--- title: "Know Your Agent in Austria: verifying AI agents" url: https://knowyouragent.ch/en/know-your-agent-austria lang: en updated: 2026-10-13 license: © Innopulse Consulting GmbH --- # Know Your Agent in Austria: verifying AI agents Know Your Agent (KYA) means verifying whether an AI agent was authorized for a specific action, with evidence that third parties can recompute independently. In Austria, this ties in with the Civil Code (ABGB), the GDPR and ID Austria. [Leutrim Miftaraj](https://knowyouragent.ch/en/about/leutrim-miftaraj), Founder, Innopulse Consulting GmbH Published 13 October 2026 ## Key points - Know Your Agent verifies whether an AI agent was authorized for an action, with recomputable evidence. - Authorization under Sections 1002 et seq. ABGB forms the legal background. - Agents are subject to the GDPR, supplemented by the Austrian Data Protection Act. - ID Austria and the EUDI wallet can in future prove an agent's [principal](https://knowyouragent.ch/en/knowledge/glossary/principal). ## What Know Your Agent means in Austria Austrian companies and authorities use AI agents for orders, customer inquiries, accounting and digital administrative procedures. Where an agent acts externally, it must be clear on whose behalf and within which limits. [Know Your Agent](https://knowyouragent.ch/en/knowledge/glossary/know-your-agent) makes these limits verifiable. knowyouragent.ch verifies evidence neutrally and locally in the browser, without an account and without data transfer. Verification follows an open verification profile with public test vectors. ## Authorization under the ABGB The ABGB governs the contract of authorization in Sections 1002 et seq. If the agent exceeds the limits of its authority, the principal is bound only insofar as it ratifies the transaction (Section 1016 ABGB). Whoever acts without sufficient authority is liable to the third party (Section 1019 ABGB). Case law also protects the reliance of third parties when the principal created the appearance of authority. How these rules apply to AI agents is not yet fully settled. In practice, a [mandate](https://knowyouragent.ch/en/knowledge/glossary/agent-mandate) with clear limits that the agent presents creates clarity for everyone involved. More in the article [Proving authority](https://knowyouragent.ch/en/knowledge/proving-agent-authority). ## Data protection under the GDPR In Austria, the GDPR applies, supplemented by the Austrian Data Protection Act. If agents process personal data, the principles under Article 5 GDPR, data protection by design (Article 25 GDPR), security of processing (Article 32 GDPR) and the rules for automated individual decisions (Article 22 GDPR) are particularly relevant. Local verification without transmitting evidence to third parties, combined with [selective disclosure](https://knowyouragent.ch/en/knowledge/glossary/selective-disclosure), supports the principle of data minimization. ## Identity: ID Austria and the EUDI wallet With ID Austria, the country has a government electronic proof of identity that can also be used for qualified electronic signatures. Under the Signature and Trust Services Act, a qualified electronic signature generally meets the requirement of written form. eIDAS 2.0 adds the European EUDI wallet, which member states must offer their citizens. It uses credentials with selective disclosure and protocols such as [OID4VP](https://knowyouragent.ch/en/knowledge/glossary/oid4vp). For agents, this makes it possible to bind a mandate to a principal proven by the government. ## Payments and retail As throughout the EU, PSD2 generally requires strong customer authentication for electronic payments. For payments by agents, payment networks are developing their own approaches with tokenization and signed purchase intents such as [Verifiable Intent](https://knowyouragent.ch/en/knowledge/glossary/verifiable-intent). Austrian merchants accepting orders from shopping agents should tie them to verifiable evidence of intent and limits. The article [Agentic commerce explained](https://knowyouragent.ch/en/knowledge/agentic-commerce) shows what matters. ## European regulation The European regulation on artificial intelligence applies directly in Austria. It attaches obligations to the roles of providers and deployers and to the risk of a system. The article [EU AI Act and AI agents: what applies to agents](https://knowyouragent.ch/en/knowledge/ai-act-ai-agents) puts this in factual context for agents. Regardless of that, the following holds for companies and administrations: what an agent may do should be defined, checked before execution and proven afterwards. ## Terms in the Austrian context The ABGB speaks of the contract of authorization, of the authorized agent and the principal; in everyday use, authorization and representation are common. KYA uses the term mandate for the machine-readable form. It means the defined limits within which an agent may act for its principal, with action types, limits and validity. ## Frequently asked questions ### What does Know Your Agent mean in Austria? Verifying whether an AI agent was authorized for an action, with independently recomputable evidence. In Austria, it ties in with authorization under the ABGB, the GDPR and ID Austria. ### What happens if an agent exceeds its authority? Under Section 1016 ABGB, the principal is generally bound in that case only insofar as it ratifies the transaction. How this applies to AI agents depends on the individual case. ### Can a mandate be linked to ID Austria? Technically, a mandate can be bound to a principal proven by the government. KYA verifies mandates in the [SD-JWT VC](https://knowyouragent.ch/en/knowledge/glossary/sd-jwt-vc) format; a profile for government identities as proof of origin is planned. ### Is KYA free for Austrian companies? Yes. Verification on knowyouragent.ch is free, needs no account and runs entirely in the browser. ### What role does the Signature and Trust Services Act play? It governs electronic signatures and trust services in Austria. Under it, a qualified electronic signature generally meets the requirement of written form. ### Are there rules specifically for AI agents in Austria? No. The general rules apply, for example those of the ABGB, the GDPR and the Austrian Data Protection Act, as well as the European regulation on artificial intelligence directly. General information, not legal advice. The statutes and the circumstances of each case are decisive. ## Sources - Allgemeines bürgerliches Gesetzbuch (ABGB), § 1002: [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001622&Paragraf=1002](https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001622&Paragraf=1002) - Signatur- und Vertrauensdienstegesetz (SVG), BGBl. I Nr. 50/2016: [https://www.ris.bka.gv.at/eli/bgbl/I/2016/50](https://www.ris.bka.gv.at/eli/bgbl/I/2016/50) - Datenschutz-Grundverordnung (EU) 2016/679: [https://eur-lex.europa.eu/eli/reg/2016/679/oj](https://eur-lex.europa.eu/eli/reg/2016/679/oj) - Verordnung (EU) 2024/1183 (eIDAS 2.0): [https://eur-lex.europa.eu/eli/reg/2024/1183/oj](https://eur-lex.europa.eu/eli/reg/2024/1183/oj) --- Quelle: https://knowyouragent.ch/en/know-your-agent-austria · KYA – Know Your Agent