.at Domains: NIS2 and Contact Verifications from October 2026
On 1 October 2026, Austria's Network and Information Systems Security Act 2026 (NISG 2026) comes into force. It is the national implementation of the EU NIS2 Directive.
In general, NIS2 requires registries and registrars to make sure that domain holder data is complete and correct. You'll find out what this means for domain holders in our article: NIS2 Directive: What does it mean for domain holders?
Which data has to be verified for .at domains?
nic.at checks the following data that you provide when registering a domain:
- full name (for legal entities, including the legal form)
- current postal address
- email address
- phone number
Since NIS2 came into force in Germany, we, as a German registrar, verify the email address of domain holders for every new registration, including .at domains.
Name and address do not have to be verified for every domain contact. nic.at regularly compares the stored data with external, publicly available sources. If it spots an anomaly, a verification is necessary. This can also affect domains that have been registered for years.
In that case, you also have to verify your email address if you haven't done so yet.
As long as you haven't received a request, you don't have to do anything or submit any documents.
How can you verify your data?
We carry out the verification ourselves as the registrar. We inform our customer (not the domain contact) as soon as a verification is necessary. This message contains all the information and instructions you need to verify the contact data.
If your email address has not been verified by then, you'll also receive an email with a confirmation link.
Maybe you notice during a verification that your stored data is incorrect. A simple correction is not enough in that case. If you correct the address, you still have to verify the domain contact. If you need to correct the name, you need a new domain contact and have to assign the affected domains to it. After that, you have to verify this new contact.
What happens if you don't verify?
If you don't respond to a request, your domain is technically deactivated after 21 days and is no longer reachable. The domain contract does not end at that point. The block lasts for 30 days. During this time, you can still verify your data and reactivate your domain. If you don't, nic.at terminates the domain contract. After about 60 days, the domain is released for new registration again.
Important: Even if your data is correct, a request that you answer too late or not at all can cost you the domain. Make sure the email address we have on file for you is up to date, so the verification request actually reaches you.
What should you do now?
- Check that your stored email address is correct.
- Check that the stored data is correct for new registrations and updates.
- Follow verification requests.
Do you have more questions about the implementation of the NISG in Austria and contact verification for .at domains? The registry nic.at has put together NIS information for at. domain holders.
