AUSTRIA Law and Practice Contributed by: Martin Schiefer and Christian Richter-Schöller, Schiefer Rechtsanwälte GmbH
• First, for classified contracts, the technical and organisational requirements of the Information Security Regulation, verified in the facility clear - ance process. • Second, from 1 October 2026, the Network and Information System Security Act 2026 for in-scope entities: registration by 31 December 2026, bind - ing risk management measures, management accountability and training, and incident reporting within 24 hours (early warning) and 72 hours (inci - dent notification), with fines of up to EUR10 million or 2% of worldwide turnover. • Third, contractual requirements in tenders, where certification to ISO/IEC 27001 or equivalent stand - ards is increasingly demanded. EU-funded pro - jects under the European Defence Fund and EDIP impose additional programme-level security rules. 5.6 Supply Chain Security There are no general statutory country-of-origin bans for defence supply chains. The relevant instruments are: • security-of-supply and information-security requirements in defence tenders, including supply chain disclosure and change control for subcon - tractors; • sanctions law, including the restrictions on Russian content and subcontractors; • the telecommunications-specific framework for high-risk 5G vendors; • NIS-2 supply chain security duties from October 2026, which force in-scope companies to manage Enforcement is contract-based in procurement, and administrative or criminal under sanctions and export control law. In practice, contracting authorities increasingly require the mapping of critical sub-tier suppliers during tender procedures. 5.7 Counter-Espionage and Insider Threat Obligations There is no standalone counter-espionage compli - ance statute for companies. Holders of facility secu - rity clearances must implement the required protec - tive measures, appoint security officers and report supplier cyber risk contractually; and • FDI screening at the ownership level.
security-relevant incidents to the competent authority, the Federal Ministry of Defence and Abwehramt for defence contracts and otherwise the Directorate for State Protection and Intelligence; the loss or compro - mise of classified material triggers immediate report - ing duties under the security annex. The Criminal Code penalises intelligence activity to Austria’s detriment. The long-debated gap whereby espionage conducted from Austrian soil against for - eign states or international organisations is largely not punishable has led to reform plans; the progress of such plans should be verified at the time of reading. Structured insider threat programmes are contractual best practice rather than a statutory duty. 5.8 Foreign Ownership, Control and Influence (FOCI) Mitigation Austria has no formal FOCI mitigation system com - parable to US special security agreements, proxy boards or government-appointed security directors. The underlying risk is addressed through three instru - ments: • first, FDI screening under the Investment Control Act, where clearance can be made subject to behavioural or structural conditions – for example, ring-fencing of sensitive information, governance undertakings or the maintenance of capabilities in Austria; • second, the facility security clearance process, in which foreign ownership and control are assessed and can bar access to classified contracts; and • third, contract-level requirements such as security annexes and personnel restrictions. These instruments operate on a case-by-case basis; there is no standing register of mitigation agreements. 5.9 Interaction Between National Security Regulation and Other Regimes The national security instruments interlock with the other regimes rather than override them. A single transaction can simultaneously trigger FDI screen - ing under the Investment Control Act, merger control, export control consequences for the transfer of tech - nology to the acquirer, the reassessment of facility
22 D EFENCE CON TRACTS 2 026
CHAMBERS.COM
Powered by FlippingBook