The NIS2 Directive significantly expands the European Union's legal framework for cybersecurity. The directive requires member states to transpose enhanced security requirements into national law.

With regard to domains, these requirements are set out in particular in Article 28, which obliges registries (domain registration authorities), registrars (at partner providers) and internet service providers to ensure that domain holder data is complete and accurate.

On 12 December 2025, the Austrian National Council passed the Network and Information Systems Security Act 2026 (NISG 2026), which implements the EU’s NIS2 Directive in Austria. This law will take effect on 1 October 2026.

The NISG 2026 obligates domain registries and registrars/ internet service providers to ensure the completeness and accuracy of domain holder data for all domains. Consequently, domain holders will in future be required to cooperate in checking the accuracy and completeness of domain holder data when requested to do so. Furthermore, this law obligates domain holders to provide a telephone number in addition to an e-mail address.

Even before the NISG 2026 came into effect, nic.at required the following information from domain holders to ensure proper domain management:

• Full name, and for legal entities, the designation of the legal form
• Mailing address
• Email address

Under the NISG 2026, the legislature now also requires a phone number for domain holders. As of 1 October 2026, the phone number will therefore be a mandatory field for new registrations. If you have not yet provided a phone number for any existing domains, you will be required to do so by 1 October 2026.

Should your registrar/internet service provider or nic.at request your cooperation in verifying your data, you are obligated:

• to provide proof that the data you have provided to us is correct, or
• to correct your data and provide proof of the accuracy of the new data.
   

Please note: Not all domain holders will be asked to verify the accuracy of their information starting October 1, 2026. You will only be required to verify your domain holder data if discrepancies are found during the review and you receive a request. This means that, unless you receive a request, you do not need to submit any documents.

If you registered your domain(s) via a registrar/internet service provider, they will be the first to contact you. If your information has not been successfully verified by your registrar/Internet service provider after 14 days, we will contact you directly.

If you registered your domain(s) directly with us, we will contact you directly.

Did you register your .at domain(s) via a registrar/internet service provider?

If so, please contact them directly. Once you have provided them with all the requested documents and information, they will handle the rest with us on your behalf.

Not sure if your domain is managed by a registrar?

You can check this in the nic.at Whois database. This information can be found in the 'Registrar' field. If this field is blank, your domain is registered directly with nic.at.

Did you register your .at domain(s) directly with nic.at?

If so, please log in to your customer account at www.nic.at/en.

If you have never logged in before, please use the standard 'Forgot Password / Create Password' feature. You should receive an email with a link to set a new password within a few minutes.

If you do not receive this email, it is likely that the email address you registered is no longer correct. You can update it at here. Please note that this change requires confirmation and manual review by us. You will receive an email from us once the change has been made.

 There are now two options available in your customer login.

 1) Are your details correct?

If so, you can upload and submit documentation to verify your details under the 'NIS2 Verification' menu item. We will review your documentation and then send you an email.

 2) Your information is no longer accurate or is incomplete?

If so, you must first correct it under the 'Account Holder Information' menu item. Please note that this may require a confirmation form, as well as manual review and confirmation by us. This depends on which details you are changing. The change form may be provided for download and will be pre-filled where necessary. Once the change has been made, you will receive an email from us.

You can then upload and submit the supporting documents verifying the accuracy of your data via the 'NIS2 Verification' menu. Once we have successfully reviewed your submission, you will receive an email.

Did you register your .at domain(s) via a registrar/internet service provider?

If so, please contact them directly. Once you have provided them with all the requested documents and information, they will handle the rest with us on your behalf.

Not sure if your domain is managed by a registrar?

You can check this in the nic.at Whois database. This information can be found in the 'Registrar' field. If this field is blank, your domain is registered directly with nic.at.

Did you register your .at domain(s) directly with nic.at?

As mentioned in our previous correspondence, we have provided guidance on how you can submit this proof. To summarise, if necessary, you can complete your domain owner information and upload the relevant documents in the customer login www.nic.at/login

For natural persons, the following documents are accepted as proof of identity:

• Proof of identity: a copy of a passport, national ID card, driving licence, etc.
• Proof of address: residential registration form, utility bill, etc.

For legal entities, the following documents are accepted as proof of identity:

• Proof of correct name: extract from the commercial register, extract from the association register, etc.
• Proof of address: electricity bill, etc.

After nic.at sends the initial request to your registrar, or directly to you as the domain holder (if your domain is registered with nic.at), you have 14 days to complete your domain holder data and/or provide proof that the data is correct. If you do not respond by the initial deadline, nic.at will send an additional request with a final deadline of seven days.

If we have not received successful verification from your registrar/internet service provider within 21 days, or if not all the required documents have been submitted to us within this timeframe, we will deactivate your domain in the DNS (‘serverHold’). This does not mean that your domain has been revoked or that the domain contract has been terminated, but it does mean that your domain and the associated services (website, email address) are no longer technically accessible. Once this 'serverHold' status has been applied, you have 30 days to correct and complete your domain holder data, if necessary, and/or provide proof to confirm its accuracy. Failure to do so will result in the revocation of the domain; in other words, the termination of the domain contract and deletion of the domain after approximately eight weeks. The domain can then be reallocated on a 'first come, first served' basis.

The NISG 2026 obligates domain registries and registrars/ internet service providers to ensure the completeness and accuracy of domain holder data for all domains. Consequently, domain holders will in future be required to cooperate in checking the accuracy and completeness of domain holder data when requested to do so. This duty to cooperate is also set out in our terms and conditions, which can be found at www.nic.at/en/terms.

If the domain holder fails to comply or complies too late with this duty to cooperate, nic.at may revoke the domain, thereby terminating the domain contract. This means that you must pay particular attention to relevant requests from your registrar/nic.at in order to avoid losing the domain(s).

If we cannot successfully verify your domain holder data within the initial 21-day period, we will deactivate your domain in the DNS with a status of 'serverHold'. This means that your domain has not yet been revoked and the domain contract has not yet been terminated, but your domain and any associated services (e.g. website or email address) will be technically inaccessible. Once the 'serverHold' status has been set, you have 30 days to complete or correct your domain holder data and/or provide proof to confirm their accuracy.

If your domain holder data is successfully verified within these 30 days while the 'serverHold' status is active, we will remove it. In this case, your domain will be re-registered in the DNS.

Introduction of the 'clientHold' status

From 1 October 2026, in exceptional cases, a registrar may remove a domain from the DNS in order to fulfil its legal obligations, particularly those under the NISG 2026. A registrar may only set the “clientHold” status if it is evident that:

• the domain holder’s data is grossly incorrect;
• the domain holder’s data is incorrect and cannot be rectified within a foreseeable timeframe; or
• the delegation agreement relating to the domain has not been validly concluded.

Changes in the nic.at Whois database?
Since the GDPR came into force in 2018, the domain holder data of natural persons have not been displayed publicly.

However, the holder details of legal entities (such as companies and associations) have continued to be published. Until now, however, it has been possible to hide the telephone number and email address of legal entities. From 1 October 2026, this information must be published for legal entities in the nic.at Whois database. Therefore, we recommend that legal entities do not enter any personal data (such as firstname.lastname@example.at and/or direct dial numbers) in these fields in future, but instead enter general details (such as office@example.at and/or the general telephone number) in their registrant details.

Fax numbers will no longer be published for either private individuals or legal entities as this field is being removed entirely. Consequently, fax numbers cannot be entered for new registrations. For existing domains, nic.at will delete these in accordance with the principle of data minimisation.

Changes to the General Terms and Conditions

Due to legal requirements, it is also necessary to make changes to our General Terms and Conditions (GTC). The new GTC will come into force on 1 October 2026. You will also find a version of the GTC in which the changes are highlighted here.