Cybersecurity, Compliance & Governance
Current insights from our specialized tools covering NIS2, ISO 27001, BSI IT-Grundschutz, AI Governance, DORA and GDPR.
Grundschutz++ Is Here: What BSI Standard 300-1 Changes for Every Organisation Running an ISMS
On 26 October 2026 the BSI published BSI Standard 300-1, the methodology of Grundschutz++. It starts from business processes, knows two protection categories, takes most of the risk work off organisations with normal protection needs, and turns every requirement into machine-readable data. What changes, what stays, and what a manager should decide first.
The 35 Minimum Criteria for Risk Assessment in Grundschutz++, Explained One by One with Examples
BSI Standard 300-1 lets organisations choose their own risk method, provided it meets 35 binding minimum criteria in Annex 3. What each criterion means, what an auditor will look for, and a worked example for every one of them.
AI System Security: What the New ISO/IEC 27090 Asks Organizations to Consider — Hugging Face Case Study
In July 2026, by the two companies' own accounts, AI agents from an OpenAI internal evaluation got past their test environment's isolation and into Hugging Face's systems. Three months later ISO/IEC 27090 arrived. What the new guidance asks organizations to consider, read against the case, and seven Lessons Learned.
Anonymous for Whom? What the EDPB's New Anonymisation Guidelines Mean for Every Manager Who Shares Data
A research institute keeps five rows of generalised patient data. No row is unique, yet the table can still betray a diagnosis to the right reader. The EDPB's Guidelines 02/2026 explain why anonymity is a question about people and their means, and how to decide it.
Berlin's Cyberattack: Why Refusing the Ransom Was Right, and What Must Change
The cyberattack on Berlin: the established sequence, why refusing the ransom was right, and five recommendations for prevention and response.
Has AI Learned from Machiavelli?
An internal OpenAI model on a research task bypassed the access barriers of a real Australian government portal. Why agentic AI needs boundaries that hold when the legitimate route to a goal is blocked, and what developers, deployers and regulators should do about it.
ISO 42001 Checklist: 45 checks for AI governance, data, AI security and autonomous agents
45 checks to ISO/IEC 42001:2023 — provenance on every item: clause, Annex A, separate law or recognised practice. Free PDF, no sign-up, English and German.
Measure what you intend to change: 48 ISMS measures to ISO/IEC 27004
36 measurement examples from Annex B of ISO/IEC 27004:2016, plus 12 constructs for the 2022 controls — the formula for each, and what the number tells you. Free PDF.
If You Ship Digital Products, CRA Reporting Starts on 11 September 2026
Article 14 of the Cyber Resilience Act applies from 11 September 2026 — including to in-scope products placed on the Union market before 11 December 2027.
Forty Cases That Decide Whether You Label
Article 50 of the EU AI Act, read against the Commission's own worked examples — thirty scenarios anchored to the Guidelines, plus ten documented incidents run through the test.
EU AI Act Article 50 Implementation Strategy: A Seven-Step Guide for Organisations
A practical seven-step path to implementing Article 50 of the EU AI Act: use-case inventory, provider or deployer roles, notices, publication checks, supplier evidence and proof that the control actually works — with the Article 5 prohibitions that no transparency notice can cure.
The AI Act Delay Is Not a Reprieve: What the Digital Omnibus Actually Changed for High-Risk AI
The Digital Omnibus is now law. It defers the core Chapter III high-risk obligations to December 2027 and August 2028 — but the prohibitions, GPAI rules, Article 50 transparency duties and the GDPR are all still live. Here is what a DACH CISO/DPO must do before treating the delay as breathing room.
The Date That Did Not Move: GPAI Enforcement Is Now Live
While the core high-risk obligations slipped to 2027 and 2028, one date did not move: on 2 August 2026 the Commission's enforcement powers over general-purpose AI models became applicable — information requests, model access, recall and fines up to 3% of turnover. What that asymmetry means for a DACH CISO/DPO who is not a model provider but a downstream user.
The Case That Was Withdrawn: How the First AI Act Referral Reached the CJEU and Left Without an Answer
A Bulgarian consumer asked what the AI Act's right to an explanation actually gives him. Before the Court could answer, the company suing him dropped its own claim. The referring judge called that a possible abuse of right; the Court did not reach the question. What the Yettel Bulgaria saga reveals about how Article 86 is — and is not — enforced.
A New Schrems III? This Time, It Comes From Across the Atlantic
The US Supreme Court's Trump v. Slaughter ruling knocked out the constitutional footing under the EU–US Data Privacy Framework's core assumption — independent US oversight. What it means for DACH CISOs and DPOs, and what to do this quarter.
AI Agents Under GDPR and the AI Act: When the Software Decides and Acts, Who Is Accountable?
An LLM answers a question. An agent reads, plans, calls tools, and acts — across systems you never listed in your DPIA. The agent is not a legal actor; you are. Why purpose limitation, Article 22, and least-privilege tool access decide whether an autonomous workflow is lawful or an open finding.
The DPA Is a Promise, Not a Control: Reading an AI Vendor Contract for What It Actually Binds
A signed Article 28 DPA is not, by itself, an operational control — it allocates responsibility for protecting data, down a subprocessor chain that on an AI vendor can run several parties deep into US jurisdiction. Why the controller stays accountable for the whole chain, what the contract must name, and how to read a DPA for the gaps it is silent about.
Fine-Tuning on Your Own Data: Why 'We Host It Ourselves' Solves the Wrong Half of the GDPR Problem
Self-hosting can reduce the third-country transfer exposure but leaves the harder problem untouched: once personal data has influenced the weights, deletion on request is currently difficult to verify and may demand retraining, unlearning, or output controls of uncertain reliability. Legitimate interest is not a default — it is a three-step test the EDPB sets a high bar for. Why the lawful basis must be settled before training, not after.
ChatGPT, Copilot or Gemini: What Happens to Personal Data the Moment You Type It Into an AI?
Every prompt is a processing operation — and often a third-country transfer. The DPA does not make it disappear, and on consumer or free-tier services your colleague's name can be used for service or model improvement unless settings, temporary mode, or business/enterprise terms exclude it. Why the question is not which AI you use, but who reads what you typed — and what they are allowed to keep.
AWS, GCP or Azure: Are Pseudonymisation and a Customer-Managed Key Enough for GDPR Compliance?
Not against the CLOUD Act and FISA 702 — unless you can answer one question: where is the key? Why customer-held key sovereignty, not geography and not the provider's name, is the dividing line.
The Subsidiary Trap: Why Your Company May Be in NIS2 Scope Without Knowing It
NIS2 scope explained from the ground up: the two filters of sector and size, the EU SME definition, the Article 6 consolidation method for linked (>50%) and partner (25–50%) enterprises, seven worked scenarios, and the essential-versus-important distinction — how to determine correctly whether the directive applies to your organisation.
The Microsoft 365 Dilemma: Is Microsoft 365 Really GDPR-Compliant?
A current assessment of Microsoft 365's GDPR compliance: the DSK determination of 2022, the EDPS proceedings against the European Commission, and the 2025 HBDI Hesse report — what has changed legally and what controllers must verify today.
A CISO Almost Went to Prison for Hiding a Breach
The Joe Sullivan Uber case shows what the NIS2 Directive and § 38 BSIG actually mean for the personal liability of management bodies — and why this American story has become Europe's template.
NIS2 Is Not Another Regulation. It Changes Who Gets Fired After a Breach.
How NIS2 shifts cybersecurity governance from organisational responsibility to personal liability — and what Article 20, §38 BSIG, and the German NIS2UmsuCG mean for management bodies in essential and important entities.
What Is an AI System in the Regulatory Context?
Definition, scope, and operational governance consequences under the EU AI Act and ISO/IEC standards. Why classification is the starting point of all regulatory obligations.
DPIA vs. FRIA: The EU's Double Gate for High-Risk AI Compliance
How GDPR's data-protection audit and the AI Act's fundamental-rights exam actually work together — and why the popular LinkedIn infographics are getting dangerously wrong.