EU AI Act compliance guide for Austria

Austria has a growing AI startup ecosystem centred in Vienna, with particular strength in enterprise software, healthtech, and smart city technology. Austrian companies building AI-powered products are fully subject to the EU AI Act's obligations. GPAI model obligations and Article 50 transparency requirements take effect August 2, 2026. Annex III high-risk AI system compliance is required by December 2, 2027. Austria's national supervisory authority for the AI Act will be coordinated through the Austrian Regulatory Authority for Broadcasting and Telecommunications (RTR) and the Data Protection Authority (DSB), both of which have existing digital regulatory mandates. The DSB has been among the more active European data protection authorities in challenging cross-border AI data practices, and similar engagement is expected under the AI Act framework.

What the EU AI Act requires

The EU AI Act creates a compliance framework based on risk classification. Article 6 and Annex III define high-risk AI: systems used in employment decisions, access to education, critical infrastructure, essential services, and law enforcement. If your product operates in these areas, Articles 9 through 17 impose mandatory obligations including risk management, data governance, technical documentation, user transparency under Article 13, human oversight under Article 14, and a quality management system under Article 17. GPAI providers and deployers must comply with Articles 53 and 55: publishing technical summaries, maintaining copyright policies, and for models with systemic risk, conducting adversarial testing and reporting incidents. Article 50 requires clear labelling of AI-generated content where users might mistake it for human-produced output, effective from August 2, 2026.

What this means for your business

Austria's AI sector includes significant activity in smart city infrastructure, enterprise automation, health data analytics, and legal process automation. Systems making consequential decisions about worker conditions, public service access, or healthcare pathways face direct Annex III high-risk classification. Vienna-based startups offering AI tools to public-sector clients face additional scrutiny, as public procurement increasingly requires demonstrated AI Act compliance. Austrian startups building on foundation models face the Article 25 downstream responsibility: if the GPAI provider has not resolved all Article 53 obligations, you as the deployer must address the gap. The DSB's established track record of challenging US-based data transfers and AI practices under GDPR means that AI Act enforcement in Austria is likely to be active and technically rigorous, particularly for systems involving non-EU data flows.

Steps to get compliant

1. Classify your AI systems against Annex III: Run a systematic audit of every AI feature in your product. For each feature, test against Article 5 (prohibited practices) and the eight high-risk categories in Annex III. Document your classification and the legal reasoning. Austrian companies selling to public-sector clients should treat this documentation as a procurement requirement, not just an internal exercise.

2. Prioritise August 2026 obligations: GPAI model compliance and Article 50 labelling both apply from August 2, 2026. Verify your GPAI providers have published Article 53 disclosures. Implement labelling for all AI-generated content visible to users before the August deadline.

3. Build technical documentation under Article 11: Annex III systems require complete technical documentation before deployment, including system description, training data governance, performance benchmarks, known limitations, and intended use scope. Article 17 requires this documentation to be maintained and updated across software versions.

4. Coordinate across GDPR and AI Act requirements: The DSB will enforce AI Act obligations alongside GDPR. Conduct a joint review of your AI systems under both frameworks simultaneously. Particular attention should be paid to training data provenance, automated decision-making disclosures, and data subject rights in AI contexts, all of which intersect directly between the two regulatory regimes.

Free EU AI Act risk assessment

Not sure where your AI system stands? The free ActComply risk screener classifies your system in under 5 minutes. No sign-up required.