1. The Legal Starting Point: Organizational Duties Without a “Blueprint”
Although Austrian law does not provide specific technical guidance for the required IT infrastructure within a company, it clearly establishes organizational duties. A corporate director bears the fundamental responsibility for ensuring that tasks at subordinate levels are carried out according to clear rules and that compliance with these rules is regularly monitored. This also applies to the IT sector. While directors are not required to personally master every technical process, they are obligated to establish appropriate processes and employ qualified, trustworthy personnel.
2. The Internal Control System (ICS) as a Protective Barrier Against Cyber Fraud
A central legal obligation is the establishment of an internal control system (ICS) pursuant to Section 22 Austrian Limited Liability Company Act (GmbHG) or Section 82 Austrian Stock Corpoaration Act (AktG). The ICS encompasses all coordinated methods and measures within a company designed to safeguard assets, ensure the accuracy and reliability of accounting data, and support compliance with prescribed business policies. Its primary purpose is financial reporting and ensuring that a company’s financial status is presented transparently and comprehensibly.
A functioning ICS includes, for example:
- reporting lines,
- the four-eyes principle,
- segregation of duties,
- as well as clear authorization limits (payment thresholds).
In the context of cyberattacks, the “human factor” is becoming increasingly important, particularly in cases involving social engineering, spoofing, or deepfakes. With regard to accounting-related functions and payment transactions, corporate directors are required to exercise a heightened level of vigilance. Accordingly, the establishment of an appropriate internal control system (ICS) is also a key component of effective protective measures against such cyberattacks.
Liability trap: If a managing director culpably fails to establish an appropriate internal control system (ICS), they are liable to the company for any resulting damages. However, if errors are nevertheless committed by employees despite a properly implemented system, this does not automatically result in personal liability for the managing director.
3. IT-Compliance
In addition to the ICS, an effective compliance management system (CMS) is also indispensable in defending against liability consequences in connection with cyberattacks. It serves not only to prevent damage and liability, but, in certain cases, may also protect against criminal consequences in the event of an incident.
- Corporate criminal law (VbVG): Fines for criminal offences committed by employees may be reduced if the company can demonstrably show that it has implemented preventive measures to avoid such offences (Section 5(3)(1) Austrian Corporate Criminal Liability Act – VbVG).
- Administrative criminal law: In administrative law as well, compliance systems serve to reduce or even eliminate a company’s own exposure to sanctions or liability risks. An effective compliance system can, for example, not only protect the person responsible for administrative offences within the meaning of Section 9 VStG from penalties, but also shield the company from joint liability under Section 9(7) VStG.
- GDPR sanctions: In the event of data breaches, fines of up to EUR 10 million or 2% of global annual turnover may be imposed. However, the implementation of appropriate technical and organisational measures (TOMs) pursuant to Article 32 GDPR may lead to exculpation (relief from liability) of the controller.
4. Specific legal foundations for IT organisation
For certain companies, additional specific obligations regarding IT organisation also apply:
- NIS-2 Directive and NISG 2026: As early as 2018, the Austrian Network and Information Security Act (NISG) introduced initial comprehensive rules for sectors such as energy, banking, and healthcare. With the new NIS-2 Directive and its implementation in Austria through the Network and Information Systems Security Act 2026 (NISG 2026), the scope of application will be significantly expanded as of 1 October 2026. In Austria alone, several thousand companies will be affected, for which cybersecurity compliance (including information security management systems) will gain a fundamentally new level of importance.
- Regulated entities in the financial sector: For credit institutions, insurance undertakings, and payment service providers, strict special statutory provisions on IT security have already been in place for several years (e.g. Section 39(2b) Austrian Banking Act – BWG, Section 110(2) Insurance Supervision Act 2016 – VAG 2016, or Section 85 Payment Services Act 2018 – ZaDiG 2018). These entities are required to establish effective risk management systems to limit “operational risks” – i.e. losses resulting from the failure of internal systems or human error.
5. Digital duty of care: The “Business Judgment Rule” in IT
For non-regulated companies—i.e. those not subject to specific legislation such as the NIS-2 Directive or sector-specific statutory requirements—the legal framework regarding IT security appears at first glance less explicit, but is nonetheless binding. Even though neither the Austrian Limited Liability Companies Act (GmbHG) nor the Stock Corporation Act (AktG) contains specific provisions dedicated to IT, managing directors are still required to ensure that the company identifies risks and mitigates them to the greatest extent possible.
Since the possibilities for IT security measures are virtually unlimited, the question arises as to the required standard of care. This is where the Business Judgment Rule (BJR) applies (Section 25(1a) GmbHG, Section 84(1a) AktG). A managing director is not liable for entrepreneurial decisions if they:
- act on the basis of adequate information,
- do not pursue extraneous or improper interests,
- and act in good faith in the best interests of the company.
The complete failure to implement necessary digitalisation measures may, under certain circumstances, be regarded as a breach of the duty of care. Corporate directors are required to actively monitor technological developments and make use of digital innovations in order to ensure both the competitiveness and the security of the company.
Important for practice: A managing director does not need to be an IT expert, but must obtain an adequate informational basis by involving qualified individuals (including external experts where necessary). From a liability perspective, an incomplete risk analysis is critical in this regard – for example, if only the web shop is assessed, but not the internal network or internal risks posed by employees, the decision is not made on the basis of adequate information.
6. Liability is particularly likely in cases of unjustifiable decisions. These include, among others:
Liability is particularly likely in cases of unjustifiable decisions. These include, among others:
- Ignorance: the deliberate disregard of known security vulnerabilities after a risk assessment has already been carried out.
- Refusal of budget allocation: where funding is denied for simple, low-cost but highly effective measures such as multi-factor authentication (MFA), regular backups, or employee training.
- Delegation errors: assigning security responsibilities to clearly unsuitable or unqualified employees.
7. Cyber insurance: only part of the solution
Cyber insurance is a useful complement to mitigate financial consequences (e.g. business interruption, data recovery costs). However, it is not a substitute for a technical security concept. Corporate directors cannot simply “outsource” the risk; the obligation to proactively secure the company remains in place.
8. Conclusion and recommendations for action
A successful cyberattack does not automatically result in liability. The law does not require 100% security, but it does require appropriate protection. This must correspond to the state of the art and the size of the company. Particularly critical is inaction in the face of obvious risks.
9. Checklist for managing directors:
- Regular risk assessments: When was the entire system (including internal threats) last reviewed by specialists? Have the findings and lessons learned from the previous risk assessment been implemented?
- State of the art: Do firewalls, encryption methods, and authentication mechanisms (MFA) comply with current standards?
- Employee awareness: Are regular trainings conducted on phishing, fake president fraud, and ransomware?
- Emergency management: Is there an up-to-date disaster recovery plan in place to enable rapid data restoration?
Do you need support?
If you’d like support with this topic, feel free to get in touch with LEUKOS. We support you:
- to minimise your liability risk by helping you prepare and document decisions on IT security measures in a way that meets the strict requirements of the Business Judgment Rule,
- to establish a tailored internal control system (ICS) and/or compliance management system (CMS), and
- and to support well-founded risk analyses of your IT infrastructure from a legal perspective, in order to create an appropriate information basis for your management decisions.