AustriaTelekommunikationsgesetz 2021 (TKG 2021), Section 44 Cybersecurity Measures of Operators and Providers
TKG 2021, BGBl. I Nr. 190/2021, § 44 idF BGBl. I Nr. 94/2025
In force since .
A sector security regimes rule binding public and private bodies.
- Private right of action
- No
- Obligation class
- Security
As of .
What it requires
- If you operate or provide public electronic communications networks or services in Austria, take the cybersecurity measures that other legal provisions require of you (Section 44(1)).
- Follow any ordinance the regulatory authority issues under Section 44(1) setting closer technical and organisational security measures for your network or service.
- If you operate public communications networks or services in Austria, or manufacture network components or supply services for such networks offered in Austria, without a seat or residence in the European Union, name a domestic address for service when an ordinance under Section 44(2) requires it.
These lines are LexLint's reading of the law's text, as of . Also read by: Rundfunk und Telekom Regulierungs-GmbH (RTR), the regulatory authority under the TKG 2021 (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.rtr.at/TKP/was_wir_tun/telekommunikation/anbieterservice/netzsicherheit/GewhrleistungSicherheitIntegritt.de.html
- Guidance body
- Rundfunk und Telekom Regulierungs-GmbH (RTR), the regulatory authority under the TKG 2021
- Open questions
- Which 'anderen Rechtsvorschriften' (other legal provisions) does Section 44(1) of the TKG 2021 refer to, and does an operator that the NISG 2026 also covers owe anything under Section 44 beyond those provisions until the regulatory authority sets closer measures by ordinance?
What this law does
Section 44(1) of the Telekommunikationsgesetz 2021 (TKG 2021), as rewritten by Article 2 of the Act BGBl. I Nr. 94/2025 that also enacts the NISG 2026, requires operators and providers to take cybersecurity measures as other legal provisions require.
Where those provisions do not suffice to keep networks and services secure, the regulatory authority (Regulierungsbehörde) may, in agreement with the Federal Chancellor, the federal minister responsible for media and the Cybersicherheitsbehörde, set closer technical and organisational security measures by ordinance.
Section 44(2) lets that ordinance also require an operator of public communications networks or services, or a manufacturer of network components or provider of services for such networks, that has no seat or residence in the European Union to name a domestic address for service of process. The rewritten Section 44 takes effect nine months after promulgation on the next first of a month, which is .
When LexLint raises it
When your app profile says your app provides telecom services.