Where we work · Austria
ISO and GRC certification consulting in Austria
Achieve ISO and GRC certification in Austria with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Austria
Clients include
ISO and GRC certification in Austria at a glance
Austria's compliance calendar changed on 1 October 2026, when the Netz- und Informationssystemsicherheitsgesetz 2026 took effect and the Bundesamt für Cybersicherheit became the competent authority for essential and important entities. Around it sit the Datenschutzbehörde, which supervises the GDPR under the Datenschutzgesetz, the Finanzmarktaufsicht, which supervises DORA, and the Bundesamt für Sicherheit im Gesundheitswesen for medical devices. Public buyers can ask for quality and environmental certificates under the Bundesvergabegesetz 2018, and the Bundes-Energieeffizienzgesetz offers large energy users certified management systems as one route. Certificates come from certification bodies accredited by Akkreditierung Austria, the national accreditation body inside the federal economy ministry, never from Sterling. Demand is strongest in life sciences and medical devices, automotive and aviation supply chains, microelectronics, advanced manufacturing, green tech, financial services and IT. Sterling serves Austrian clients from its Frankfurt office, drawing on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Austria
Each page covers who needs the standard in Austria, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Austria (11)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR / DSGVO) and the Austrian Datenschutzgesetz (DSG) Datenschutzbehörde (DSB) — the DSG sets it up as the national supervisory authority under Article 51 GDPR | The GDPR applies directly; the DSG supplements it. The DSG establishes the Datenschutzbehörde as the national supervisory authority and gives it powers to obtain information, inspect data processing and the related documents, and to enter premises where processing takes place. | |
| Certification under the GDPR: the Datenschutzbehörde as accreditation body Datenschutzbehörde — the DSG has it publish the certification criteria by ordinance and act as the single national accreditation body under Article 43(1)(a) GDPR | GDPR certification is a separate scheme from ISO management-system certification. The GDPR says approved certification mechanisms may be used as an element for demonstrating compliance, and in Austria the Datenschutzbehörde itself holds the accreditation role for the certification bodies. | |
| Bundesamt für Cybersicherheit (Cybersicherheitsbehörde), subordinate to the Federal Minister of the Interior and seated in Vienna Essential and important entities under the NISG 2026 (sectors listed in the Act's annexes) | Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), BGBl. I Nr. 94/2025, promulgated on 23 December 2025 and in force from 1 October 2026 per RIS, implementing Directive (EU) 2022/2555. Entities register with the authority, apply risk-management measures that take account of relevant national, European and international standards, report significant incidents and later evidence implementation, with certificates able to support the operational and organisational part. The Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), BGBl. II Nr. 290/2026, issued on 1 October 2026, adds detail. Neither the Act nor the ordinance names ISO/IEC 27001. | |
| Finanzmarktaufsicht (FMA), working with the Oesterreichische Nationalbank Financial entities (banks, insurers, investment firms and other entities in DORA's scope) | Regulation (EU) 2022/2554 (DORA), which the FMA says applies from 17 January 2025 and for which it is the competent authority in Austria; its areas include ICT risk management, handling and reporting of ICT incidents, resilience testing and ICT third-party risk. The FMA page does not name ISO/IEC 27001. | |
| Bundesminister für Inneres (Federal Minister of the Interior) Critical entities (energy, transport, banking, health, drinking water and other sectors of the EU critical entities directive) | Resilienz kritischer Einrichtungen-Gesetz (RKEG), BGBl. I Nr. 60/2025: the Minister designates critical entities, which carry out a risk analysis and take resilience measures, and the Minister supervises them and informs the authorities designated under the NIS2 Directive. The Act does not name ISO 22301. | |
| Bundesamt für Sicherheit im Gesundheitswesen (BASG) Medical device manufacturers and distributors | Medizinproduktegesetz 2021 (MPG 2021), BGBl. I Nr. 122/2021, which names the BASG as the competent national authority under the EU medical device and in vitro diagnostic regulations and as the authority responsible for notified bodies. Regulation (EU) 2017/745 expects manufacturers to have a quality management system. The MPG does not name ISO 13485. | |
| Competent food authorities under the Lebensmittelsicherheits- und Verbraucherschutzgesetz (LMSVG) Food businesses | Regulation (EC) No 852/2004, Article 5: food business operators put in place, implement and maintain a permanent procedure based on the HACCP principles and keep documents and records. The LMSVG, BGBl. I Nr. 13/2006, is the national act on safety requirements for food, consumer goods and cosmetics and does not itself require a third-party certificate. | HACCP |
| E-Control, which under the Act receives reports and keeps the list of qualified energy auditors Large energy users (energy audits and recognised management systems) | Bundes-Energieeffizienzgesetz (EEffG), BGBl. I Nr. 72/2014, in the version RIS shows on 11 October 2026: companies based in Austria that are large or above its thresholds carry out an energy audit or set up a recognised management system, namely an energy management system certified by an accredited body on recognised standards, a certified environmental management system, or one validated under EMAS. | ISO 50001, ISO 14001 |
| Arbeitsinspektorate (labour inspectorates) Occupational health and safety | ArbeitnehmerInnenschutzgesetz (ASchG), BGBl. Nr. 450/1994, the Austrian act on safety and health at work, which contains the duty to identify and assess hazards and fix measures (Arbeitsplatzevaluierung). The Act does not name ISO 45001. | |
| Rundfunk und Telekom Regulierungs-GmbH (RTR) AI Service Desk, as point of contact and information hub Providers and deployers of AI systems | Regulation (EU) 2024/1689 (EU AI Act). The RTR says its AI Service Desk is a point of contact and information hub on AI that supports implementation of the AI Act, with Section 20c KOG and Section 194a TKG as its legal basis. The RTR page does not name ISO/IEC 42001. | |
| Public prosecutors and courts under the VbVG; internal reporting duties under the HSchG Employers running reporting channels, and organisations managing criminal-liability risk | HinweisgeberInnenschutzgesetz (HSchG), BGBl. I Nr. 6/2023: enterprises with 50 or more employees set up an internal reporting system. Verbandsverantwortlichkeitsgesetz (VbVG), BGBl. I Nr. 151/2005: an entity can answer for offences by staff where decision-makers failed in due care, in particular by omitting essential technical, organisational or personnel measures. Neither names ISO 37001 or ISO 37301. |
Accreditation and recognition
- Akkreditierung Austria (Austrian national accreditation body, a department of the Federal Ministry for Economy, Energy and Tourism): National accreditation body — the Akkreditierungsgesetz 2012 makes the responsible federal minister the accreditation body and assigns the operational work to the unit named Akkreditierung Austria; it accredits conformity assessment bodies legally established in Austria with their headquarters for the accredited activity in Austria.
- Datenschutzbehörde (accreditation of GDPR certification bodies): Single national accreditation body under Article 43(1)(a) GDPR, as the DSG provides.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Bundesvergabegesetz 2018 (BVergG 2018), BGBl. I Nr. 65/2018, section on Normen für Qualitätssicherung und Umweltmanagement (Contracting authorities (öffentliche Auftraggeber and Sektorenauftraggeber)): Where a contracting authority asks for certificates from independent bodies as proof of quality assurance standards, it must refer to quality assurance systems that meet the relevant European standards and are certified by accredited bodies; for environmental management it must refer to EMAS or standards certified by accredited bodies. Each tender decides whether certificates are required at all.
Economic zones
- Austrian life sciences sector: biotech, pharmaceuticals, medical technology
- Austrian mobility sector: automotive, rail industry, aviation
- Austrian microelectronics and advanced manufacturing: microelectronics, additive manufacturing, robotics, sensor technology
- Austrian green tech and deep tech: climate and environmental protection technology, artificial intelligence, cybersecurity
Sterling in Austria
Sterling delivers in Austria from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Austria, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Austrian clients ask
Are certification audits in Austria conducted in German or English?
Either can work, and the choice is agreed with the certification body when you apply. German is the official language and Austrian statutes and regulator publications appear in German, while English is common in international groups and technology firms. Settle the language of the audit and of controlled documents early, and follow any language fixed by a contract or a regulator's procedure.
Is the Austrian NIS2 law in force?
Yes. The Netz- und Informationssystemsicherheitsgesetz 2026 was promulgated as BGBl. I Nr. 94/2025 on 23 December 2025 and, according to RIS, entered into force on 1 October 2026, with the Bundesamt für Cybersicherheit as competent authority. Whether your organisation counts as an essential or important entity depends on sector and size under the Act's annexes, which the authority or your counsel can confirm.
Which authority supervises the GDPR in Austria?
The Datenschutzbehörde. The Datenschutzgesetz sets it up as the national supervisory authority under Article 51 of the GDPR and supplements the regulation, giving the authority powers to demand information, inspect processing and related documents, and enter premises where processing happens. For its view on a particular activity, ask the authority or your counsel.
Who accredits certification bodies in Austria?
Akkreditierung Austria, a department of the Federal Ministry for Economy, Energy and Tourism acting under the Akkreditierungsgesetz 2012. EA lists it as an MLA signatory with a management system certification scope, and it accredits bodies established in Austria. Recognition runs scope by scope, so check that a certification body's accreditation covers your standard and sector.
Who accredits GDPR certification bodies in Austria?
The Datenschutzbehörde itself. The Datenschutzgesetz has it publish certification criteria by ordinance and act as the single national accreditation body under Article 43(1)(a) of the GDPR, which is separate from Akkreditierung Austria's work on ISO certification bodies. Approved certification can be one element in showing compliance, yet it does not replace the controller's own duties.
Does Austrian law require a certified energy or environmental management system?
For some companies it is one permitted route. Under the energy efficiency act, obligated firms either commission an energy audit or run a recognised management system, meaning an energy system certified by an accredited body, a certified environmental system or an EMAS-validated one. Whether your firm is obligated is for E-Control or your counsel.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR / DSGVO) and the Austrian Datenschutzgesetz (DSG) — ris.bka.gv.at (accessed 11 Oct 2026)
- Certification under the GDPR: the Datenschutzbehörde as accreditation body — ris.bka.gv.at; eur-lex.europa.eu (accessed 11 Oct 2026)
- Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), BGBl. I Nr. 94/2025, promulgated on 23 December 2025 and in force from 1 October 2026 per RIS, implementing Directive (EU) 2022/2555. Entities register with the authority, apply risk-management measures that take account of relevant national, European and international standards, report significant incidents and later evidence implementation, with certificates able to support the operational and organisational part. The Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), BGBl. II Nr. 290/2026, issued on 1 October 2026, adds detail. Neither the Act nor the ordinance names ISO/IEC 27001. — ris.bka.gv.at; ogd.ris.bka.gv.at (accessed 11 Oct 2026)
- Regulation (EU) 2022/2554 (DORA), which the FMA says applies from 17 January 2025 and for which it is the competent authority in Austria; its areas include ICT risk management, handling and reporting of ICT incidents, resilience testing and ICT third-party risk. The FMA page does not name ISO/IEC 27001. — fma.gv.at (accessed 11 Oct 2026)
- Resilienz kritischer Einrichtungen-Gesetz (RKEG), BGBl. I Nr. 60/2025: the Minister designates critical entities, which carry out a risk analysis and take resilience measures, and the Minister supervises them and informs the authorities designated under the NIS2 Directive. The Act does not name ISO 22301. — ris.bka.gv.at (accessed 11 Oct 2026)
- Medizinproduktegesetz 2021 (MPG 2021), BGBl. I Nr. 122/2021, which names the BASG as the competent national authority under the EU medical device and in vitro diagnostic regulations and as the authority responsible for notified bodies. Regulation (EU) 2017/745 expects manufacturers to have a quality management system. The MPG does not name ISO 13485. — ris.bka.gv.at; basg.gv.at; eur-lex.europa.eu (accessed 11 Oct 2026)
- Regulation (EC) No 852/2004, Article 5: food business operators put in place, implement and maintain a permanent procedure based on the HACCP principles and keep documents and records. The LMSVG, BGBl. I Nr. 13/2006, is the national act on safety requirements for food, consumer goods and cosmetics and does not itself require a third-party certificate. — eur-lex.europa.eu; ris.bka.gv.at (accessed 11 Oct 2026)
- Bundes-Energieeffizienzgesetz (EEffG), BGBl. I Nr. 72/2014, in the version RIS shows on 11 October 2026: companies based in Austria that are large or above its thresholds carry out an energy audit or set up a recognised management system, namely an energy management system certified by an accredited body on recognised standards, a certified environmental management system, or one validated under EMAS. — ris.bka.gv.at (accessed 11 Oct 2026)
- ArbeitnehmerInnenschutzgesetz (ASchG), BGBl. Nr. 450/1994, the Austrian act on safety and health at work, which contains the duty to identify and assess hazards and fix measures (Arbeitsplatzevaluierung). The Act does not name ISO 45001. — ris.bka.gv.at (accessed 11 Oct 2026)
- Regulation (EU) 2024/1689 (EU AI Act). The RTR says its AI Service Desk is a point of contact and information hub on AI that supports implementation of the AI Act, with Section 20c KOG and Section 194a TKG as its legal basis. The RTR page does not name ISO/IEC 42001. — rtr.at; eur-lex.europa.eu (accessed 11 Oct 2026)
- HinweisgeberInnenschutzgesetz (HSchG), BGBl. I Nr. 6/2023: enterprises with 50 or more employees set up an internal reporting system. Verbandsverantwortlichkeitsgesetz (VbVG), BGBl. I Nr. 151/2005: an entity can answer for offences by staff where decision-makers failed in due care, in particular by omitting essential technical, organisational or personnel measures. Neither names ISO 37001 or ISO 37301. — ris.bka.gv.at (accessed 11 Oct 2026)
- Akkreditierung Austria (Austrian national accreditation body, a department of the Federal Ministry for Economy, Energy and Tourism) — bmwet.gv.at; ris.bka.gv.at; european-accreditation.org; ilac.org (accessed 11 Oct 2026)
- Datenschutzbehörde (accreditation of GDPR certification bodies) — ris.bka.gv.at (accessed 11 Oct 2026)
- Bundesvergabegesetz 2018 (BVergG 2018), BGBl. I Nr. 65/2018, section on Normen für Qualitätssicherung und Umweltmanagement — ris.bka.gv.at (accessed 11 Oct 2026)
- Austrian life sciences sector — investinaustria.at (accessed 11 Oct 2026)
- Austrian mobility sector — investinaustria.at (accessed 11 Oct 2026)
- Austrian microelectronics and advanced manufacturing — investinaustria.at (accessed 11 Oct 2026)
- Austrian green tech and deep tech — investinaustria.at (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice