.AT NIS2

From 1 October 2026, nic.at applies the registrant data accuracy and verification requirements introduced by Austria's NIS Act 2026 (Netz- und Informationssystemsicherheitsgesetz 2026, NISG 2026), which transposes the NIS2 Directive into national law. This covers .AT and the second-level domains .CO.AT and .OR.AT.

Good to know: unlike some other ccTLDs, .AT does not add an up-front identity or SMS verification gate on every registration. The registry requires the registrant data behind every .AT domain to be accurate and complete at all times, and it can request verification of that data for an individual domain. Realtime Register handles the data validation and the verification process on your behalf.

Related articles

.AT — TLD information and registration requirements (link to be added)
NIS2 — extended contact validation & annual data review
Contact validation (email confirmation flow)

Timeline at a glance

Date	What happens
1 October 2026	Austria's NIS Act 2026 enters into force. nic.at's updated rules on registrant data accuracy and on-request verification apply to .AT, .CO.AT and .OR.AT from this date.

Before this date there is no change to the .AT process.

What the rules require

The Austrian NIS2 framework places two obligations on the registrar for every .AT registrant.

Accurate and complete data (continuous). The registrant data on record must be correct and complete at all times:

Full and correct holder name, and organisation where the holder is a legal person
Address and country
Email address and phone number
The correct holder type (a legal person or a natural person)

This obligation applies from registration onward and does not expire. Obviously incorrect or incomplete data may not be submitted.

Verification on request (per domain). nic.at can flag a specific .AT domain and ask us to verify that the holder data is accurate and complete:

Verification is a check of the data for accuracy and completeness, not a fixed identity or document procedure
It is triggered by the registry for an individual domain, not required on every registration
The registry sets the outcome it needs; we choose how to confirm the data

There is no fixed validity window and no periodic re-verification cycle. The data simply has to stay accurate, and the registry can request a check whenever it flags a domain.

Verification flow

When nic.at requests verification of a .AT domain, we run the check and resolve it in one of three ways:

Data is accurate and complete. We confirm this to nic.at. Nothing changes for the domain.
Data is inaccurate or incomplete. We correct or complete it, where needed together with you and the registrant, then confirm the corrected data to nic.at.
Data cannot be confirmed, or the registrant cannot be reached in time. The registry places the domain on ServerHold and removes it from the DNS. This is not a cancellation. While the domain is on ServerHold it is temporarily not billed, and the hold is lifted once the data is confirmed or corrected.

ServerHold is reversible. It takes the domain out of the DNS but is not a registry cancellation. The most common cause is an unreachable registrant, so a working, current contact is what keeps a domain safe.

Which operations are affected

Operation	Accurate and complete data required	Verification triggered at this step
New .AT registration	Yes	No, only on a registry request
Ownership transfer	Yes	No, only on a registry request
Registrant update	Yes	No, only on a registry request
Renewal	Data must stay accurate	No
Nameserver or DNS updates	No change to the data duty	No

Registrations, transfers and updates proceed as they do today, provided the registrant data is complete and not obviously incorrect. Verification is a separate, registry-driven step that only happens when nic.at asks for it.

What Realtime Register handles for you

Requirement	How Realtime Register handles it
Data validation	Completeness and format checks on the registrant contact at registration and update, using the existing validation process. Incomplete data is rejected before the operation completes.
Email reachability	Runs through the standard email confirmation flow already used across the platform. No change to your workflow.
On-request verification	When nic.at requests verification for a specific .AT domain, we run the accuracy and completeness check and, where needed, reach out through you or the registrant to confirm or correct the details, then report the result to nic.at.
Status handling	If a domain is flagged and cannot be resolved, the registry hold status is shown in the platform so you can act before the domain is removed from the DNS.
Record-keeping	We keep the verification records the registry requires, so you do not need to retain anything separately.

What you need to do

1. Submit accurate, reachable registrant data

Every .AT registration needs a complete and correct holder record, above all a working email address
Accurate data at the point of registration is what prevents a verification problem later
Do not submit placeholder or obviously incorrect details

2. Respond if we flag a .AT domain for verification

If nic.at requests verification for one of your .AT domains, we will ask you or your customer to confirm or correct the holder details
The registrant must be reachable and must respond within the registry's deadline
An unanswered verification is the most common reason a domain is suspended

3. Keep registrant details up to date

Update the holder record when the customer's details change
A domain with an out-of-date, unreachable contact is the one most at risk if the registry later runs a check

There is no contract or technical work on your side. We manage the registry relationship and the verification process.

Frequently asked questions

Does every .AT domain require verification?

No. Verification is only run when nic.at requests it for a specific domain. A normal registration only needs accurate, complete registrant data.

Is there an SMS code, like some other ccTLDs?

No. .AT does not use an SMS one-time code at registration. The registry requires the data to be accurate and complete, and we confirm it. If the registry later requests verification of a domain, we run the check then.

What triggers a verification request?

nic.at flags an individual domain when it has reason to believe the holder data may be incomplete or inaccurate, for example after a complaint, an authority request, or its own data-quality check.

What happens if the registrant cannot be reached?

If the data cannot be confirmed or corrected and the holder cannot be reached within the registry's deadline, the domain is placed on ServerHold and removed from the DNS, so the website and email stop working. This is not a cancellation: the hold is lifted once the data is confirmed. Keep the holder's contact details current to avoid it.

Is there a validity period I need to track?

No. .AT has no fixed verification validity window and no periodic re-verification. The obligation is simply that the data stays accurate, and the registry can request a check at any time.

Does this apply to .CO.AT and .OR.AT as well?

Yes. The same rules apply to .AT, .CO.AT and .OR.AT.

Do renewals or nameserver changes trigger anything?

No. Renewals, nameserver changes and other updates that do not affect the registrant data are not affected.

Questions? Contact our support team if you have questions about a specific .AT domain or registrant contact.