Which authorities are responsible for the CRA in Austria?
CERT.at as coordinating CSIRT and the Federal Chancellery as notifying authority; market surveillance authority, fallback procedure and accompanying act are still open.
| Function | Legal basis | Status in Austria (21 October 2026) |
|---|---|---|
| Coordinating CSIRT for CRA reports | Art. 14(7) CRA; § 11 NISG 2026 for coordinated disclosure | CERT.at, designated according to the ENISA list of 4 September 2026. Reports via the ENISA platform reach CERT.at and ENISA simultaneously. A formal Austrian designation act could not be found. |
| Notifying authority (for conformity assessment bodies) | Art. 35 et seq. CRA, to be established by 11 June 2026 | Federal Chancellery through the Cybersecurity Certification Authority under the CSZG; coordination with Akkreditierung Austria. |
| Market surveillance authority | Art. 52 et seq. CRA, to be established by 11 December 2027 | Open. In September 2026 the Federal Chancellery itself described the set-up as a “construction site”; alignment with market surveillance under the AI Act is planned. For supervised financial institutions a role of the FMA is conceivable but not determined. |
| Fallback procedure if the ENISA platform is down | ENISA FAQ of 17 September 2026, question 25 | Not published. Germany (e-mail to CERT-Bund) and Ireland have described national fallback routes; for Austria such guidance is missing. |
| National accompanying act (CRA-Begleitgesetz) | Implementation of the authority and penalty provisions | Planned path according to the Federal Chancellery: Council of Ministers March 2026, National Council April, Federal Council May, promulgation June 2026. We could not confirm adoption in the Federal Law Gazette at the time of our check. |
The Austrian Economic Chamber notes that reports via the Single Reporting Platform are automatically forwarded to CERT.at and ENISA; “I am an assigned representative” and the CSIRT Austria must be selected. According to the ENISA FAQ the manufacturer bears the risk of a wrong selection. Companies should enter their legal company name.
How high are the fines under Art. 64 CRA?
From EUR 15 million or 2.5 % to EUR 5 million or 1 % of worldwide annual turnover; enforcement needs a market surveillance authority.
| Infringement | Range |
|---|---|
| Essential requirements under Annex I; manufacturer obligations under Art. 13 and 14 (including reporting) | up to EUR 15 million or 2.5 % of worldwide annual turnover of the preceding year, whichever is higher |
| Other obligations of the regulation | up to EUR 10 million or 2 % |
| Incorrect, incomplete or misleading information to notified bodies or market surveillance authorities | up to EUR 5 million or 1 % |
| Exemptions (para. 10) | micro and small enterprises for missing the early-warning deadline; open-source software stewards for any infringement – the duty itself and the other enforcement powers remain |
Imposing fines requires a national authority. As long as market surveillance is not set up, enforcement is missing – not the duty. Art. 17(4) clarifies that a report under Art. 14 as such does not establish increased liability.
Product liability: Where does transposition of the new directive stand?
Directive (EU) 2024/2853 replaces the 1985 Product Liability Directive. Software is expressly a product (Art. 4(1)); a product can be defective because it does not meet safety-relevant cybersecurity requirements (Art. 7(2)(f)); and whoever fails to supply a necessary security update although able to cannot argue that the defect arose only later (Art. 11(2)(c)). The transposition deadline ends on 9 December 2026; the new rules apply to products placed on the market after that date.
The Product Liability Act applies in the version of Federal Law Gazette I No. 98/2001; the word software does not appear in it. Among the 141 ministerial drafts of the 28th legislative period none concerns product liability; no government bill or private member's bill exists; Austria has notified no transposition measure to the Commission. By comparison, Germany has had a government bill in the Bundestag since 25 February 2026 (printed paper 21/4297). Until an Austrian transposition act enters into force the old act applies; an interpretation contra legem is not possible even in conformity with the directive. How a late act treats products placed on the market between 9 December 2026 and its entry into force is decided by its transitional provision – which nobody knows because there is no text. The delay shifts the timing, not the direction.
Board liability: What must management organise under the CRA?
For management boards and managing directors the CRA is an organisational duty. § 84 of the Stock Corporation Act and § 25 of the Limited Liability Companies Act require the diligence of a prudent manager; § 39 of the Banking Act obliges credit institutions to adequate procedures for managing operational and ICT risk, which DORA specifies. Whoever has an app in the store under its own brand and has not organised reporting readiness since 11 September 2026 is breaching a duty that already applies – a circumstance that supervisors, auditors or the supervisory board will not treat as a future topic. The topic page Board liability places the duties of corporate bodies in context.
NISG 2026 and CRA: How do the reporting channels connect?
The NISG 2026 (Federal Law Gazette I No. 94/2025) has been in force since 1 October 2026; covered entities register with the cybersecurity authority by 31 December 2026. CRA reporting runs separately via the ENISA platform but reaches the same CERT.at. For financial entities DORA is the special regime for ICT incidents; a product incident can nevertheless touch all three routes – product (CRA), operator (DORA, to the FMA) and, where applicable, entity (NISG 2026).
What should an institution in Austria do now?
Five steps, from CERT.at in the runbook through aligning update processes with December 2027 to briefing management and supervisory boards.
- Record CERT.at as coordinating CSIRT in the runbook and the platform profile; document the direct contact route because no fallback procedure is published.
- Monitor the market-surveillance question – it decides who imposes fines and requests information under Art. 13(22).
- Set up support period and update process as if the Product Liability Directive already applied from 9 December 2026 – the legislator's delay does not change the direction.
- Include the CRA status in reporting to the board and supervisory board: product inventory, roles, reporting readiness, product class, open evidence.
- Track the delegated act under Art. 27(9), the Official Journal citation of standards and the accompanying act as dated watch points.
Frequently asked questions
To whom does an Austrian manufacturer report under Art. 14 CRA?
Via the ENISA Single Reporting Platform to CERT.at as coordinating CSIRT and simultaneously to ENISA. CERT.at must be selected in the report; the platform does not determine competence itself.
Which authority imposes CRA fines in Austria?
The market surveillance authority under Art. 52 et seq. CRA. It must be established by 11 December 2027 and was not designated as of 21 October 2026. The fine ranges of Art. 64 apply regardless.
Does the new product liability apply in Austria from 9 December 2026?
Only with a transposition act. At the time of our check on 8 October 2026 no draft existed. Until entry into force the Product Liability Act in its 2001 version applies; the EU rules are coming, only the date from which they apply before Austrian courts is open.
Is the FMA competent for the CRA?
Not under the CRA itself. The FMA is the addressee of DORA notifications. Whether it will be assigned CRA market-surveillance tasks for supervised institutions is for the national accompanying act to decide.
Ing. Mag. Patrick Eiler
Patrick Eiler advises banks and insurers in Vienna on regulatory reporting, data architecture and AI compliance. More than twenty years in banking, insurance and financial services; speaker at the Hypo-Verband (expert session of 23 September 2026).