CRA Compliance in Austria

Austria's CRA national competent authority responsibilities are distributed between BMI (national security and critical infrastructure), the Rundfunk und Telekom Regulierungs-GmbH (RTR, for telecoms and digital markets), and the Federal Ministry for Digital and Economic Affairs (BMAW) for market surveillance of consumer and industrial products. Austria has implemented NIS2 through the Netz- und Informationssystemsicherheitsgesetz 2024 (NISG 2024), which provides the legislative framework for cybersecurity oversight. The allocation of specific CRA NCA responsibilities will be confirmed through national implementing legislation expected before December 2027.

Austrian manufacturers are expected to submit Article 14 notifications to GovCERT Austria (for government and critical infrastructure supply chain) or CERT.at (for private sector manufacturers) within the CRA timeframes. CERT.at is operated by nic.at (the Austrian domain registry) and provides incident coordination services for the Austrian internet community and industry. The Article 14 obligation requires an early warning within 24 hours of detecting active exploitation and a full notification within 72 hours. The specific Article 14 reporting channel for manufacturers will be confirmed through national CRA implementing guidance — manufacturers should monitor BMI and RTR announcements.

Market surveillance for CRA products in Austria is coordinated between BMAW and sector regulators, with the Federal Office of Metrology and Surveying (BEV) involved in conformity assessment accreditation. The full CRA penalty regime applies: up to €15 million or 2.5% of global annual turnover for violations of essential cybersecurity requirements. Austria's market surveillance under the General Product Safety Regulation and Radio Equipment Directive provides a foundation for CRA enforcement. The BMAW has active market surveillance operations for CE-marked products and is expected to integrate CRA cybersecurity requirements into existing market surveillance procedures.

CERT.at publishes free cybersecurity advisories and guidance in German for Austrian businesses. The Austrian Institute of Technology (AIT) provides technical research and conformity testing services relevant to CRA product evaluations. The Wirtschaftskammer Österreich (WKÖ) provides CRA implementation guidance for its SME members through its digital economy division. Austria Wirtschaftsservice (aws) supports SME investment in cybersecurity compliance through innovation funding programmes. The Austrian Standards Institute (ASI) publishes national adoptions of IEC and ETSI standards relevant to CRA Annex I compliance.