Austria: ID Austria and AI applications

What does ID Austria do?

ID Austria is the electronic proof of identity (E-ID) for Austria. Under § 4 E-GovG (E-Government Act), it proves a person’s identity and confirms that an electronic application comes from them. Clear identification works via the sector-specific personal identifier (bPK): it is derived from the person’s source PIN (Stammzahl) and applies only to one area of state activity, such as tax or health (§ 9 E-GovG). This prevents data from different sectors from being combined via a common identifier.

Authorities connect ID Austria via the Portalverbund, companies via the Business Service Portal (USP). Technically, applications are connected to the central E-ID system via SAML2 (PVP2 S-Profile) or OpenID Connect.

Does an AI application need ID Austria?

That depends on whether the application must know who is asking.

Application	ID Austria needed?	Why
Chatbot with general information on opening hours, forms, responsibilities	No	The answers do not depend on the person
Assistant that helps fill in an application and submits it	Yes, on submission	The authority must match person and application
Information on your own proceedings or decision	Yes	Only the person concerned may see the data
AI platform for the authority’s staff	No	Sign-in via the organisation’s identity management

An example from the federal administration: since summer 2026, the ID Austria app has included the AI assistant “ida”. It answers questions about digital dealings with authorities and uses only verified content from oesterreich.gv.at and id-austria.gv.at. According to the Federal Chancellery, it runs on a platform of the Federal Computing Centre (Bundesrechenzentrum) in Austria and stores no personal data. In future, it is to support administrative procedures only at the person’s express request and with their approval.

What should you watch for in data protection?

• Only as much identity as needed: If a chatbot does not need to know anyone, it needs no sign-in. This reduces the effort for the data protection impact assessment and the record of processing activities.
• Keep bPKs separate: A bPK identifies a person only in its own sector. Companies may only store and use bPKs created with their own identifier (§ 14 (2) E-GovG). As a rule, it has no place in input to an AI, in chat histories or in an app’s documents.
• Separate application and advice: The AI can prepare an application; it is submitted via the procedure with ID Austria. This keeps it traceable that the person acted themselves.
• Be recognisable as AI: Anyone talking to a chatbot must be told so, unless it is obvious (Art. 50 (1) AI Act, since 2 August 2026). Transparency obligations under Art. 50 →

How does this work with basebox?

basebox is an AI platform for the staff of your organisation, available in Austria as a cloud or as a server. Sign-in runs through your identity management, connected via LDAP, OIDC or SAML. basebox never sees passwords, and a second factor is possible. Permissions come from your identity management: the AI may never do more than the person using it.

ID Austria (via OpenID Connect or SAML2/PVP2) and the Portalverbund (SAML2) can technically be connected via basebox’s identity management (Keycloak). We clarify the connection in the project: a company registers its application in the USP, an authority adds it to the Portalverbund. Contact →

Not legal advice: This article gives an overview of the E-Government Act and the AI Act. The requirements of the Source PIN Register Authority and the conditions for service providers are authoritative. Research as of 11 October 2026.