AUSTRIA Law and Practice Contributed by: Philipp Scheuba, BLS Rechtsanwälte GmbH
in an increased liability risk for managing bodies, as they will have to ensure compliance with the expand- ed obligations. Member states had until 17 October 2024 to incorporate NIS2 components, strategies, and mandated reporting into their national laws. In Austria the NISG 2026 (Network and Information Sys- tem Security Act 2026) serves to implement the NIS 2 Directive and will come into force nine months after its publication in the Federal Law Gazette on the first day of the following month – ie, on 1 October 2026. The aim is to improve the resilience and response to security incidents within the public and private sec- tors across the EU. It establishes an obligation to take appropriate risk management measures for the secu- rity of network and information systems. Severe sanc- tions are envisaged (up to EUR10 million or 2% of the group’s total annual turnover – a significant increase from the previous cap of EUR50,000). Management bodies are liable for breaches if essential risk assess- ments are neglected or ignored. In October 2025, the Supreme Court (OGH) went a step further in reshaping the claims landscape by ask- ing the Constitutional Court (VfGH) to annul Section 12 (3) VersVG in its entirety as unconstitutional. The provision currently allows insurers to trigger a one- year exclusion period for bringing coverage actions by issuing a “qualified” denial of cover; after that period the claim is definitively lost, irrespective of the under- lying merits. The OGH considers this an unjustified
privilege for insurers compared to other debtors and even compared to the policyholder as the typically weaker contracting party, and questions its compat- ibility with the constitutional equality principle. If the VfGH follows this reasoning and strikes down Section 12 (3) VersVG, future disputes would again be gov- erned solely by the general limitation regime in Sec- tion 12 (1) VersVG, which would materially extend the effective window for policyholders to litigate disputed claims and may prompt insurers to adjust claims-han- dling strategies and reserving practices. Finally, there have been changes regarding collective regress proceedings. With effect from July 2024, Sec- tions 619 et seq. of the Austrian Civil Procedure Code have significantly reshaped the procedural framework for mass consumer claims in Austria. Qualified entities may now pursue injunctive and redress actions on behalf of groups of affected consumers, with central- ised jurisdiction at the Commercial Court of Vienna and broad limitation effects. Although practical use is still evolving, areas involving standardised products, recurring advisory duties, uniform premium adjust- ments or data incidents may become more exposed. Insurers should therefore reassess the robustness of key policy wording – particularly premium adjustment clauses and coverage exclusions – and ensure that their governance and documentation standards are capable of withstanding collective scrutiny.
27 CHAMBERS.COM
Powered by FlippingBook