Government & Public Services Compliance in Austria

Digital public services are open and mature in Austria: the E-Government Act gives everyone a right to electronic contact with courts and administrative authorities in matters of federal law, and ID Austria is the common key to the federal portal oesterreich.gv.at, FinanzOnline and a growing number of private services. The market for identity solutions around the state is therefore defined less by licensing than by integration rules: how a public body or company connects to the state identity system and what data it may receive.

The principal authorities are the Federal Chancellery (which holds e-government competence and runs the digitalisation programme), the Ministry of the Interior (which governs registration of the electronic identity and opens the system to private users) and the Telekom-Control-Kommission, which supervises trust service providers. The biggest practical constraint for anyone designing a remote journey is that the state identity itself is issued in person, so a digital service cannot assume every user already holds one.

1. Who regulates this sector

Under the Federal Ministries Act 1986 as in force since 1 April 2025, digitalisation and e-government sit with the Federal Chancellery, which now hosts the Source PIN Register Authority. The Länder (federal provinces) run their own procedures in provincial matters; the federal right to electronic contact under the E-Government Act (E-Government-Gesetz, E-GovG) covers matters of federal legislation.

2. Licensing and authorisation

No licence is needed to accept ID Austria; each route in has an admission step.

Public bodies

A public-sector controller that wants to identify people with the electronic identity (E-ID) must set up an E-ID-capable technical environment and register the data processing, with its assignment to a state sector, with the Source PIN Register Authority (E-GovG § 10(1)). Sector-specific personal identifiers (bPK) are then generated per procedure; identifiers from sectors the body does not administer may only be stored encrypted.

Private companies and associations

A company or association that wants users to transmit verified register data through ID Austria applies to the Ministry of the Interior through the Business Service Portal (usp.gv.at). It must justify in writing, by reference to its business purpose, why it needs each data item it asks for (E-ID Regulation § 3). Access is refused or ended where data have not been processed lawfully and in good faith, and data may be used only for the company's own stated purposes (E-GovG § 18(2)). Companies may store only identifiers formed with their own source PIN (E-GovG § 14).

Trust service providers

The qualified certificate behind every ID Austria is issued by a qualified trust service provider under the eIDAS Regulation. Qualified status and supervision fall to the Telekom-Control-Kommission (Signatur- und Vertrauensdienstegesetz [Signature and Trust Services Act], SVG § 12).

Wallet relying parties [Adopted, applies with wallets]

Under Regulation (EU) 2024/1183, any public or private relying party that intends to rely on European Digital Identity Wallets must register in the Member State where it is established, giving at least its identity and the data it intends to request (eIDAS Article 5b).

3. Identity framework (AML rules do not apply)

Public authorities are not obliged entities under the Financial Markets Anti-Money Laundering Act (Finanzmarkt-Geldwäschegesetz, FM-GwG), which applies to credit and financial institutions (FM-GwG § 1(1)). Identity in public services is governed by the E-Government Act, the eIDAS Regulation and data protection law.

Identity before access to data

Online access rights to personal data held by public bodies may be granted only once the unique identity of the person and the authenticity of the request are proven in an electronically verifiable form (E-GovG § 3(1)).

Identification only where needed

Otherwise, a public body may require identification only where an overriding legitimate interest calls for it, in particular where it is essential to a statutory task (E-GovG § 3(2)).

Unique identity by design

Each person's source PIN is derived with strong encryption from the Central Register of Residents number, or from the supplementary register for people not registered as residents (E-GovG § 6(2)).

The state identity also feeds financial-sector due diligence: FM-GwG § 6(4) accepts a statutory electronic ID procedure for remote customer identification.

4. Identity verification and onboarding

Registering the E-ID

For Austrian citizens aged 14 or over, the passport authority or an authorised municipality registers the E-ID automatically when they apply for a passport or identity card, unless they expressly object. Citizens may also ask for registration at the passport authority, an authorised municipality or a State Police Directorate (E-GovG § 4a(1)). Minors from 14 may register without a guardian's consent (E-ID Regulation § 1(2)).

Non-citizens register at a State Police Directorate and must show a sufficient link to Austria, in particular residence, employment or business activity. Asylum applicants can register only once granted protection or a residence right, and for non-citizens without a main residence in Austria the certificate is valid for at most three years (E-GovG § 4a(2)).

Registration is allowed only once identity is established beyond doubt. The authority may query police, civil status, citizenship and immigration records, and identity evidence follows the passport rules (E-GovG § 4a(4); E-ID Regulation § 1(1)). The user then completes registration at home with the smartphone and a second device, linking an authentication factor such as the ID Austria app (Digital Austria, ID Austria).

Using the E-ID

At each use, the Source PIN Register Authority creates and signs an "identity link" containing the sector-specific identifier, first name, surname and date of birth and sends it to the service (E-GovG § 4(5)). Further register attributes, such as confirmation of an age limit, residence data, nationality or the current photo, are added only with the holder's consent (E-ID Regulation § 4). Name and date of birth may be stored with the E-ID for up to twelve months to allow a simplified proof; for other attributes, such as the photo, the register holder sets the period (E-GovG § 4(6)).

Foreign eIDs

Public bodies accept eID means of other EU Member States that meet eIDAS Article 6(1) as equivalent to an E-ID, no later than six months after the scheme appears on the EU list. Private controllers may accept them but are not obliged to. A first-time foreign user is entered in the supplementary register (E-GovG § 6(5)).

Video identification in the tax administration

The Finanzamt Österreich may identify people remotely by video, but only for first-time entry of people without a main residence in Austria into tax records and for issuing or resetting FinanzOnline access for people from states with no eID at assurance level "high", or for legal representatives of entities (Finanz-Video-Identifikationsverordnung [Financial Video Identification Regulation], FVIV § 1). Sessions are recorded in full or captured by screenshots, and the officer checks holograms by tilting and confirms an SMS code (FVIV § 4).

5. Digital channels: what's different

Bottom line: using public services online is a legal right and ID Austria works at assurance level "high", but the identity itself is still proofed face to face, and unless a federal law provides otherwise the paper or counter channel must stay open.

Choice of channel is protected

In matters of federal law, everyone has a right to electronic contact with courts and administrative authorities, except in matters unsuitable for it (E-GovG § 1a(1)). Unless a federal law provides otherwise, at least one other channel must be offered, and choosing it may not lead to a disadvantage (E-GovG § 1a(3)). Courts and authorities established under federal law had to be able to check the E-ID's simplified proof of identity by 1 January 2025 (E-GovG § 25(6)).

Proofing is in person, use is remote

A full ID Austria requires an in-person identity check at a registration authority. Only citizens holding an authority-registered mobile signature or basic ID Austria can upgrade online. Citizens can extend their E-ID online; non-citizens must return to a State Police Directorate (E-ID Regulation § 2).

Attributes instead of documents

Online, register data replace scans, and in matters of federal law a simplified proof of name, date of birth and photo has the evidential value of an official photo ID as defined in FM-GwG § 6(2) (E-GovG § 4(6)). In the eAusweise app, the digital age proof shows the checker only the photo, the date of last update and whether the age threshold is met; name and date of birth stay hidden (Digital Austria, eAusweise).

Changes ahead

[Adopted, applies 24 Dec 2026] Each Member State must provide at least one European Digital Identity Wallet, at assurance level "high" and free for natural persons, and public bodies that require eID for an online service must accept it (eIDAS Articles 5a and 5f(1)). [Adopted, applies 24 Dec 2027] Private relying parties, other than micro and small enterprises, that must use strong user authentication by law or contract must also accept wallets at the user's request (eIDAS Article 5f(2)).

6. Data protection and biometrics

The GDPR and the Datenschutzgesetz (DSG) [Federal Act concerning the Protection of Personal Data] apply; the E-Government Act adds identity rules.

• Sector-specific identifiers. Public-sector systems may hold a person's unique identity only as a bPK, and a natural person's source PIN may be stored only encrypted (E-GovG §§ 8, 12). Each sector's bPK is an irreversible derivation (E-GovG § 13(1)); identifiers from other sectors or for private use are released only encrypted, and unauthorised storage or use of another company's identifier is an offence (E-GovG § 22).
• Registration data. Registration authorities may process identity data, the current photo, contact details and details of the documents presented (E-GovG § 4b(1) and (3)). The rights to object and to restriction under GDPR Articles 21 and 18 do not apply to this processing (E-GovG § 4b(2)).
• Retention. Log data are kept for three years, and registration data are deleted at the latest three years after the E-ID is revoked or expires (E-GovG § 4b(4), (5)).
• Consent and transparency. Register data go to a public body or private third party only on the holder's instruction, and the log of those transmissions must be accessible only to the holder (E-GovG § 18(1)).
• Biometrics. The facial image used for the E-ID is the passport-standard photo held in the passport register, and it is released as an attribute only with consent. Citizen portal services can be used with ID Austria via device face or fingerprint unlock (Digital Austria, Mobile Government). A service that runs its own face matching processes biometric data for unique identification, a special category under GDPR Article 9.

7. Sector-specific obligations

Public authorities

Courts and authorities must publish online the technical requirements of electronic contact (E-GovG § 1a(2)), and public bodies set up by federal law must communicate with each other electronically, the exemption having ended on 31 December 2025 (E-GovG §§ 1c, 25(5)). The official signature (Amtssignatur) marks documents from a public body; misusing or faking it is an offence (E-GovG §§ 19, 22).

Electronic delivery

Signing up for electronic delivery counts as consent to receive official documents electronically, and documents requiring proof of delivery need registration with the E-ID; participants must report changes, including to the notification e-mail address, without delay (Zustellgesetz [Service of Documents Act], ZustG § 28b).

Private service providers

Admitted companies must report to the Ministry of the Interior any circumstance that rules out their use, and the Ministry keeps admission records for five years after access ends (E-GovG § 18(2); E-ID Regulation § 3).

Two-factor log-in for FinanzOnline

Since 1 October 2025, the FinanzOnline tax portal requires two-factor log-in, with ID Austria recommended (Federal Chancellery, 17 July 2025).

8. Risk indicators and red flags

Identity fraud around public services

• Impersonated tax messages: SMS, e-mail or calls posing as FinanzOnline or the Ministry of Finance, promising refunds or threatening seizures.
• Fake "data check" requests: links asking users to confirm personal and bank details to keep receiving benefits such as family allowance (BMF warning, August 2026).
• Lookalike portals and fake decisions: websites styled like FinanzOnline and forged official decisions; genuine notices are digitally signed and arrive by post or in the FinanzOnline databox.
• Requests for secrets: any request for passwords, card or account data; the tax administration never asks for them.
• Doubtful identity or misuse risk: authorities must have an E-ID suspended or revoked on the holder's death, on a risk of misuse or where facts raise justified doubts about identity (E-GovG § 4a(5)).

9. Enforcement and penalties

Penalties are maximum administrative fines per offence, unless another provision carries a stricter penalty.

Beyond fines, the Ministry of the Interior can refuse or withdraw a private company's access to the identity system (E-GovG § 18(2)), and the Data Protection Authority enforces the GDPR. Recent case law concerns electronic delivery, which is not effected where notifications did not arrive or the recipient had no knowledge of them (ZustG § 35(6), (7)). The Supreme Administrative Court stressed users' duty to monitor their notification address (VwGH Ra 2026/04/0100, 28 July 2026); the Federal Administrative Court upheld service on a registered user (BVwG W198 2332833-1, 28 October 2026) but set aside a sanction where the e-mail linked to the claimant's ID Austria had been deactivated without his knowledge (BVwG G308 2341554-1, 13 August 2026).

10. Recent changes and what to watch

• 24 December 2027[Adopted, applies 24 Dec 2027] Larger services required to use strong authentication must accept EU wallets on request (eIDAS Article 5f(2)).
• 24 December 2026[Adopted, applies 24 Dec 2026] EU wallet deadline; in July 2026 the Federal Chancellor told Parliament the ID Austria app is being developed into Austria's wallet, in phases with pilots.
• 28 July 2026[In force] The Supreme Administrative Court ruled that ID Austria users of electronic delivery must keep their notification e-mail current and check it.
• 27 July 2026[Proposed, consultation closed 21 Sep 2026] A draft law to bar under-14s from video-sharing platforms with addictive features would require privacy-preserving age verification; ID Austria is to be one option, not mandatory. Proposed start 1 January 2027, with age checks by 31 March 2027.
• 1 October 2025[In force] FinanzOnline log-in requires two factors.
• July 2024[In force] BGBl. I No. 117/2024 amended the E-Government Act: free choice of another channel without disadvantage, electronic contact between public bodies, evidential value of the E-ID photo proof, twelve months (previously three) for storing simplified proofs, and a duty to verify them by 1 January 2025.
• 5 December 2023[In force] The E-ID (ID Austria) entered full operation and replaced the mobile signature (BGBl. II No. 340/2023); about 6.3 million registrations had been made by 1 September 2026.
• 27 April 2022[In force] ID Austria published as a notified eID scheme at assurance level "high" (OJ 2022/C 173 I/01).

11. What this means for identity verification

• Plan for two populations. Many users hold ID Austria, others do not, so a fallback such as document and liveness verification is needed.
• Prefer register attributes to document capture. Confirmed name, date of birth, photo or an age flag from ID Austria can replace image capture, with consent and, for private firms, after admission by the Ministry of the Interior.
• Accept EU eIDs and wallets. Public bodies must accept notified EU eIDs and, from the end of 2026, EU wallets; match accounts on the sector-specific identifier, not on names.
• Store identifiers correctly. Keep only bPKs formed for your own sector or company.
• Re-verify on lifecycle events. E-IDs expire with their certificate (five years for citizens, at most three for non-citizens without a main residence) and can be revoked, so check status at each use.