The EU AI Act in Austria

The AI Act, Regulation (EU) 2024/1689, applies directly and is published in the Official Journal of the EU, not as a federal act in the RIS. Austria still has to designate the authorities that supervise the market and notify conformity assessment bodies, and set penalty rules (Articles 70 and 99). The deadline was 2 August 2025. No such law has been adopted: according to APA in August 2026, the Federal Chancellery is drafting a government bill but could not yet name a consultation date.

Blogs often cite a "KI-Servicestelle-Gesetz (KISG)", but no law with that title appears in the RIS. The KI-Servicestelle rests on an amendment to the KommAustria Act and the Telecommunications Act 2021, published on 26 February 2024 (BGBl. I Nr. 6/2024). It covers information, advice and an AI advisory board, not supervisory or penalty powers.

Because the regulation applies directly, its duties do not wait for a national authority. The prohibitions (Article 5) and AI literacy (Article 4) have applied since 2 February 2025. The Digital Omnibus, Regulation (EU) 2026/1744 in force since 27 July 2026, reworded Article 4: providers and deployers must take measures to support the AI literacy of their staff, without a guaranteed level. Further prohibitions apply from 2 December 2026.

The transparency duties in Article 50 have applied since 2 August 2026: disclose chatbots, label deepfakes and label AI-generated text on matters of public interest unless it is editorially reviewed. High-risk duties apply from 2 December 2027 for Annex III systems and from 2 August 2028 for AI in Annex I products. The Federal Chancellery has stressed that businesses must comply even though no Austrian authority is designated yet.

There is no statutory course or certificate. The KI-Servicestelle states that the AI Act leaves the form of the measures open: internal training, external advice or in-house sessions can all work, and no certifications exist at present. It recommends a written AI strategy, an internal AI policy and a record per employee of the type, content, date and provider of each training.

The AI Act itself attaches no administrative fine to Article 4. RTR points out, however, that missing staff training is generally attributable to the business under § 1313a ABGB. If a lack of AI literacy causes damage, Article 4 supports the view that training was owed, so the duty can matter for civil liability.

Austrian labour law applies alongside the AI Act. Under § 96(1)(3) ArbVG, control measures and technical systems that affect human dignity need the works council's consent. § 96a ArbVG covers systems that process employees' personal data beyond general details and systems that assess employees; here the arbitration board can replace consent. Where there is no works council, § 10 AVRAG requires each employee's consent for such control measures.

Whether a given AI tool falls under these rules depends on how it is used. For high-risk AI at work, Article 26(7) also requires employers to inform workers’ representatives and affected staff before putting it into service. Where personal data is processed, the GDPR and the Austrian DSG apply in parallel.

The RTR KI-Servicestelle answers questions by email, runs an FAQ, an AI Act chatbot, webinars and a newsletter, and provides graphics on the transparency duties. The WKO offers its AI Act page, the KI-Guidelines for SMEs and sector pages on labelling, for example for trades and tourism. Both help with orientation but do not replace legal advice or a binding decision by an authority.