AustriaCybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification
CSZG, BGBl. I Nr. 78/2024, §§ 3, 4, 6 und 7
In force since .
A product security requirements rule binding public and private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- If you are a conformity assessment body, a holder of a European cybersecurity certificate or an issuer of an EU declaration of conformity, the Federal Chancellor supervises you under this Act as the national cybersecurity certification authority.
- Keep the records that Regulation (EU) 2019/881 or the European certification scheme requires, and let the Federal Chancellor inspect them (Section 4(2)(1)(a)).
- Carry out within the set deadline any measure the Federal Chancellor orders by decision to meet the Regulation or a European certification scheme (Section 4(2)(1)(b)).
- Make ICT products, services and processes available for testing, at your own cost, at the place and time the Federal Chancellor designates, and allow them to be inspected and put into operation (Section 4(2)(1)(c) and (d)).
- Answer completely the Federal Chancellor's requests for information and for investigation under Article 58(8)(a) and (b) of the Regulation, and give access to your premises during normal business hours (Sections 4(2)(2) and 7(1)).
- Issue European cybersecurity certificates at assurance level high only as Section 6 and Article 60(3) of the Regulation allow.
These lines are LexLint's reading of the law's text, as of . Also read by: Bundeskanzleramt (Federal Chancellery), national cybersecurity certification authority (NCZB) (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Section 7 makes the listed failures administrative offences (Verwaltungsübertretungen) fined by the district administrative authorities, not criminal offences.
Penalty structure
Section 7(1) sets the fine at up to EUR 50,000 and, on repetition, up to EUR 100,000.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 100,000
Who enforces it
Enforcement body
The Federal Chancellor (Bundeskanzler) as the national cybersecurity certification authority; the district administrative authorities (Bezirksverwaltungsbehörden) impose the fines.
Settledness
- As of
- Guidance link
- https://www.bundeskanzleramt.gv.at/themen/cybersicherheit/nationale-behoerde-fuer-cybersicherheitszertifizierung/faq-nczb.html
- Guidance body
- Bundeskanzleramt (Federal Chancellery), national cybersecurity certification authority (NCZB)
What this law does
The Cybersicherheitszertifizierungs-Gesetz (CSZG), BGBl. I Nr. 78/2024, promulgated on , carries out Regulation (EU) 2019/881 (the Cybersecurity Act) in Austria. Section 3(1) makes the Federal Chancellor the national cybersecurity certification authority under Article 58 of that Regulation.
Section 4(2) lets the Chancellor inspect the records that conformity assessment bodies, holders of European cybersecurity certificates and issuers of EU declarations of conformity must keep, order them by decision to meet the Regulation or a certification scheme, require ICT products, services and processes to be made available for testing at the holder's own cost, and inspect premises during business hours.
Section 6 lets the Chancellor transfer the issuing of European cybersecurity certificates at assurance level high to a conformity assessment body.
Section 7(1) makes it an administrative offence, fined up to EUR 50,000 and up to EUR 100,000 on repetition, not to answer an information, investigation, record-inspection, inspection or testing request, not to carry out an ordered measure on time, to refuse access to premises, or to issue a certificate contrary to Section 6 or Article 60(3) of the Regulation. The Austrian legal information system lists as the date the Act's sections took effect.
When LexLint raises it
When your app profile says your app distributes a software product.