Is a payment provider, in Austria

DORA-VG, BGBl. I Nr. 112/2024, Art. 1, §§ 2, 3, 7 und 8 · Read the law's page

• Meet DORA's requirements on ICT risk management (Articles 5 to 14, except Article 11(11)), simplified ICT risk management (Article 16(1) and (2)), handling, classifying and reporting ICT-related incidents and cyber threats (Articles 17, 18(1) and (2) and 19), digital operational resilience testing (Articles 24 and 25) and ICT third-party risk (Articles 28 to 30), which Section 7(1) enforces.when it serves a financial business
• If you are identified under DORA Article 26(8), carry out the advanced threat-led penetration testing that Articles 26(1) to (6) and (8) and 27 require (Section 7(1)(5)).for a financial business
• If you are a financial entity that Section 2 of the DORA-VG lists and the Finanzmarktaufsichtsbehörde (FMA) supervises under Article 46 of Regulation (EU) 2022/2554, such as a credit institution, payment or e-money institution, investment firm, crypto-asset service provider, central securities depository, central counterparty or trading venue, this Act and the Regulation bind you.
• If you are a credit institution under Section 1(1) of the Bankwesengesetz that is not one of the financial entities DORA Article 2(1)(a) to (t) lists, apply this Act, the Regulation and its delegated and implementing acts to yourself as if you were a credit institution under Article 2(1)(a) (Section 3(1)).

Barrierefreiheitsgesetz (BaFG), §§ 2 Abs. 2 und 3, 3, 4 Abs. 3, 5, 6, 14, 15, 17, 18, 36, 37 Abs. 2 und 3 sowie Anlagen 1, 3 und 4, BGBl. I Nr. 76/2023 · Read the law's page

• If you offer or provide to consumers after 28 June 2025 a service listed in section 2(2) of the BaFG (electronic communications services other than emergency calls and machine-to-machine transmission services; services giving access to audiovisual media services; the websites, mobile services including apps, electronic tickets, transport information (for information screens, only interactive screens within the Union) and interactive self-service terminals (other than those built into vehicles, aircraft, ships and rolling stock) of air, bus, rail and waterborne passenger transport, where for urban, suburban and regional transport only the interactive self-service terminals are covered; consumer banking services; e-books and dedicated software; e-commerce services), design, offer and provide it to the requirements of Annex 1, Sections 3 and 4 (for urban, suburban and regional transport, Section 4 only) (BaFG, ss. 2(2), 4(3) and 14(1); Directive (EU) 2019/882, Art. 4(3) and 13(1)).
• If you are a microenterprise (fewer than ten persons employed and either annual turnover or annual balance sheet total of at most EUR 2 million) that offers or provides services, you are exempt from the accessibility requirements of section 4(3) and from all obligations connected with meeting them; if you rely on the exemption, give the Sozialministeriumservice on request the documents it needs to check it (BaFG, ss. 3(19), 6(1) and 24(2); Directive (EU) 2019/882, Art. 4(5)).
• Make websites, their online applications and mobile services including apps perceivable, operable, understandable and robust in a consistent and adequate way; make the products covered by the Act that you use to provide the service meet Section 1 (and where relevant Section 2) of Annex 1; give information about how the service works, about the products it uses and their accessibility features, through more than one sensory channel and in understandable, perceivable, text-based formats, in an adequate font size with sufficient contrast, with an alternative for non-text content; and where you offer support services (help desks, call centres, technical support, relay services and training services), give information on the accessibility of the service and its compatibility with assistive technologies through accessible means of communication (BaFG, Annex 1, Section 3, lit. a to d).
• If you provide electronic communications services, add real-time text beside voice and, where video is offered, total conversation services; if you provide services giving access to audiovisual media services, offer perceivable, operable, understandable and robust electronic programme guides that give information on the accessibility available, and transmit access components (subtitles for the deaf and hard of hearing, audio description, spoken subtitles, sign language interpretation) in full, in adequate quality, synchronised with sound and video, and so that users can control their display and use (BaFG, Annex 1, Section 4, lit. a and b).
• If you provide passenger transport services (other than urban, suburban and regional), give information on the accessibility of vehicles, surrounding infrastructure and buildings and on assistance, and on electronic tickets and ticketing services, real-time travel information and additional service information; for urban, suburban and regional transport, make the self-service terminals accessible (BaFG, Annex 1, Section 4, lit. c and d).
• If you provide consumer banking services, offer identification methods, electronic signatures, security and payment services that are perceivable, operable, understandable and robust, and keep information at or below language level B2 of the Common European Framework of Reference for Languages (BaFG, Annex 1, Section 4, lit. e).
• If you provide e-books and dedicated software, keep text and audio synchronised, do not let the digital files block assistive technologies, ensure access to content, navigation and layout, allow alternative presentation, make accessibility features discoverable through metadata, and do not let digital rights management block accessibility features (BaFG, Annex 1, Section 4, lit. f).
• If you provide e-commerce services, give the accessibility information about the products and services on sale where the responsible operator supplies it, make identification, security and payment functions provided as a service accessible, and offer identification methods, electronic signatures and payment services that are perceivable, operable, understandable and robust (BaFG, Annex 1, Section 4, lit. g).
• Prepare the information of Annex 3 and state in your general terms and conditions, or a similar document, how the service meets the requirements, with a general description of the service in an accessible format, the explanations needed to understand how it is carried out and a description of how it meets the requirements of Annex 1, and present information showing that the way the service is provided and monitored ensures that it meets them (Annex 3, points 1 and 3); make it available to the public in written and oral form, including in a form accessible to persons with disabilities, and keep it for as long as you offer the service (BaFG, s. 14(2) and Annex 3).
• Keep procedures in place so that the requirements are always met while the service is offered, and take account of changes in the features of the service, in the requirements and in the harmonised standards or technical specifications relied on (BaFG, s. 14(3)); a service that meets harmonised standards or parts of them, whose references are published in the Official Journal of the European Union, is presumed to conform to the requirements they cover, and one that meets technical specifications is deemed to conform to the requirements they cover (s. 5).
• If a service does not conform, take the corrective measures needed, inform the Sozialministeriumservice and the competent authorities of the Member States where the service is provided at once, with details of the non-conformity and the measures taken, and hand over on its reasoned request the information and documents in German or English that show conformity, cooperating in remedying the non-conformity (BaFG, s. 14(4) and (5)).
• If you provide services through self-service terminals, prepare information on whether, and to what extent, the built environment of the terminals that falls within your responsibility is accessible to persons with disabilities, make it available to the public, including in an accessible form, and keep it for as long as you offer the service (BaFG, s. 15).
• The requirements apply only so far as compliance does not need a significant change that fundamentally alters the basic nature of the service, and only so far as it does not impose a disproportionate burden; if you rely on either, assess it (for the disproportionate burden against the criteria of Annex 4), document the assessment, keep the results for five years after the service was last provided, produce a copy on request, and send information to the Sozialministeriumservice and the market surveillance authorities of the Member State where the service is provided; if you rely on the disproportionate-burden exception, renew the assessment for each category or type of service when the service changes, when the Sozialministeriumservice asks and at least every five years (BaFG, ss. 17 and 18(1) to (4) and (6); Directive (EU) 2019/882, Art. 14).
• You cannot rely on the disproportionate-burden exception if you received public or private funds, other than your own, to improve accessibility (BaFG, s. 18(7); Directive (EU) 2019/882, Art. 14(6)).
• Websites and mobile applications need not make accessible recorded time-based media or office file formats published before 28 June 2025, online maps and map services that give essential navigation information in accessible digital form, third-party content that you neither finance, develop nor control, or archive content that is neither updated nor revised after 28 June 2025 (BaFG, s. 2(3)).
• A service that complies with the provisions on accessible information and information on accessibility in Regulation (EC) No 261/2004, Regulation (EC) No 1107/2006, Regulation (EU) No 1177/2010, Regulation (EU) No 181/2011, Regulation (EU) 2021/782 or the acts adopted under Directive 2008/57/EC meets the corresponding requirements of the BaFG, and the additional requirements of the BaFG apply in full (BaFG, s. 7; Directive (EU) 2019/882, Art. 5).
• Until 28 June 2030 you may continue to provide services using products that you lawfully used for similar services before 28 June 2025; service contracts agreed before 28 June 2025 may continue unchanged until they expire, for no longer than five years from that date; and self-service terminals that you lawfully used before 28 June 2025 may stay in use for comparable services until the end of their economic useful life, for no longer than 20 years after first use and not beyond 28 June 2040 (BaFG, s. 37(2) and (3); Directive (EU) 2019/882, Art. 32).

Barrierefreiheitsgesetz (BaFG), §§ 21 bis 33, 35 und 36, BGBl. I Nr. 76/2023 · Read the law's page

• If the Sozialministeriumservice checks a product or service of yours, cooperate fully with it; make available free of charge the tools and access data needed for a full test for the duration of the check, and provide samples and trial provision of the service free of charge, bearing the transport costs (BaFG, ss. 23(1) and (2) and 25).
• Give the Sozialministeriumservice, on request, the relevant documents, technical specifications, data and information on conformity and technical aspects, including access to embedded software, copies of them, and information on the supply chain, distribution network, quantities on the market and other models with the same technical features (BaFG, s. 23(5) and (6)); allow its authorised persons to enter the premises, land and means of transport you use for your business during business hours (s. 23(4)).
• If the Sozialministeriumservice announces a check of a self-service terminal, keep the terminal available undisturbed for the time the check needs (BaFG, s. 23(7)).
• If a check shows that a product or service does not comply, bear the costs of the check that the Sozialministeriumservice orders by notice (BaFG, s. 23(9)).
• If the Sozialministeriumservice requires corrective measures for a product within a set period, take all suitable measures to bring the product into conformity and extend them to all the products you made available on the Union market; if you do not, withdraw or recall the product within the further period it sets, failing which it orders provisional measures by notice to withdraw, recall, prohibit or restrict the product on the Austrian market (BaFG, s. 26(1), (3) and (4)).
• If the Sozialministeriumservice finds that a service does not meet the requirements, take the corrective measures it requires within the period it sets; it must then by notice oblige you to take corrective or other proportionate measures, such as informing the public of the non-compliance or ceasing to offer or provide the service (BaFG, s. 28(1)); if the built-environment information of section 15 is missing, provide it within the period set by notice (s. 28(2)).
• If the Sozialministeriumservice finds a formal non-conformity (a CE marking missing or wrongly affixed, an EU declaration of conformity missing or wrong, technical documentation unavailable or incomplete, missing, wrong or incomplete manufacturer or importer details, or another unmet formal duty of section 9 or 11), correct it; if it persists the Sozialministeriumservice restricts or prohibits the product or has it withdrawn by notice (BaFG, s. 29(1) and (2)); if the Annex 3 information of a service is missing, incomplete or not made available in accessible form, correct it, failing which the Sozialministeriumservice obliges you by notice to take corrective or other proportionate measures (s. 29(3) and (4)).
• If you rely on the fundamental-alteration or disproportionate-burden exception, expect the Sozialministeriumservice to check that you made and documented the assessment, informed it, applied the criteria of Annex 4 properly, and met the accessibility requirements that still apply (BaFG, s. 24(1)).
• A notice of the Sozialministeriumservice, or its failure to decide, can be challenged by an appeal to the Bundesverwaltungsgericht; the federal minister responsible for social affairs may bring an appeal on a point of law (Amtsrevision) to the Verwaltungsgerichtshof against the Bundesverwaltungsgericht's decision (BaFG, ss. 31 and 32).
• Before the Sozialministeriumservice requests corrective action or issues a notice, it must give you the result of its investigation and at least ten working days to comment; once you show it that the lawful state has been restored, apply to have the measures it ordered by notice lifted in whole or in part (BaFG, ss. 26(1) and (4), 28(3), 29(5) and 30).
• A breach of the duties listed in section 36 is an administrative offence that the Sozialministeriumservice punishes with a fine; where the operator is a legal person, the person authorised to represent it externally, or a responsible agent it has appointed, answers for the breach and the legal person is jointly liable for the fine, unless the provision provides otherwise, and a substitute term of imprisonment is set for the case that the fine cannot be collected (BaFG, s. 36; Verwaltungsstrafgesetz 1991, ss. 9 and 16).