What you are actually buying
nic.at GmbH in Salzburg is the only body that can delegate a .at name, and it has run the extension as a private Austrian company rather than under an ICANN registry agreement. That is the reason several habits carried over from .com do not apply here: there is no auto-renew grace period, no redemption period in the ICANN sense, and no 60-day transfer lock after registration. The rules are nic.at's own and they are set in its registration guidelines and general terms.
The most useful difference is the shape of the contract. A .at registration is a continuing obligation with no end date, invoiced in annual service periods, and it ends when it is cancelled or revoked rather than when a clock runs out. In practice that feels like an annual renewal, but it explains why cancellation has a deadline tied to the service period rather than an expiry date, and why a lapse is treated as a termination of a live contract rather than as an expiry you can quietly undo.
Holder data becomes a live obligation on 1 October 2026
Austria implemented NIS2 through the NISG 2026, passed on 12 December 2025 and in force from 1 October 2026. From that date registries and providers are obliged to ensure holder data is complete and accurate, and holders owe a duty to co-operate when asked. nic.at has published the escalation it will run: a first request with 14 days to respond, a final request with a further 7, then serverHold, which takes the domain out of the DNS without ending the contract. Once serverHold is set you have 30 days to correct the data or evidence it before the domain is revoked and deleted. nic.at is explicit that not every holder will be asked, only records where the check finds a discrepancy.
As a reseller our job here is unglamorous and matters more than the registration itself: we keep the holder record correct, we keep the billing and holder addresses on mailboxes that a person actually reads, and we pass registry correspondence on rather than letting it sit in a shared inbox. We are not the registry, so we cannot waive a nic.at deadline, but almost every .at domain that gets lost is lost to an unread email rather than to a policy.