (§ 7(2) point 2).
• Account for what your product learns or acquires after it is put into circulation: the effect of that ability is weighed in judging whether it is defective (§ 5(2) point 3).
• Keep records you could produce if a court orders disclosure on a claimant's plausible claim; failing to disclose relevant evidence after a court order presumes the product defective (§§ 6(1) and 7(2) point 1).
• If you are a manufacturer established outside the Union, your importer and your authorized representative answer as the manufacturer does, and where there is neither, the fulfilment service provider answers (§ 3(1) point 3).
• If you substantially modify a product outside the manufacturer's control and then make it available on the market or put it into operation, you answer as its manufacturer (§ 3(2)).
• If you are a supplier, or an online platform that lets consumers conclude distance contracts with traders, name an economic operator established in the Union or your own supplier within one month of an injured person's request, or you answer for the defective product (§ 3(3) and (4)).
• Do not rely on a contract term to exclude or limit your duty to compensate in advance (§ 9).
• A claim under the Act is time-barred three years after the injured person knew or should have known of the damage, the defect and the liable operator, and ten years after you put the product into circulation or into operation (25 years for a latent bodily injury) unless proceedings were started earlier (§§ 13 and 14).

Gesetzesentwurf Mindestalter Soziale Medien, Begutachtung 27 Juli 2026 · Read the law's page

• Applies to platforms aimed at or reasonably likely to be used by children that use at least one addictive design feature: a recommendation feed weighted toward strangers' content, infinite scroll or autoplay, a continuous-use reward system, or a push notification meant to draw a user back. Messaging services are excluded.
• Prevent a user under 14 from opening or keeping an account; you may still offer a separate child-appropriate area.
• Verify age once, at account creation, with a zero-knowledge-proof, double-blind design: the age-attestation provider learns nothing about where or when its attestation is used, and you receive only a true-or-false answer on whether the 14-year threshold is met, with no name, birth date or other identifying data.
• You may use ID Austria, the state digital-identity system, to verify age, but it is one available method among others and not a mandatory one.
• Have the age verification the draft requires in place by 31 March 2027 at the latest; the draft sets 1 January 2027 as the day its provisions take effect.