Austria

Section 17(8) of the KommAustria-Gesetz charges the RTR-GmbH, under the joint responsibility of both its managing directors, with building and running a Servicestelle für Künstliche Intelligenz (KI-Servicestelle).

Section 20c(1) sets the Servicestelle's purpose: a varied information and advisory offering on building competence in designing and using artificial intelligence applications, and a central service point for AI projects and applications in the media, telecommunications and postal fields.

Section 20c(2) requires the RTR-GmbH to run an information portal on projects and initiatives that use AI, in particular publicly funded ones, and requires the federal funding bodies to ensure that grant recipients then give the RTR-GmbH the essential project data.

Section 194a of the Telekommunikationsgesetz 2021 lists the support and advice that the telecommunications and postal division gives the public through the Servicestelle, including the rules for developing and using AI in businesses and public bodies, the technical documentation of AI systems, the effects of AI on cybersecurity and AI already used in high-risk areas.

Section 20c(6) sets up a Beirat für Künstliche Intelligenz (KI-Beirat) at the RTR-GmbH to inform and advise the members of the federal government and the RTR-GmbH on developments in AI. Section 20c of the KommAustria-Gesetz, with sections 17(8) and 18(3a), came into force on 1 January 2024.

Section 207a(4) defines image-based sexual abuse material and sexual depictions of minors to include, at Z 4, any pictorial representation whose viewing creates the impression, whether through alteration of an image or without using one at all, that it is a representation of the kind described in Z 1 to 3: a realistic depiction of a sexual act involving a person under 14, or of an event that appears to be such an act, or the same acts involving a minor between 14 and 18.

This reaches a wholly AI-generated or synthetically altered image with no underlying real depiction, provided the image creates the impression of a realistic depiction, within the same offences as a real photograph. Section 207a(5) exempts producing or possessing such a depiction of a person aged 14 to 17 for one's own use where the act carries no risk of distribution.

Producing such an image, or offering, procuring, supplying, showing, or otherwise making it accessible to another, is an offense under Section 207a(1). Knowingly accessing one online is a separate offense under Section 207a(3a). Merely possessing or procuring one is punishable under Section 207a(3).

The Verbraucherkreditgesetz 2026 implements Directive (EU) 2023/2225 on consumer credit agreements. A lender is a business that grants or promises to grant credit. Section 13 requires lenders and credit intermediaries to inform the consumer clearly and comprehensibly when they make an offer that was personalized on the basis of automated processing of personal data.

Where the creditworthiness assessment involves automated processing of personal data, section 17(5) lets the consumer demand and obtain human intervention on the lender's side. In particular, the consumer may obtain clear and comprehensible explanations of the assessment, including the logic and risks of the automated processing, may state his or her own view, and may obtain a review of the assessment and of the decision to grant the credit. The lender must inform the consumer of these rights.

The Act comes into force on 20 November 2026 and applies only to credit agreements concluded after 19 November 2026, except as section 45(3) provides.

A controller must notify the Datenschutzbehorde without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

The General Data Protection Regulation (GDPR) applies directly in Austria, and the Datenschutzgesetz (DSG), BGBl. I Nr. 165/1999 as amended by BGBl. I Nr. 50/2025, supplies domestic institutional and procedural provisions: the structure of the Datenschutzbehorde (DSB) and criminal offenses for data misuse under DSG Section 63. The Constitutional Court repealed paragraph 1 of section 9 DSG, the media privilege, as unconstitutional. The repeal took effect at the end of 30 June 2024.

Section 9 DSG was re-regulated from 1 July 2024 by the amending act published as Federal Law Gazette I No. 62/2024. DSG Section 12 adds its own lawfulness grounds for image recordings made for private purposes, subject to the safeguards of Section 13.

Transferring personal data of a person in Austria outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the highest Article 83(5) fine tier (up to EUR 20 million or 4 percent of global turnover).

General Data Protection Regulation (GDPR) Article 22 gives a person in Austria the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

The third main part of the Datenschutzgesetz applies, under Section 36(1), to processing by competent authorities for the purposes of preventing, investigating or prosecuting criminal offenses and for national security.

On 11 June 2026, in a case on an access request about a credit score under Article 15(1)(h), the Verwaltungsgerichtshof (Supreme Administrative Court) held that general macroeconomic statistics used as parameters in a credit score are in principle not personal data (Ra 2026/04/0001).

Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Austria can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.

Section 4 of the Datenschutzgesetz adds two rules for these requests: access may, as a rule, be refused where disclosure would endanger a business or trade secret of the controller or of a third party (§ 4(6)), and where automated data can be corrected or erased only at set times for economic or technical reasons, their processing is restricted until then, with the effect of GDPR Article 18(2) (§ 4(2)).

The Datenschutzbehorde (DSB) is Austria's supervisory authority, with General Data Protection Regulation (GDPR) Article 83 administrative fines of up to the greater of EUR 20 million or 4 percent of global turnover, plus a criminal offense in DSG Section 63 for using, disclosing or publishing entrusted personal data with intent to enrich oneself or to harm the data subject.

Article 82 arms an individual with a direct private right of action for material or non-material damage, without a seriousness threshold, per the CJEU's ruling in C-300/21 UI v Osterreichische Post AG (4 May 2023), itself referred by the Austrian Supreme Court. The register that the Bundeskartellanwalt publishes under Section 12 of the Qualifizierte-Einrichtungen-Gesetz lists noyb as a qualified entity for both cross-border and domestic collective actions.

Article 9(1) prohibits processing special categories of personal data, namely personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation, unless a listed Article 9(2) exception applies, most often explicit consent.

A voiceprint captured through specific technical processing for identification falls within the General Data Protection Regulation (GDPR) definition of biometric data, as a faceprint does. In a decision of 9 May 2023, the Datenschutzbehörde concluded that Clearview AI had processed personal data of an Austrian complainant who had made an access request.

Section 118a punishes anyone who gains access to a computer system, or part of one, by overcoming a specific security measure, with intent either to obtain personal data whose secrecy is protected or to cause harm through the accessed data or system; prosecution requires the victim's authorization. Section 126a punishes altering, deleting, rendering unusable, or suppressing data over which the offender lacks sole authority, where this damages another.

Section 126b punishes seriously disrupting a computer system's functioning by entering or transmitting data. Section 126c punishes creating, acquiring, distributing, or possessing a program, device, password, or access code built or adapted for committing these offenses, with intent that it be so used.

None of the four turns on whether the targeted content was publicly viewable: Section 118a turns on overcoming a specific security measure, Sections 126a and 126b on the offender's lack of sole authority over the data or system, and Section 126c on the tool's built purpose.

Section 42h(1) to (5) lets anyone reproduce a lawfully accessed work for a research organization or a cultural-heritage institution, and lets individual researchers do so where justified by a non-commercial purpose, to mine text and data for scientific or artistic research, and store the reproduction as long as the research purpose justifies it; this exception cannot be contracted away and applies even where a for-profit undertaking participates in a public-private partnership with the research or heritage institution.

Section 42h(6) creates a separate, general exception letting any person reproduce a lawfully accessed work for their own text-and-data-mining, for any purpose, unless the rightsholder has expressly prohibited the reproduction through an adequately signaled reservation, in particular a machine-readable one for works made available online.

A database whose compilation, verification, or presentation required a substantial investment is protected as such under Section 76c, independent of any copyright in its contents.

Section 76d gives the database's producer the exclusive right to reproduce, distribute, broadcast, publicly communicate, and make available the whole database or a substantial part of it, and treats the repeated and systematic extraction or re-utilization of insubstantial parts the same way where this conflicts with the database's normal exploitation or unreasonably prejudices the producer's legitimate interests.

Section 76e voids any contractual term by which a lawful user agrees not to extract or re-utilize insubstantial parts, to the extent that doing so neither conflicts with normal exploitation nor unreasonably prejudices the producer. The right lasts fifteen years from completion, or from publication if the database is published within that period.

Section 1 of the Bundesgesetz gegen den unlauteren Wettbewerb (UWG) lets an injured party seek an injunction, and damages where the defendant is at fault, against anyone who, in the course of trade, applies an unfair commercial practice or other unfair conduct capable of more than trivially affecting competition to the disadvantage of undertakings, or a commercial practice contrary to professional diligence that is likely to materially distort the economic behavior of the average consumer it reaches.

The Cybersicherheitszertifizierungs-Gesetz (CSZG), BGBl. I Nr. 78/2024, promulgated on 5 July 2024, carries out Regulation (EU) 2019/881 (the Cybersecurity Act) in Austria. Section 3(1) makes the Federal Chancellor the national cybersecurity certification authority under Article 58 of that Regulation.

Section 4(2) lets the Chancellor inspect the records that conformity assessment bodies, holders of European cybersecurity certificates and issuers of EU declarations of conformity must keep, order them by decision to meet the Regulation or a certification scheme, require ICT products, services and processes to be made available for testing at the holder's own cost, and inspect premises during business hours.

Section 6 lets the Chancellor transfer the issuing of European cybersecurity certificates at assurance level high to a conformity assessment body.

Section 7(1) makes it an administrative offence, fined up to EUR 50,000 and up to EUR 100,000 on repetition, not to answer an information, investigation, record-inspection, inspection or testing request, not to carry out an ordered measure on time, to refuse access to premises, or to issue a certificate contrary to Section 6 or Article 60(3) of the Regulation. The Austrian legal information system lists 6 July 2024 as the date the Act's sections took effect.

The DORA-Vollzugsgesetz (DORA-VG), Article 1 of BGBl. I Nr. 112/2024 of 19 July 2024, gives effect in Austria to Regulation (EU) 2022/2554 (DORA) on digital operational resilience for the financial sector.

Section 2 makes the Finanzmarktaufsichtsbehörde (FMA) the competent authority under Article 46 of the Regulation for credit institutions (except where supervision is reserved to the European Central Bank), payment institutions, e-money institutions, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues and the other entity types the Section lists.

Section 3(1) applies the Act and the Regulation to a credit institution that is not one of the financial entities DORA Article 2(1)(a) to (t) lists as if it were a credit institution under Article 2(1)(a).

Under Section 7 the person responsible for a financial entity commits an administrative offence, punishable by the FMA with a fine of up to EUR 150,000, by failing the Regulation's ICT risk-management requirements (Articles 5 to 14, except Article 11(11)), its requirements for handling, classifying and reporting ICT-related incidents (Articles 17, 18(1) and (2) and 19), its resilience-testing requirements (Articles 24 and 25) or its ICT third-party risk requirements (Articles 28 to 30), among other listed infringements.

Under Section 8 the FMA can fine a legal person for those infringements up to EUR 500,000 or up to 1 percent of annual net turnover, whichever is higher. The Act enters into force on 17 January 2025.

Section 7(1) requires a service provider that lawfully sends a commercial communication by electronic mail without the recipient's prior consent to ensure that the communication is clearly and unmistakably recognizable as such when it reaches the user. Section 7(2) requires the Rundfunk und Telekom Regulierungs-GmbH (RTR-GmbH) to keep a list in which persons and companies can register free of charge to exclude commercial communications by electronic mail.

The service providers named in paragraph 1 must observe that list. Section 7(3) leaves other legislation on the admissibility of commercial communication by electronic mail unaffected. Section 3 Z 6 defines a commercial communication as advertising and other forms of communication that serve the direct or indirect promotion of the sale of goods and services or the image of an enterprise.

Section 174(3) makes the sending of electronic mail, SMS included, for direct marketing purposes inadmissible without the recipient's prior consent.

Section 174(4) lifts the consent requirement where the sender obtained the contact information in connection with a sale or a service to its customers, the message advertises its own similar products or services, the recipient was clearly and distinctly offered a free and easy way to refuse such use of the contact information when it was collected and again with every transmission, and the recipient has not refused in advance, in particular by entry in the list named in section 7(2) of the E-Commerce-Gesetz.

Section 174(5) makes direct-marketing electronic mail inadmissible in any case where the sender's identity is disguised or concealed, where section 6(1) of the E-Commerce-Gesetz is violated, where the recipient is asked to visit websites that violate that provision, or where there is no authentic address to which the recipient can send a request to stop such messages.

Section 6(1) of the E-Commerce-Gesetz requires a commercial communication that is part of, or constitutes, an information society service to be clearly and unmistakably recognizable as such and to show who commissioned it. Section 174(6) treats an administrative offence under paragraph 1, 3 or 5 that was not committed in Austria as committed where the unsolicited message reaches the user's connection.

Section 188(4) Z 28 makes sending electronic mail contrary to section 174(3) or (5) an administrative offence. The administrative offences in section 188(4) carry a fine of up to 50,000 euro.

Section 165(3) obliges operators of public communications services and providers of an information society service within the meaning of section 3 Z 1 of the E-Commerce-Gesetz to inform the user which personal data they will process, on what legal basis, for what purposes and for how long the data are stored. It allows the collection of these data only if the user has given consent actively and on the basis of clear and comprehensive information.

The consent rule does not stand in the way of technical storage or access whose sole purpose is carrying out the transmission of a message over a communications network or, where strictly necessary, enabling the provider of an information society service that the user expressly requested to provide that service. The information is to be given in a suitable form, in particular in the general terms and conditions, and at the latest at the start of the legal relationship.

The Telekommunikationsgesetz 2021 states in section 1(6) that it implements Directive 2002/58/EC as amended by Directive 2009/136/EC. Section 188(4) Z 24 makes it an administrative offence not to inform the users as section 165(3) requires. The administrative offences in section 188(4) carry a fine of up to 50,000 euro.

Section 120(1) punishes whoever uses a recording device or a listening device to obtain knowledge, for themselves or another unauthorized person, of a non-public statement of another that was not meant for their own notice. The penalty under section 120(1) is imprisonment of up to one year or a fine of up to 720 daily rates.

Section 120(2) punishes in the same way whoever, without the consent of the speaker, makes the sound recording of another's non-public statement accessible to a third party for whom it is not meant, or publishes such a recording.

Section 120(2a) punishes whoever records, makes accessible to another unauthorized person or publishes a message transmitted by telecommunication that was not meant for them, intending to obtain knowledge of its content for themselves or another unauthorized person, with imprisonment of up to three months or a fine of up to 180 daily rates, where the act is not threatened with a stricter penalty under the preceding provisions or another provision. Under section 120(3) the offender is prosecuted only with the authorization of the injured person.

Section 119(1) punishes whoever, intending to obtain knowledge for themselves or another unauthorized person of the content of a message transmitted by telecommunication or by a computer system that was not meant for them, uses a device that was attached to the telecommunications installation or the computer system or otherwise made ready to receive. The penalty under section 119(1) is imprisonment of up to two years. Under section 119(2) the offender is prosecuted only with the authorization of the injured person.

Section 174(1) makes calls, including the sending of fax transmissions, for advertising purposes without the user's prior consent inadmissible. The consent of a person whom the end user has authorized to use their connection is equal to the user's consent. The consent can be revoked at any time, and revocation does not affect a contract with the addressee of the consent.

Section 174(2) bars the caller from suppressing or falsifying the caller identification on a telephone call for advertising purposes, and from causing the service provider to do so. Section 4 Z 13 of the Act defines a user as a natural or legal person who contractually uses or applies for a publicly available communications service. Section 188(6) Z 9 makes an advertising call contrary to section 174(1) an administrative offence.

The administrative offences in section 188(6) carry a fine of up to 100,000 euro. Section 188(4) Z 27 makes suppressing or falsifying the caller identification contrary to section 174(2) an administrative offence.

Section 20(1) lets a person whose personality right has been infringed, or is threatened with infringement, sue for an injunction and for removal of the unlawful state of affairs. Section 20(3) extends that claim to an intermediary whose services the infringer uses. A provider of a mere conduit service within the meaning of Article 4 of Regulation (EU) 2022/2065 does not count as an intermediary for this rule.

Where the intermediary meets the conditions for an exclusion of responsibility under Articles 5 and 6 of the Regulation, it can be sued only after a warning (Abmahnung). Section 20 has had its current wording since 17 February 2024, following the Digital Services Act (DSA)-Begleitgesetz, BGBl. I Nr. 182/2023.

Section 81(1) lets a person whose exclusive right under the Urheberrechtsgesetz has been infringed, or is threatened with infringement, sue for an injunction. Section 81(1a) extends the injunction claim to an intermediary whose services the infringer uses. Where the intermediary meets the conditions for an exclusion of responsibility under Articles 4 to 6 of Regulation (EU) 2022/2065, it can be sued only after a warning (Abmahnung). Section 81 has had its current wording since 17 February 2024, following the Digital Services Act (DSA)-Begleitgesetz, BGBl. I Nr. 182/2023.

Section 13(1) requires providers of intermediary services, on the order of a domestic court, to give the court all information that allows the users of their service with whom they have agreements to transmit or store information to be identified, for the prevention, investigation, clarification or prosecution of court-punishable offences.

Section 13(2) requires them, on the order of a domestic administrative authority, to give the authority the names and addresses of those users where knowing them is an essential prerequisite for the authority's tasks.

Section 13(3) requires them to give a third person the name and address of a user on request, where that person shows an overriding legal interest in establishing the identity of a user and of a specific unlawful matter and also makes credible that the information is an essential prerequisite for pursuing a legal claim.

Section 14 requires a claim for information under section 13(3) to be brought before the commercial court of first instance in whose district the harmful event occurred or threatens to occur, which decides in non-contentious proceedings. Section 3 Z 3a defines a provider of intermediary services by reference to Article 3(g) of Regulation (EU) 2022/2065. The Digital Services Act (DSA)-Begleitgesetz of 2023 replaced sections 13 to 16 of the Act with the sections described here. It deleted sections 17 to 19 of the Act with their headings.

Section 18c treats a provider of a large online platform as itself communicating to the public, and so needing the authors' permission, when it gives the public access to copyright-protected works its users upload.

A large online platform is a service that plays an important role on the market for online content by competing with online content services for the same audiences, where one of its main purposes is to store and give the public access to a large amount of works uploaded by its users, and that organizes and promotes this content to make a profit.

Services such as non-profit online encyclopedias, non-profit educational, artistic and scientific repositories, development and sharing platforms for open-source software, electronic communications services, online marketplaces, business-to-business cloud services and cloud services for personal use are not providers in this sense.

Section 89a(1) makes the provider liable, on the basis of fault, to a person injured by an unauthorized making available of a work, unless the provider proves that, in light of proportionality, it made all efforts to obtain permission, all efforts to keep specified works unavailable, and acted without delay on a sufficiently substantiated notice from the rightsholder and made all efforts to prevent re-upload.

Section 89a(3) lowers this to all efforts to obtain permission and prompt action on notice for a provider whose service has been available in the Union for less than three years and whose annual turnover does not exceed 10 million euro, with the added duty to show best efforts to prevent re-upload once its average monthly visitors exceed five million.

Section 89b(1) bars measures under section 89a(1) that make lawfully uploaded works unavailable, including works used under an exception or limitation. Section 89b(2) requires the provider to make adequate information on how the measures work easy to find on its website and in its terms. Section 89b(3) bars automated blocking or removal of a small excerpt of a work.

Section 89b(3) allows automated measures against a small excerpt exceptionally, where the rightsholder shows for a specific period that without temporary measures the economic exploitation of the work would be significantly impaired and other provision is made so that permitted uses are not prevented.

Section 89b(4) requires the provider to make content accessible when the user asserts before or at upload that the use is permitted, unless the assertion is immediately recognizable as abusive, and to offer online forms for that assertion. Section 89b(5) requires a complaint procedure for users against unjustified blocking or removal. Section 89b(5) requires that procedure to be, as a rule, capable of completion within two weeks of the complaint.

Under section 89b(6), where the complaint respondent does not respond promptly or responds manifestly insufficiently in the complaint procedure, the work must be made accessible. Section 89c(1) makes KommAustria the supervisory authority. Section 89c(1) gives the RTR-GmbH the administrative support of KommAustria and the function of complaints body.

Section 89c(4) requires KommAustria to impose a fine of up to one million euro on a provider that applies measures that systematically and to a significant extent make lawful uploads unavailable or that sets up no effective complaint procedure. Providers covered when the amendment took effect had to implement the section 89b duties by 1 April 2022, and later entrants within three months of starting activity. The gazette of the Urheberrechts-Novelle 2021 lists Directive (EU) 2019/790 among the Union acts it implements.

The Terrorinhalte-Bekämpfungs-Gesetz regulates the implementation in Austria of the obligations that arise from Regulation (EU) 2021/784 on addressing the dissemination of terrorist content online. Section 2(1) designates KommAustria as the competent authority for issuing removal orders, for reviewing removal orders and for overseeing specific measures, and as the penalty authority for section 7.

Section 5 requires every hosting service provider to register without delay for delivery through a delivery service under sections 28b and 35 of the Zustellgesetz and to state at registration that there are no periods in which delivery is excluded. Section 6(1) requires hosting service providers to send KommAustria their transparency report by 1 February of each year.

Section 7(3) makes it an administrative offence, punishable by a fine of up to 1 million euro, not to remove terrorist content or disable access to it in all Member States as soon as possible, and in any case within one hour, after receiving a removal order. Section 7(1) carries a fine of up to 50,000 euro for the breaches it lists, including failing to register for delivery under section 5.

Section 7(2) carries a fine of up to 500,000 euro for the breaches it lists, including failing to take the specific measures against the dissemination of terrorist content. In the case of systematic or continuing breaches of the removal duty in section 7(3) Z 1, section 7(4) requires KommAustria to impose a fine of up to 4 % of the provider's worldwide annual turnover in the preceding financial year. The Act has applied since 1 September 2023.

The Koordinator-für-digitale-Dienste-Gesetz regulates the implementation in Austria of the obligations that arise from Regulation (EU) 2022/2065, the Digital Services Act. Section 2(1) designates the Kommunikationsbehörde Austria (KommAustria) as the competent authority for the tasks of the Digital Services Coordinator under Article 49(1) and (2) of the Regulation. Section 2(2) calls on the Rundfunk und Telekom Regulierungs-GmbH (RTR-GmbH), Fachbereich Medien, to support KommAustria.

Section 2(4) gives the RTR-GmbH, Fachbereich Medien, the tasks of an out-of-court dispute settlement body under Article 21(6) of the Regulation. Section 5(1) makes it an administrative offence for a provider of an intermediary service to breach the duties in Articles 9 to 15 of the Regulation that it lists. Section 5(2) makes it an administrative offence for a provider of hosting services, including an online platform, to breach the duties in Articles 16 to 18 that it lists.

Section 5(3) does the same, subject to Article 19 of the Regulation, for a provider of an online platform or online search engine as to the publication of average monthly active users under Article 24(2) and (3). Section 5(4) does the same, subject to Article 19, for a provider of an online platform as to Articles 20 to 28 and Article 86(2).

Section 5(5) does the same, subject to Article 29, for a provider of an online platform that allows consumers to conclude distance contracts with traders as to Articles 30 to 32. Section 5(6) does the same for a provider of a very large online platform or very large online search engine as to Article 14(5) and (6). Section 5(7) makes it an administrative offence not to comply with a measure or decision of KommAustria in exercising its investigation or enforcement powers.

Section 6(1) Z 1 sets a fine of up to 1 % of the annual income or worldwide annual turnover for providing incorrect, incomplete or misleading information, failing to reply or rectify, or not tolerating an inspection. Section 6(1) Z 2 sets a fine of up to 6 % of the provider's worldwide annual turnover in all other cases.

Section 6(2) requires KommAustria, after a provider or other person has breached a decision or order of the kind it lists, to threaten a periodic penalty payment of up to 5 % of the average daily worldwide turnover or income for each day of non-compliance, and to impose it if the call to stop the breach is not met in time.

Section 6(5) makes the legal representative resident in Austria liable for fines imposed for breaches by providers of intermediary services without an establishment in the Union. Section 10(1) brings the Act into force on 17 February 2024 and repeals the Kommunikationsplattformen-Gesetz, BGBl. I Nr. 151/2020.

The Politische-Werbung-Gesetz regulates the implementation in Austria of the obligations that arise from Regulation (EU) 2024/900 on the transparency and targeting of political advertising. Section 2(1) designates KommAustria as the competent authority, the penalty authority for section 6 and the national contact point under Article 22(9) of the Regulation.

Section 6(1) fines a provider of political advertising services with up to 20,000 euro for negligence and up to 50,000 euro for intent for the breaches it lists. Section 6(2) fines a sponsor with up to 50,000 euro for negligence and up to 100,000 euro for intent for the breaches it lists.

Section 6(3) fines a publisher of political advertising with up to 20,000 euro for negligence and up to 50,000 euro for intent for the breaches it lists, which include the provision of a political advertisement with the information Article 11 requires, the transparency notice under Article 12, archiving and access under Article 13 and the notification procedure under Article 15.

Section 6(4) fines a controller that fails to take appropriate measures to transmit information free of charge under Article 20 of the Regulation, with up to 20,000 euro for negligence and up to 50,000 euro for intent. Section 6(5) fines a provider of political advertising services with up to 100,000 euro for providing its services contrary to Article 5(2) of the Regulation or for designing its contracts contrary to Article 7(2).

Section 6(6) fines a publisher of political advertising with up to 100,000 euro for continuing to provide a political advertisement after finding or being told that its transparency notice is incomplete or incorrect, and with up to 500,000 euro where a very large online platform or very large online search engine fails to archive political advertisements as Article 13(2) provides, lacks the notification procedure Article 15(1) to (4) requires or fails to meet the obligations under Article 15(5).

Sections 1 to 5 and 7 to 10(1) have applied since 1 May 2026, and section 6 since 15 May 2026 to facts occurring after 31 May 2026.

The Federal Act of 21 January 1988 on liability for a defective product is the Produkthaftungsgesetz. The Federal Law Gazette issue that publishes it is dated 12 February 1988. The Justice Committee's report on the bill says that the bill is to adapt Austrian law to the directive of the European Communities on liability for defective products.

Section 1(1) makes the entrepreneur who made a product and put it into circulation liable to compensate damage when a defect in the product kills a person, injures the body or harms the health, or damages a physical thing other than the product. The importer, meaning the entrepreneur who brought the product into the European Economic Area for distribution and put it into circulation there, is liable in the same way.

Where neither the manufacturer nor the importer can be identified, every entrepreneur who put the product into circulation is liable unless it names to the injured person, within a reasonable time, the manufacturer, the importer or the person who supplied it. Section 3 treats as manufacturer the person who made the end product, a basic material or a component, and anyone who presents itself as manufacturer by affixing its name, trademark or another distinguishing mark.

Section 4 defines a product as any movable corporeal thing, even where it forms part of another movable thing or is joined to an immovable thing, including energy. A product is defective under section 5 if it does not offer the safety that one is entitled to expect in all the circumstances. A product cannot be regarded as defective merely because an improved product was put into circulation later.

A manufacturer or importer who asserts that it did not put the product into circulation, or did not act as an entrepreneur, bears the burden of proof. A defendant who asserts that the product did not yet have the defect when it was put into circulation must show this to be probable in the circumstances. Under section 8, liability is not excluded by a lack of fault but only by proof of one of three grounds.

The first ground is that the defect is due to a legal rule or official order that the product had to meet. The second ground is that the properties of the product could not be recognised as a defect according to the state of science and technology when the defendant put it into circulation. The third ground, open to a maker of only a basic material or component, is that the design of the product it went into, or the instructions of that product's manufacturer, caused the defect.

Under section 2, damage to a thing is compensated only where an entrepreneur who used the thing mainly in its business did not suffer it, and only for the part exceeding EUR 500. Section 9 bars excluding or limiting the duty to compensate in advance. Section 13 makes claims under the Act that are not time-barred earlier expire ten years after the liable person put the product into circulation, unless the injured person has meanwhile asserted the claim in court.

Section 14 applies the General Civil Code to the claims unless the Act provides otherwise. Section 15(1) leaves untouched provisions of the General Civil Code and other rules under which damage is compensated to a wider extent or by other persons. Section 16 obliges manufacturers and importers to make provision, by insurance or otherwise and in the manner and extent usual in fair business dealing, so that compensation duties under the Act can be met. The Act entered into force on 1 July 1988.

The Act does not apply to damage caused by products put into circulation before it entered into force. The consolidated text on the Legal Information System records the Act as last amended in 2001. Section 4 and section 8 took their present wording on 1 January 2000, and the new wording does not apply to products put into circulation before that day.

Section 2 took its present wording on 1 January 2002, and the new wording does not apply to damage caused by products put into circulation before that day.

Section 4(1) of the BaFG allows economic operators to place on the market only products that meet the accessibility requirements of the Act. Article 4(1) of Directive (EU) 2019/882 is the source of that duty. Section 2(1) applies the Act to the products that it lists and that are placed on the market after 28 June 2025.

The listed products are hardware systems for consumer general-purpose computers and their operating systems, payment terminals, ATMs, ticketing machines, check-in machines, interactive information self-service terminals, consumer terminal equipment with interactive computing capability used for electronic communications services or for access to audiovisual media services, and e-readers.

Interactive information self-service terminals are not covered where they are installed as integral parts of vehicles, aircraft, ships or rolling stock. Section 4(2) applies Sections 1 and 2 of Annex 1 to products, and only Section 1 of Annex 1 to the self-service terminals of section 2(1), item 2.

Section 5(1) presumes conformity with the accessibility requirements for products that meet harmonised standards, or parts of them, whose references are published in the Official Journal of the European Union. Section 9(1) allows a manufacturer to place a product on the market only if it was designed and manufactured to the requirements of section 4(2).

Section 9(2) requires the manufacturer to draw up the technical documentation and carry out the conformity assessment of Annex 2, and, once conformity is shown, to issue an EU declaration of conformity and affix the CE marking. Section 9(3) requires the manufacturer to keep the technical documentation and the EU declaration of conformity for five years after the product is placed on the market.

Section 9(8) requires the manufacturer, where a product it has placed on the market does not conform, to take the corrective measures needed to restore conformity or to withdraw the product. Where such a product does not meet the requirements, section 9(8) also requires the manufacturer to inform the Sozialministeriumservice and the market surveillance authorities of the Member States where it supplied the product, and to keep a register of non-conforming products and complaints.

Section 10 lets the manufacturer appoint an authorised representative in writing, but the representative cannot take over the manufacturer's duty to design and manufacture to the requirements or to draw up the technical documentation. Section 11(1) allows an importer to place only conforming products on the market.

Section 11(2) allows an importer to place a product on the market only if the manufacturer carried out the conformity assessment and drew up the technical documentation, the product bears the CE marking and carries the required documents, and the manufacturer met its identification duties.

Section 12(2) allows a distributor to make a product available only after checking the CE marking, the accompanying documents with the instructions and safety information in German, and the manufacturer's and importer's identification details. Section 13 treats an importer or distributor as a manufacturer if it places a product on the market under its own name or brand, or changes a product already on the market so that its conformity may be affected.

Section 17(1) applies the requirements only so far as compliance does not need a significant change that fundamentally alters the basic nature of the product. Section 18(1) applies the requirements only so far as compliance does not impose a disproportionate burden on the economic operator.

An operator that relies on either exception for a product must assess it, document the assessment for five years, and inform the Sozialministeriumservice and the market surveillance authorities of the Member State where the product is placed on the market. Sections 17(5) and 18(5) exempt microenterprises that deal with products from documenting and notifying the assessment, but they must give the Sozialministeriumservice the facts relevant to the assessment on request.

Section 18(7) bars an operator that received public or private funds, other than its own, to improve accessibility from relying on section 18(1). Section 33 requires the Zollamt Österreich to cooperate with the Sozialministeriumservice in market surveillance under Chapter VII of Regulation (EU) 2019/1020. Section 3, item 19 defines a microenterprise by the number of persons it employs and by its annual turnover or annual balance sheet total.

Section 36(1) fines a person who places a product on the market in breach of section 9(1) or section 11(1), or in breach of the first sentence of section 11(3), or who makes a product available in breach of the first sentence of section 12(3), up to EUR 80,000. If a microenterprise or a small or medium-sized enterprise commits that offence, the fine is up to EUR 50,000.

Section 36(2) fines formal breaches by manufacturers, importers and distributors, such as a missing conformity assessment, EU declaration of conformity, technical documentation, identification, CE marking or corrective measure, up to EUR 40,000. Section 36(3) fines failures to keep the documentation for five years, to inform the Sozialministeriumservice, to hand over documents or to cooperate up to EUR 16,000.

Section 14(1) of the BaFG allows a service provider to offer or provide a service only if it is designed, offered and provided to the accessibility requirements of section 4(3). Article 13(1) of Directive (EU) 2019/882 is the source of that duty. Section 3, item 4 defines a service provider as any natural or legal person that provides a service on the Union market or offers to provide such a service to consumers in the Union.

Section 2(2) applies the Act to the services that it lists and that are provided to consumers after 28 June 2025.

Those services are electronic communications services other than emergency calls and machine-to-machine transmission services, services giving access to audiovisual media services, the websites, mobile services including apps, electronic tickets, transport information and interactive self-service terminals of air, bus, rail and waterborne passenger transport, consumer banking services, e-books and dedicated software, and e-commerce services.

For transport information screens, item 3 covers only interactive screens within the territory of the Union, and it does not cover terminals installed as integrated parts of vehicles, aircraft, ships and rolling stock used to provide such passenger transport services.

Section 3, item 25 defines consumer banking services as credit agreements within the meaning of Directive 2008/48/EC or Directive 2014/17/EU, certain services listed in Directive 2014/65/EU, payment services, services linked to a payment account and electronic money, provided to consumers.

Section 3, item 27 defines e-commerce services as services provided at a distance, through websites and mobile device-based services, by electronic means and at the individual request of a consumer with a view to concluding a consumer contract. For urban, suburban and regional transport services, section 2(2), item 3 covers only the interactive self-service terminals.

Section 2(3) excludes from websites and mobile applications recorded time-based media and office file formats published before 28 June 2025, online maps and map services that give essential navigation information in accessible digital form, third-party content the operator neither finances, develops nor controls, and archive content. Section 2(4) leaves section 42d of the Urheberrechtsgesetz and Regulation (EU) 2017/1563 on the cross-border exchange of accessible-format copies unaffected.

Section 7 deems services that meet the provisions on accessible information and information on accessibility in the Union passenger-transport acts to meet the corresponding requirements of the Act, and applies the Act's additional requirements in full. Section 4(3) applies Sections 3 and 4 of Annex 1 to services, and only Section 4 of Annex 1 to urban, suburban and regional transport services.

Section 3 of Annex 1 requires websites, their online applications and mobile services including apps to be made perceivable, operable, understandable and robust in a consistent and adequate way. Section 4 of Annex 1 adds requirements for specific kinds of service. Section 5(1) presumes conformity with the accessibility requirements for services that meet harmonised standards, or parts of them, whose references are published in the Official Journal of the European Union.

Section 6(1) exempts microenterprises that offer or provide services from the accessibility requirements of section 4(3) and from all obligations connected with meeting them. Section 3, item 19 defines a microenterprise by the number of persons it employs and by its annual turnover or annual balance sheet total. Section 6(2) requires the federal ministries responsible for social affairs and for the economy to draw up guidelines that help microenterprises apply the Act.

Section 14(2) requires the provider to prepare the information of Annex 3, make it available to the public in written and oral form, including in a form accessible to persons with disabilities, and keep it for as long as the service is offered. Annex 3 requires the provider to state in its general terms and conditions or a similar document how the service meets the accessibility requirements of section 4(3).

Section 14(3) requires the provider to keep procedures in place so that the requirements are always met while the service is offered or provided. Section 14(4) requires the provider, where a service does not conform, to take the corrective measures needed and to inform the Sozialministeriumservice and the competent authorities of the Member States where the service is provided, with details of the non-conformity and the measures taken.

Section 14(5) requires the provider to hand over to the Sozialministeriumservice, on its reasoned request, the information and documents in German or English that show conformity, and to cooperate in remedying non-conformity. Section 15(1) requires a provider that provides services through self-service terminals to prepare information on whether, and to what extent, the built environment of the terminals that falls within its responsibility is accessible, and to make it available to the public.

Article 4(4) of the Directive lets Member States decide that the built environment used by clients of covered services complies with its Annex III. Section 17(1) applies the requirements only so far as compliance does not need a significant change that fundamentally alters the basic nature of the service. Section 18(1) applies the requirements only so far as compliance does not impose a disproportionate burden on the economic operator.

A service provider that relies on section 18(1) must repeat its assessment for each category or type of service when the service changes, when the Sozialministeriumservice asks, and at least every five years. Section 18(7) bars an operator that received public or private funds, other than its own, to improve accessibility from relying on section 18(1).

Section 37(2) lets service providers continue until 28 June 2030 to offer or provide their services using products that they lawfully used for similar services before 28 June 2025. Service contracts agreed before 28 June 2025 may continue unchanged until they expire, but for no longer than five years from that date.

Under section 37(3), self-service terminals that a provider lawfully used before 28 June 2025 may stay in use for comparable services until the end of their economic useful life, but not longer than 20 years after first use and not beyond 28 June 2040. Section 36(1), item 3 fines a person who offers or provides a service in breach of section 14(1) up to EUR 80,000, and up to EUR 50,000 where the offender is a microenterprise or a small or medium-sized enterprise.

Section 36(2), item 2 fines a failure to prepare the Annex 3 information properly, up to EUR 40,000. Section 36(3), item 3 fines a failure to provide the Annex 3 information or to keep it for as long as the service is offered, up to EUR 16,000. Section 36(3), item 7 fines a failure to prepare or provide the information on the built environment of self-service terminals, up to EUR 16,000.

Section 21 of the BaFG makes the Sozialministeriumservice, the Bundesamt für Soziales und Behindertenwesen, responsible for the official acts that the Act provides for, unless the Act provides otherwise. The Sozialministeriumservice has placed the central market surveillance under the Act in its Landesstelle Oberösterreich. Directive (EU) 2019/882 requires Member States to designate the authorities that check the compliance of services.

Section 22(3) requires the Sozialministeriumservice to check whether products and services meet the requirements and whether economic operators meet their duties. Section 23(1) lets the Sozialministeriumservice test products and services, and requires the economic operator to make the tools and access data needed for a full test available free of charge for the duration of the test.

Section 23(3) lets the Sozialministeriumservice buy products and use services under a false identity for the purpose of market surveillance. Section 23(7) allows the Sozialministeriumservice to check self-service terminals only after timely prior notice, and requires the operator to keep the terminal undisturbed for the time needed. Section 23(9) lets the Sozialministeriumservice oblige an operator whose product or service fails the check to bear the costs of the check by notice (Bescheid).

Under section 26, where a product does not meet the requirements, the Sozialministeriumservice requires the operator to take all suitable corrective measures within a set period, and, if it has taken none within that period, to withdraw or recall the product within a further period.

Where the operator takes no suitable corrective measures, section 26(4) requires the Sozialministeriumservice to take provisional measures by notice to withdraw or recall the product or to prohibit or restrict its availability on the Austrian market. Before a request under section 26(1), the Sozialministeriumservice must give the operator the result of its investigation and at least ten working days to comment.

Sections 28(3) and 29(5) give a service provider or other operator the same opportunity before a request or notice concerning a service or a formal non-conformity. Section 30 requires measures ordered by notice to be lifted in whole or in part, on the addressee's application, once it shows the Sozialministeriumservice that the lawful state has been restored.

Under section 28(1), where a service does not meet the requirements, the Sozialministeriumservice requires the provider to take corrective measures within a set period, and by notice must oblige the provider to take corrective or other proportionate measures such as informing the public of the non-compliance or ceasing to offer or provide the service.

Under section 29(1), the Sozialministeriumservice requires an operator to correct a formal non-conformity, such as a missing or wrongly affixed CE marking, a missing EU declaration of conformity, incomplete technical documentation or missing manufacturer or importer details. If the formal non-conformity persists, section 29(2) requires the Sozialministeriumservice to restrict or prohibit the product by notice, or to have it withdrawn.

Section 29(3) and (4) apply the same two steps to a service provider that has not prepared the Annex 3 information or has not made it available to the public in accessible form. Section 31 allows an appeal against a notice of the Sozialministeriumservice to the Bundesverwaltungsgericht. Section 33 requires the Zollamt Österreich to cooperate with the Sozialministeriumservice in market surveillance under Chapter VII of Regulation (EU) 2019/1020.

Section 22(5) requires the Sozialministeriumservice to give a consumer, on request and in an accessible format, the information it holds on an economic operator's compliance and the operator's assessments under sections 17(2) and 18(2). Section 35(1) and (2) give consumers, the Verein für Konsumenteninformation, the Österreichischer Behindertenrat, the Bundesarbeitskammer and the Wirtschaftskammer Österreich the right to report possible infringements to the Sozialministeriumservice.

Section 35(3) requires the Sozialministeriumservice to examine the report and to tell the reporting person or organisation in writing, in an accessible format and within eight weeks, whether it will conduct proceedings, giving reasons if it will not. Section 36(6) excludes the fines of section 36(1) to (3) in award procedures under the Bundesvergabegesetz 2018 and the Bundesvergabegesetz Konzessionen 2018.

Section 35(4) excludes the reporting right of section 35(1) to (3) in the same award procedures. Section 36(4) requires the scale of the breach, in particular the number of products or services and persons affected, and whether the breach is a repeat breach, to be taken into account in setting the fine. Section 36 makes each breach it lists an administrative offence (Verwaltungsübertretung) that the Sozialministeriumservice punishes with a fine.

Section 9(1) and (7) of the Verwaltungsstrafgesetz 1991 makes the person authorised to represent a legal person externally answerable for its compliance with administrative provisions, unless those provisions provide otherwise or a responsible agent has been appointed, and makes the legal person jointly liable for the fine.

Section 16 of the Verwaltungsstrafgesetz 1991 requires a substitute term of imprisonment to be set with every fine for the case that it cannot be collected, of at most two weeks where the offence carries no prison term. Section 36(5) allocates the fines to the Federation, which pays them into the support fund for persons with disabilities for participation projects.

The Sozialministeriumservice states that the conciliation procedure of the Bundes-Behindertengleichstellungsgesetz is carried out by its Landesstellen, not by the market surveillance authority under the BaFG.

Section 2(2) of the Bundes-Behindertengleichstellungsgesetz applies the Act to legal relationships, including their initiation and formation, and to the use or assertion of services outside a legal relationship, so far as access to and the supply of goods and services available to the public is concerned and the Federation (Bund) has direct regulatory competence.

Section 2(3) excludes the protection against discrimination in employment, which section 7a of the Behinderteneinstellungsgesetz governs. Section 4(1) provides that no one may be directly or indirectly discriminated against because of a disability.

Section 5(2) provides that indirect discrimination exists where apparently neutral rules, criteria or procedures, or features of designed living areas, can place persons with disabilities at a particular disadvantage compared with others, unless they are objectively justified by a legitimate aim and the means are appropriate and necessary.

Section 6(1) provides that indirect discrimination does not exist where removing the conditions that cause the disadvantage, in particular barriers, would be unlawful or unreasonable because of disproportionate burdens. Section 6(2) lists, among the factors for assessing whether a burden is disproportionate, the effort of removal, the economic capacity of the party denying discrimination, public funding for the measures and the time since the Act came into force.

Under section 6(3), where removal proves a disproportionate burden, discrimination exists if reasonable measures were not taken to achieve at least a significant improvement of the person's situation, approaching equal treatment as closely as possible. Section 6(4) requires the assessment of indirect discrimination through barriers to check whether accessibility rules apply to the case and whether and to what extent they were met.

Under section 6(5), structures and other facilities, means of transport, technical objects of daily use, information-processing systems and other designed areas of life are barrier-free if persons with disabilities can access and use them in the generally customary way, without particular difficulty and in principle without outside help.

The federal ministry reads the Act as providing that a lack of accessibility can amount to disability discrimination, but only where removing the barrier is legally possible and reasonable. The ministry states that the Barrierefreiheitsgesetz and the equal-treatment law do not compete with each other. Section 9(1) gives a person whose discrimination ban under section 4(1) was breached a claim for compensation of the pecuniary loss and for compensation for the personal impairment suffered.

Section 10(2) allows other claims under the Act to be brought before the ordinary courts only if a conciliation procedure before the Sozialministeriumservice took place first. The court claim is admissible only if no amicable settlement was reached within three months of the start of the conciliation procedure.

Section 14(1) and (2) has the conciliation procedure conducted at each Landesstelle of the Sozialministeriumservice and starts it when the person claiming discrimination files a request for conciliation. Under section 10(3), a claim for harassment must be brought in court within one year and every other claim within three years.

Section 13(1) lets the Österreichischer Behindertenrat, the Klagsverband and the Behindertenanwalt bring an action for a declaration, and against large corporations also for an injunction and removal, where a breach significantly and lastingly affects the general interests of the protected group. Section 19(1) provides that the Act takes effect on 1 January 2006.

Section 34(1) of the BaFG makes the accessibility requirements of Annex 1 mandatory accessibility requirements, for the products and services that the Act covers, within the meaning of sections 107(1) and 275(1) of the Bundesvergabegesetz 2018 and section 60(1) of the Bundesvergabegesetz Konzessionen 2018. Article 24(1) of Directive (EU) 2019/882 is the source of that rule.

Section 107(1) of the Bundesvergabegesetz 2018 requires a contracting authority that procures a performance intended for use by natural persons to set the technical specifications so that design for all, including accessibility for persons with disabilities, is taken into account. Where mandatory accessibility requirements follow from a legal act of the European Union, the technical specifications must refer to them so far as those criteria are concerned.

Section 107(2) allows the contracting authority to depart from that duty in objectively justified cases. Such a case exists in particular where the contracting authority can assume that persons with disabilities are not expected to use the performance, or where the estimated additional costs of taking the criteria into account are disproportionate.

Section 275(1) states the same duty for a sector contracting entity (Sektorenauftraggeber) that procures such a performance above the threshold values, and section 275(2) allows the same departures.

Section 60(1) of the Bundesvergabegesetz Konzessionen 2018 requires a contracting entity that procures, above the threshold values, a performance intended for use by natural persons to set the technical and functional requirements so that design for all, including accessibility for persons with disabilities, is taken into account and to refer to mandatory accessibility requirements that follow from a legal act of the European Union.

Section 60(2) of that Act allows the same departures in objectively justified cases. Sections 107 and 275 of the Bundesvergabegesetz 2018 and section 60 of the Bundesvergabegesetz Konzessionen 2018 have applied in their current wording since 21 August 2018. Section 34(3) of the BaFG treats those mandatory accessibility requirements as met where harmonised standards and technical specifications, whose references are published in the Official Journal of the European Union, are used.

Section 34(2) of the BaFG lets the requirements of Annex 1, Section 5 be used to assess the accessibility that other federal laws prescribe for features, components or functions of products or services outside the Act. Section 36(6) excludes the fines of section 36(1) to (3) in award procedures under the Bundesvergabegesetz 2018 and the Bundesvergabegesetz Konzessionen 2018.

A video-sharing platform provider must ensure that content of gratuitous violence, and content that mainly consists of the unreflective depiction of sexual acts, is subject to effective access control by age verification. The provider must also make content that can impair the development of minors available only in a way that minors do not usually follow it, for example through parental control systems, and must let users rate that content with an easy function.

The duties apply to video-sharing platforms of providers established in Austria within the meaning of the E-Commerce Act. Failing to take the measures that keep harmful content away from minors, or that put content of that kind behind effective access control, is an administrative offence punishable by a fine of up to 150,000 euros.

A service provider that produces a press publication, in analogue or digital form, on its own initiative and under its own editorial responsibility and oversight, holds the exclusive right to reproduce the whole publication or parts of it, and to make it available to the public online, within an information-society service.

A press publication is a collection of predominantly journalistic literary works, published under a common title as a periodically appearing or regularly updated title such as a newspaper, magazine, or journal, and intended to inform the public about news or other topics; scientific and academic periodicals are expressly excluded. The right lasts two years from the press publication's own publication, and cannot be exercised to the detriment of an underlying author's or performer's own rights.

The right does not extend to private or non-commercial use of press publications by individual users, to the setting of hyperlinks, or to the use of individual words or very short extracts.

Section 42h(6) UrhG lets any person, for their own use, reproduce a work they have lawfully accessed in order to mine text and data in digital form automatically. This general exception does not apply where the rightsholder has expressly prohibited the reproduction and signaled that prohibition adequately, in particular through machine-readable means for a work made available online.

This is Austria's transposition of the Digital Single Market (DSM) Directive's general, opt-out-based text-and-data-mining exception, distinct from the narrower, non-waivable scientific-research exception in Section 42h(1) to (5).