Austria

Currently, there are no specific constitutional provisions regulating AI systems and no decisions referring to them.

However, within the framework of the AIM Strategy 2030 presented in summer 2021, the Austrian federal government intends to create a legal framework for placing AI on the market, putting it into operation and using it safely, thus guaranteeing the fundamental rights of citizens. The AI strategy was developed and presented as an agile strategy, and is, therefore, open to clarifications and additions. The first addition was made in November 2024 with the so-called AI implementation plan (www.digitalaustria.gv.at/verwaltung/strategien/ki-aim-at-2030.html). All departments within the AI Policy Forum, as well as experts from research, science, business and other stakeholders will be involved in the development process. See www.bmf.gv.at/presse/pressemeldungen/2023/september/ki-massnahmenpaket.html.

The federal government has declared its intention to actively participate at international level in order to strengthen and concretise the international legal framework (especially regarding human rights and international humanitarian law) for the digital space and to develop standards for the ethical use of AI in accordance with human rights.

The right to privacy is constitutionally protected in section 1 of the Data Protection Act (DPA). According to this law, everyone (both natural and legal persons) has the right to confidentiality of personal data concerning them, in particular with regard to respect for their private and family life, insofar as there is an interest worthy of protection. The existence of such an interest is only excluded if data is not accessible to a claim to secrecy due to its general availability or due to its lack of traceability to the person concerned. AI systems that are trained with personal-related data or used for personal related decisions can infringe this right.

The “right to informational self-determination” is recognised from this claim to secrecy under section 1(1) of the DPA. Although the right to informational self-determination is not expressly affirmed, it can be derived from human dignity and general principles of the rule of law and is also recognised by the case law of the Austrian Constitutional Court (see Constitutional Court 27.6.2014, G 47/2012, G 59/2012, G 62/2012, G 70/2012, G 71/2012). The right to informational self-determination guarantees the freedom of the individual to decide when and within what limits personal facts of life are disclosed. If data or predictions from a person’s behaviour are made by means of, or by creating links, it is precisely this right that seems to be violated, as the data subject has no influence on the information generated about them regarding customer affiliations, interests, behaviours or life models, which indisputably concern their private life.

Against this background, it can be particularly problematic that the data subject has no ability to influence the profile/output created about them by the AI system. However, such circumstances have not yet been the subject of a decision.

There are no decisions or conventions that refer to AI.

Artificial intelligence regularly involves mathematical solutions that are realised in software, i.e. computer-implemented processes. In Austria, these are only accessible to patent protection to a limited extent, as computer programs are not patentable (section 1(3) of the No. 5 Patent Act). Rather, the program must have a “further technical effect” (see Austrian Supreme Court 25.8.2016, 4Ob94/16a). AI systems would, therefore, have to contribute to solving a concrete technical problem with technical means, such as the control of an autonomous vehicle, for a patent to be granted.

The protection of investment in AI developments is fragmented. An algorithm, which is typically a mathematical rule, cannot be protected as a computer program under section 40a of the Austrian Copyright Act. It is, however, not yet decided, whether a trained model can be protected under the Copyright Act. Only the AI-system as AI-based software would be protected under section 40a of the Austrian Copyright Act. The developer of the software or the entity that introduced the algorithm into the AI system, would, however, not be treated as the author of the output, because the output is not a component of the software and therefore not already created by the developer in the source code.

A vivid discussion is going on, whether the output data, which is the most valuable component of an AI system, can be protected under the Copyright Act due to often only minor creative human contribution.

According to the Austrian Supreme Court, if a computer converts millions of found image files into thumbnails completely independently and without further human intervention, this would not suffice for a protectable work. This would only be the case with the help of a program that has been defined once and is thus no longer used merely as an aid to human activity and moreover takes over the tasks of a human creator in their entirety (Austrian Supreme Court on 20 September 2011, 4 Ob 105/11m). Even if this decision did not refer to an AI system, the circumstances are comparable to such situations where the AI entity is able to fully autonomously create a work (without human intervention). Only a product of the human mind can be protected by copyright law, which is regularly not the case with artificially generated works, because the output lacks any reference to the intellectual process and creative will of a human being. If a human being subsequently gives the work personal traits through their specific commands and the further development of the artificially generated suggestions, it might be eligible as a protected work. However, the personality of the creator must be expressed in such a way that the work is stamped with the hallmark of uniqueness and belonging to its creator (established case law since Austrian Supreme Court 7 March 1978; 4 Ob 317/78). For such artificially generated works (without human intervention in the described way), no regulations exist.

If the artificially generated work was created with any human intervention, there are already national rules for analysing who has influenced the machine in such a creative manner that they would be treated as author (or co-author). These rules also apply to the question whether the prompter controls the AI through instructions and optimises the results through further prompts, such that the output can be considered to stem from the personality of the prompter, and therefore its performance is to be attributed a creative quality in the final result.

As with other creative processes, it is rather a matter of individual assessment and depends on the individual circumstances whether the prompter has created the intellectual-aesthetic content of the work through their creative performance, or whether the technical performance predominates. Hence, this will be determined on a case-by-case decision by the national courts.

The Austrian Copyright Act does not provide further rules in the sense of related rights that protect the investments in the original algorithm and database for deep learning (similar to database protection).

According to section 26b of the Austrian Unfair Competition Act (UCA), a trade secret is information that is:

• secret because it is neither generally known nor readily accessible, either in its entirety or in the precise arrangement and composition of its components, to persons in the circles normally concerned with this type of information;
• has commercial value because it is secret; and
• is subject to reasonable confidentiality measures appropriate to the circumstances by the person exercising legitimate control over that information.

This broad range of potentially protectable commercial information suggests that data more generally may also be covered. Simple raw data will regularly lack the requirements under section 26b(1) of the UCA, but this does not necessarily apply to the refined data in a particular compilation, which, as such, is not generally known or readily accessible and has commercial value. These criteria could be applicable to recognised patterns and weights created during the training of a model for an AI system. A prerequisite for protection would be that the individual variables of the calculation within the model remain secret, which, however, could possibly collide with the transparency requirement under the General Data Protection Regulation (GDPR) and in the proposal of the AI Act.

An Austrian court has not yet decided in a case with such circumstances. Hence, it is unclear whether components of an AI system could be protected as trade secrets.

There are no notable cases in Austria dealing with the protection of AI components.

According to section 285 of the Austrian Civil Law Act, everything that is distinct from a person and serves for the use of people is called a thing in the legal sense. The prerequisite for qualification as a thing is that it is controllable and exists in a limited, available quantity; otherwise, it would be common property. According to this definition, data is consistently understood as a legal thing, but there is no agreement as to whether it is generally to be treated as a tangible or intangible thing. The predominant Austrian commentary literature assumes that data not stored on a data carrier should be treated as an intangible thing.

However, no authority or court has decisively addressed the ownership of data. Although data is supposed to be marketable largely like other intangible goods and can therefore be the subject of a purchase, it is largely unclear which provisions on purchase as a title for the acquisition of ownership actually apply.

Provided that AI systems process personal related data (be it as input or as output), the European GDPR and the national provisions in the DPA apply. The Austrian Data Protection Authority (DSB) has not yet commented on questions of the permissibility of data processing and the rights of data subjects in AI in a decision; however, on 29 April 2024 a complaint against OpenAI was filed by the Austrian privacy activist Max Schrems and his non-governmental organisation None of Your Business (NYOB) (see, e.g. www.euractiv.com/section/digital/news/schrems-ngo-files-gdpr-complaint-against-openai-over-ai-hallucinations), which centred on the issue that ChatGPT does not ensure accurate processing of data (Article 5(1)(d), GDPR), criticising the fact that generating answers to user requests is achieved by a process of mathematical correlation, i.e. by predicting the most statistically likely words to appear in a sequence. The DSB has referred the case to the Irish Data Protection Authority with a decision still pending.

In April 2024 the DSB published FAQs (see www.dsb.gv.at/kuenstlichebrintelligenz/kuenstliche-intelligenz-datenschutz) in which it generally emphasises the validity of the GDPR when using AI systems and describes the processing principles, but does not address specific interpretive questions such as. in which training phase data processing takes place or how the deletion of data from a training corpus should be implemented).

The DSB has also recently, in its notification of 28 May 2024 (D036.500/2024 2024-0.380.937), commented on the relationship between the GDPR and the AI Act. In summary the opinion of the DSB is as follows:

• The GDPR remains applicable even after the AI Act comes into force if personal data is processed.
• Where personal data is processed in the context of the use of AI systems, this is only permissible if the data protection principles pursuant to Article 5 of the GDPR are complied with. In particular, a justification pursuant to Article 6(1) (and where applicable, Article 9(2) GDPR) must exist.
• Where Article 22 of the GDPR (automated decisions in individual cases including profiling), the requirements of this provision shall apply.
• In accordance with Article 5(2) of the GDPR, the controller bears the burden of demonstrating that the processing is lawful.

Furthermore, in connection with AI systems the obligation to conduct a data protection impact assessment was re-emphasised by the DSB. Article 35(4) of the GDPR provides that the national supervisory authority shall draw up and publish a list of processing operations for which a data protection impact assessment must be carried out (the so-called blacklist). The DSB has made use of this provision and implicitly refers to AI technologies as being subject to it.

There are three factors that could be applicable to AI systems according to section 2(1) of this blacklist:

• Data processing which involves the evaluation or classification of natural persons, including profiling and forecasting, for purposes relating to the performance at work, economic situation, health, personal preferences and interests, reliability or conduct, location or change of location of the person and which are based solely on automated processing and are likely to produce adverse legal, physical or financial effects.
• Processing of data intended to evaluate the behaviour and other personal aspects of natural persons, which may be used by third parties to produce automated decision-making, which produces legal effects concerning the persons evaluated or similarly significantly affects them.
• Processing of data using or applying new or novel technologies or organisational solutions which make it more difficult to assess the impact on data subjects and the societal consequences, in particular through the use of artificial intelligence and the processing of biometric data, provided that the processing does not concern the mere real-time rendering of facial images.

Apart from the fact that the provisions on profiling (Article 4(4), GDPR) and automated individual decision-making (Article 22, GDPR) are of particular relevance for AI, as almost all AI systems are designed to assess human characteristics and because machine learning works by definition with automated decisions then the right to access (Article 15, GDPR) is also of relevance.

According to a decision of the DSB (8 September 2020, DSB 2020-0.436.002), the scope of the right of access also includes the right to be informed of all relevant elements of an automated decision. This is intended to ensure the comprehensibility, correctness and up-to-dateness of the input variables in the case of the data subject. However, the information does not include the logic of the algorithm, its source code, its compilation code or its complete documentation. It is apparent that in making its decision, the DSB overlooked the fact that certain calculation methodologies are almost certainly subject to know-how protection.

Directive (EU) 2019/1024 on open data and the re-use of public sector information (recast) [2019] OJ L172/56 is applicable from 17 July 2021. It replaces Directive 2003/98/EC on the re-use of public sector information, as amended by Directive 2013/37/EU. The Austrian Act on the Further Usage of Public Institutions’ data (Informationsweiterverwendungsgesetz, IWG), Federal Law Gazette I No. 116/2022 as of 27 July 2022, is intended to implement Directive (EU) 2019/1024 by the Federal Government. The Directive introduces several innovations and is not merely an amendment, but establishes a new legal framework. In parallel, legislative measures by the federal states are also required.

Section 6 IWG requires a written application for the re-use of documents held by public bodies to be submitted to the public body in whose possession the requested document is located. The application must clearly state the content, scope and manner of the intended re-use of the documents. With regard to personal data in such documents, reference is only made to the applicability of the GDPR. However, the draft does not set out the criteria to be used when balancing the interests of further use against those of the data subjects for confidentiality.

The obligation to facilitate reuse does not, however, mean that the IWG creates a right of access to documents. This is instead achieved by the Freedom of Information Act (Informationsfreiheitsgesetz, IFG), Federal Law Gazette No I 5/2024 as of 26 February 2024, effective since 1 September 2025. For example, the IFG provides access to information, either through the proactive publication of data in the public interest (section 4, IFG) or through individual requests for information (section 7, IFG).

According to section 2(1) of the blacklist (see Section 3.2, above), the processing of biometric data is also subject to a privacy impact assessment.

The principles of equal treatment in Austria are primarily laid down in the following laws:

• Federal Equal Treatment Act (Gleichbehandlungsgesetz (GlBG)) governing the private sector and other areas.
• Federal Act on Equal Treatment in the Federal Sector (Bundes-Gleichbehandlungsgesetz (B-GlBG)) governing employment relationships in the federal service.

The GIBG protects against discrimination in employment on the grounds of gender (in particular with reference to marital status or parental status), ethnicity, religion or belief, age and sexual orientation. Discrimination on these grounds is prohibited in the establishment of the employment relationship, in the determination of remuneration, in the granting of voluntary social benefits, in training and retraining measures, in career advancement (in particular promotions) in other conditions of employment, and in the termination of employment.

An issue in the context of AI systems is that discrimination often occurs indirectly. Hence, the unequal treatment of a person is not obviously due to one of the above-mentioned grounds of discrimination, but due to the apparently neutral regulation, which may have disadvantageous effects. For example, the model is supposed to exclude all part-time employees, which in the output leads to only men being included because statistically the majority of the part-time positions are more often held by women. This is indirect discrimination. The Austrian courts have not yet addressed this issue.

As part of the federal government’s strategy for artificial intelligence (Artificial Intelligence Mission Austria 2030, Vienna 2021; Section 9.2, below), it was generally recognised that, while AI systems must be protected against attacks on IT systems, at the same time AI systems must be used in a supportive manner to improve IT security. The Austrian government has therefore committed to supporting the development of models and methods for the security of AI systems. In addition, standards for the resilience of AI systems against attacks and security breaches and the reliability and reproducibility of AI results are to be promoted, and concepts for auditing AI systems are to be developed with experts at national and European level.

In Austria, a number of open research questions relating to security and security testing have been identified in the use of AI-based systems. Traditional approaches in the field of security testing, especially penetration testing, and strategies and techniques such as fuzzy testing, show problems when applied to modern algorithms that require further research. In order to address these issues early on in the procurement process, a guide for companies to purchase the most secure AI possible was developed by the St. Pölten University of Applied Sciences and made available on the website of the Austrian Federal Chancellery (www.onlinesicherheit.gv.at/Services/News/Beschaffung-sicherer-AI-Ein-praktischer-Leitfaden.html), which makes it possible to determine:

• whether a product is based on fundamental security considerations;
• how essential issues such as control over data and models, patching and the like are handled; and
• whether a suitable contact person is available to answer such questions sensibly and correctly.

Despite these strategies and initial approaches in Austria to create safe and robust AI systems, there are currently no official recommendations or efforts to enshrine this in law.

So far, in Austrian antitrust practice, no decision by the national competition authorities and courts addresses AI-related market abuses.

In its thesis paper “Digitalisation and Competition Law” (Digitalisierung und Wettbewerbsrecht), the Austrian Federal Competition Authority (FCA) suggests reversing the burden of proof with regard to cases of abuses typical of the digital economy. In the FCA’s view, this appears justified where there is a prima facie case of abusive conduct or where official investigative actions encounter natural or technical limits. It would then be up to the (dominant) companies to explain, with recourse to the data available to them, why a certain practice or conduct does not have anticompetitive abusive effects. Following that concept, with regard to AI, undertakings concerned in the context of AI, for example, would have to prove that their algorithms do not abuse dominant position in the relevant market.

In its case report concerning its investigation of Amazon, the FCA when confronted with an alleged abuse of a dominant digital global player, first concluded that Amazon had market power, although the relevant market was not ultimately defined. In defending itself from complaints from retailers, Amazon argued that AI was needed in the running of its website. Following the Amazon investigation, the high number of fraud cases using sophisticated technologies made it necessary to take action against possible fraud using automated programmes and self-learning algorithms. The FCA did not comment on this in its report, but neither did it reject this argument.

In March 2024, the FCA submitted its contribution to the European Commission’s consultation on competition in virtual worlds and generative AI. Principally, the FCA views generative AI as an area with significant competition risks and stresses that issues of market power, entry barriers, data access, interoperability and the role of virtual worlds must be addressed early and closely in coordination with the European Commission. It explicitly highlights risks related to abuse of dominance, discriminatory conduct and structural shifts along entire value chains (see www.bwb.gv.at/fileadmin/user_upload/Barrierefrei_Competition_in_Virtual_Worlds_and_Generative_AI.pdf).

As of March 2026, no domestic competition rules or regulations addressing AI exist in Austria. Amendments introduced by the 2021 reform of the Austrian Cartel Act established new criteria in assessing market dominance — all of which address the digital economy. For example, the amended Cartel Act now refers, inter alia, access to relevant data and the benefits of network effects as exemplary criteria for determining market dominance.

No observation.

No observation.

No observation.

No observation.

No observation.

No observation.

Austria has already begun preparations for the AI Act. A national body has been established to coordinate and monitor the rules of the AI Act, namely the AI Service Centre, which was set up within the Austrian Regulatory Authority for Broadcasting and Telecommunications (RTR). A corresponding application was discussed in the Constitutional Committee of Parliament on 22 January 2024 and passed in the National Council on 31 January 2024.

The AI Service Centre is to be transformed into an AI authority under the EU Artificial Intelligence Act in a further expansion step. The aim is to ensure that AI systems placed on the EU market and used in the Union are safe and uphold the fundamental rights and values of the EU.

The same application submitted to the National Council on 22 January 2024 also included the establishment of an “Advisory Board for Artificial Intelligence”, also based at RTR. The 11-member advisory board was constituted on 28 February 2024 and advises policymakers on technical, social and ethical issues relating to artificial intelligence.

Austrian federal ministers presented the federal government’s strategy for artificial intelligence (shortly referred to as AIM AT 2030) including its goals and fields of action in September 2021. The key question is whether the current legal framework for product liability, product safety, data protection or consumer protection is sufficient for products with embedded AI or whether new regulations are needed, especially with regard to learning AI systems.

The Austrian strategy follows the European draft of the AI law and intends to use AI regulatory sandboxes to analyse how new innovative technologies function within the existing regulatory environment and thereby also offers the legislator the opportunity to gain important insights into whether and where there is a need for regulation.

In November 2024 the AI implementation plan was presented as an interim report and an extension of the AI strategy. It complements and specifies the strategy with new measures that are being implemented or planned in the short to medium term. The AI implementation plan provides an overview of 47 measures from all 12 federal ministries that are already being implemented or are currently being planned within the framework of the AI strategy for the period from 2024 onwards (see www.digitalaustria.gv.at/verwaltung/strategien/ki-aim-at-2030.html).