AustriaStGB Sections 118a and 126a to 126c, Computer-Misuse Offenses
StGB Sec. 118a, 126a-126c, BGBl. Nr. 60/1974 as amended
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not overcome a computer system's specific security measure to gain access, if your purpose is to obtain personal data protected by a secrecy interest, or to use the accessed data or system to harm another, per StGB Section 118a.NIST AI RMFMAP 4.1
- Do not alter, delete, suppress, or render unusable data over which you lack sole authority, in a way that damages another, per StGB Section 126a.no control in the NIST AI RMF
- Do not seriously disrupt a computer system's functioning by entering or transmitting data, per StGB Section 126b.no control in the NIST AI RMF
- Do not create, acquire, distribute, or possess a program, device, password, or access code built or adapted to commit these offenses, per StGB Section 126c.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
StGB Section 118a: imprisonment up to two years for the base offense (up to three years if the system is a critical-infrastructure component, up to five years if committed within a criminal organization against critical infrastructure). Prosecution proceeds only on the victim's authorization (Section 118a(3)). Section 126a: imprisonment up to six months or a fine up to 360 daily rates for the base offense; up to two years where the damage exceeds EUR 5,000; up to three years where many computer systems are affected using a purpose-built tool; six months to five years where the damage exceeds EUR 300,000, critical infrastructure is affected, or the act is committed within a criminal organization. Section 126b carries the same penalty tiers for disrupting a system's functioning, with the second tier (up to two years) triggered by a disruption of longer duration rather than by damage over EUR 5,000. Section 126c: imprisonment up to six months or a fine up to 360 daily rates for creating, acquiring, or distributing a purpose-built tool with intent that it be used for one of these offenses; up to two years where the tool is used in relation to Section 118a, 119, or 119a, or to an aggravated form of Section 126a or 126b; up to three years where the tool is capable of impairing essential components of critical infrastructure.
Who enforces it
Enforcement body
Ordinary criminal courts, on public prosecution for Sections 126a to 126c and on the victim's authorization for Section 118a.
Settledness
- As of
- Open questions
- Does a login requirement, a rate limit or a robots.txt directive count as a 'spezifische Sicherheitsvorkehrung im Computersystem' whose overcoming makes access an offence under Section 118a(1)?
- Does a person who gets past a security measure to read data that the operator shows to its registered users act 'in der Absicht' of obtaining 'personenbezogene Daten' within the meaning of Section 118a(1) Z 1?
What it makes you log
Logging duty
Sections 118a and 126a to 126c define offences: unlawful access to a computer system, damage to data, serious disruption of a computer system, and misuse of programs and access data. They impose no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Section 118a punishes anyone who gains access to a computer system, or part of one, by overcoming a specific security measure, with intent either to obtain personal data whose secrecy is protected or to cause harm through the accessed data or system; prosecution requires the victim's authorization. Section 126a punishes altering, deleting, rendering unusable, or suppressing data over which the offender lacks sole authority, where this damages another.
Section 126b punishes seriously disrupting a computer system's functioning by entering or transmitting data. Section 126c punishes creating, acquiring, distributing, or possessing a program, device, password, or access code built or adapted for committing these offenses, with intent that it be so used.
None of the four turns on whether the targeted content was publicly viewable: Section 118a turns on overcoming a specific security measure, Sections 126a and 126b on the offender's lack of sole authority over the data or system, and Section 126c on the tool's built purpose.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .