Blog on Datargo

One Incident, Two Reporting Channels: CRA and NIS2 Since 11 September 2026

Thu, 17 Sep 2026 00:00:00 +0000

Article 14 of the Cyber Resilience Act has applied since 11 September 2026. Manufacturers of products with digital elements must now report actively exploited vulnerabilities and severe security incidents. The rest of the regulation only applies from 11 December 2027, so the reporting duty comes more than a year early. It expressly covers products placed on the market before that date as well.

For many companies this is not their first reporting duty. Essential and important entities under the German NIS2 Implementation Act have been reporting significant incidents to the BSI since December 2025. A company that sells software as a product and is itself a NIS2 entity now carries two duties that look alike but do not overlap.

The End of clientAuth: Why mTLS With Public Certificates Is Running Out

Wed, 16 Sep 2026 00:00:00 +0000

For a long time, a publicly trusted TLS certificate could do two things at once: identify a server to browsers and identify a client to another server. The Extended Key Usage extension made this possible with the purposes serverAuth and clientAuth. That dual role is ending. The Chrome Root Program policy requires hierarchies dedicated exclusively to server authentication.

The key dates

Under version 1.8 of the Chrome Root Program Policy, two dates apply:

NIS2 After the Grace Period: From Registering to Reporting

Tue, 15 Sep 2026 00:00:00 +0000

The statutory registration deadline under the German NIS2 Implementation Act passed on 6 March 2026, and the leniency granted by the BSI ended on 31 July. Today the BSI states plainly that the deadline has passed and calls on companies in scope to register without delay. Anyone who has not done so is no longer in a transition phase.

For registered entities, a different question arises. Registration is a one-off step; the reporting duty under Section 32 of the German BSI Act is a permanent state. Whether a company can meet it only becomes clear during an incident.

E-Invoicing From 2027: What Invoice Issuers Should Settle Before Year-End

Thu, 10 Sep 2026 00:00:00 +0000

Since 1 January 2025, domestic companies in Germany have had to be able to receive e-invoices. For issuing invoices, a transitional rule under Section 27(38) of the German VAT Act applies: until 31 December 2026, all invoice issuers may still issue an “other invoice” instead of an e-invoice, meaning paper or an unstructured electronic format. At the turn of the year, this rule ends for a large share of companies.

NIS2 Registration: Why 31 July 2026 Is the Deadline That Counts

Mon, 20 Jul 2026 00:00:00 +0000

The three-month registration window under the German NIS2 Implementation Act closed on 6 March 2026. Yet for many entities the more important date is a different one: 31 July 2026. By that day the BSI expects the outstanding registrations and treats late submissions with practical leniency until then. Of around 29,500 companies in scope, only about 11,500 had registered by the statutory deadline, rising to roughly 18,500 by the end of May. A substantial share is therefore still missing.

ViDA: What Comes After the German E-Invoicing Mandate

Thu, 16 Jul 2026 00:00:00 +0000

Many companies treat e-invoicing as a German topic with a German timetable: receiving since 2025, issuing from 2027 and 2028. That is correct, but incomplete. Above this national staged plan sits a European reform that sets the long-term frame: VAT in the Digital Age, or ViDA, formally adopted on 11 March 2025 as Directive (EU) 2025/516. Anyone designing their e-invoicing architecture today only around the German deadlines is planning too short.

The Cloud Sovereignty Framework: When Sovereignty Becomes a Measurable Procurement Criterion

Mon, 13 Jul 2026 00:00:00 +0000

Digital sovereignty was long a term for keynote speeches, hard to pin down and harder still to verify. With the Cloud Sovereignty Framework, the European Commission has turned it into an evaluation grid. The version published in October 2025 (1.2.1) defines eight sovereignty objectives and a methodology for classifying cloud providers in a structured way. April 2026 brought the practical test: a framework contract worth 180 million euros for sovereign cloud services for the EU institutions, awarded to four European providers.

APIs as Part of the Supply Chain: Why Interface Security Becomes a Matter of Evidence

Tue, 23 Jun 2026 00:00:00 +0000

Software is rarely a monolith today. Modules, partner services and tenants talk to each other through interfaces, and these APIs are the quiet connectors of the supply chain. NIS2 explicitly requires supply chain security as part of the risk picture. That moves a question long treated as purely technical to the foreground: how secure, and how auditable, are your own interfaces?

The interface is the attack surface

The most common API weaknesses are not exotic exploits but authorization flaws. In the OWASP API Security Top 10, Broken Object Level Authorization sits in first place: an API hands out data without properly checking whether the requesting account is allowed to see it at all. A changed object ID in the request is then enough to retrieve someone else’s records. Three control points decide robustness in practice:

Passkeys in the Enterprise: Phishing-Resistant Sign-In Beyond Passwords and OTPs

Tue, 23 Jun 2026 00:00:00 +0000

Phishing remains the most reliable way into corporate networks, and most second factors do little to change that. A password plus an SMS code, TOTP app or push approval counts as multi-factor authentication, yet at its core it is attackable: lure the user onto a fake page and the second factor can be captured in real time too. FIDO2 passkeys address exactly this point.

Why classic MFA stays phishable

The problem is not the number of factors but their transferability. A one-time code is a shared secret: it works wherever it is entered, including on the phishing page. What is missing is a binding to the genuine counterparty. That binding is precisely what WebAuthn, the standard behind passkeys, provides.

The EU Data Act and the End of Switching Fees: Cloud Switching Becomes Mandatory

Tue, 23 Jun 2026 00:00:00 +0000

Vendor lock-in was long a commercial lever: anyone wanting to leave paid for the exit, fought proprietary formats and lost weeks to migration work. The EU Data Act (Regulation (EU) 2023/2854) reverses that logic. The regulation has applied since 12 September 2025, and its Chapter VI turns switching cloud providers into an enforceable customer right.

What has applied since September 2025

Providers of data processing services (IaaS, PaaS, SaaS) must remove every obstacle that makes switching harder: pre-commercial, commercial, technical, contractual and organisational barriers alike. In practice this means a maximum notice period of two months, a 30-day transition window for the actual move (extendable to up to seven months where technically unfeasible) and the right to take data and digital assets along. For new contracts these duties already apply.

When the Chatbot Has to Identify Itself: AI Transparency in Customer Service from August 2026

Tue, 23 Jun 2026 00:00:00 +0000

Automated first responses, AI-assisted ticket triage, generated reply suggestions: in customer service, AI is already routine. From 2 August 2026 Article 50 of the EU AI Act becomes enforceable, bringing binding transparency obligations for exactly these systems. These duties are distinct from the rules for providers of general-purpose AI models (GPAI): the point here is not the model, but the interaction with people.

What Article 50 requires

At its core sits a disclosure duty. Providers of AI systems intended for direct interaction with people (such as chatbots) must ensure that the person concerned is aware they are communicating with an AI system. The notice must be given at the latest at the time of the first interaction, unless the use of AI is obvious from the circumstances. On top of that, AI-generated or manipulated content must be marked as such in a machine-readable way, and content of public interest that could appear authentic has to be labelled separately.

47-Day Certificates: The CA/Browser Roadmap to 2029

Tue, 09 Jun 2026 00:00:00 +0000

The debate is settled, and part of the outcome is already operational reality: since 15 March 2026, publicly trusted TLS certificates may be valid for at most 200 days, down from 398. That is the first step in a roadmap the CA/Browser Forum adopted in April 2025 with Ballot SC-081v3: unanimously, with 29 votes in favour and none against. At the end of that roadmap sits a maximum lifetime of 47 days.

eIDAS 2.0 and the EUDI Wallet: What Relying Parties Must Prepare by the End of 2026

Tue, 09 Jun 2026 00:00:00 +0000

In about six months a deadline expires that many companies still treat as distant regulation: by 24 December 2026, all 27 EU member states must provide their citizens and residents with at least one European Digital Identity Wallet (EUDI Wallet). The legal basis is Regulation (EU) 2024/1183 (“eIDAS 2.0”), in force since 20 May 2024.

For most companies the more pressing question is not when the wallet arrives, but when they will have to accept it. And that deadline follows immediately.

The Cyber Resilience Act: What 11 September 2026 Means for Makers of Digital Products

Tue, 09 Jun 2026 00:00:00 +0000

In about three months a regulation turns into operational reality. From 11 September 2026 the first binding obligations of the Cyber Resilience Act (Regulation (EU) 2024/2847) take effect, and they happen to be the ones that demand the most process: reporting actively exploited vulnerabilities and severe security incidents. The remaining product and conformity obligations follow with full application on 11 December 2027.

Anyone who manufactures, imports or distributes products with digital elements in the EU should therefore treat September not as a distant date, but as the day a working reporting path has to exist.

Data Sovereignty After the Data Privacy Framework: Why EU Hosting Becomes an Architecture Question

Tue, 02 Jun 2026 00:00:00 +0000

Anyone transferring personal data to the United States has relied since 2023 on the adequacy decision for the EU-US Data Privacy Framework (DPF). In September 2025 the General Court of the European Union (EuG) dismissed a challenge against it, leaving the framework a valid legal basis. But the matter is not closed: in late October 2025 an appeal was lodged with the Court of Justice (Case C-703/25 P). Another reversal, a “Schrems III”, is not ruled out.

The EU AI Act: GPAI Enforcement from 2 August 2026 and What the Digital Omnibus Postponed

Tue, 26 May 2026 00:00:00 +0000

The EU AI Act has been in force since August 2024, but many of its obligations take effect in stages. One date stands out: on 2 August 2026 active enforcement against providers of general-purpose AI models (GPAI) begins through the EU AI Office, and national sanction regimes take effect in parallel. In Germany the accompanying AI Measures and Innovation Act (KI-MIG) applies. Anyone who uses or provides AI should know the deadline, but also the most recent postponements.

SD-JWT VC and OpenID4VP: The Protocols Behind the EUDI Wallet

Tue, 12 May 2026 00:00:00 +0000

Most of the conversation around the EUDI Wallet sits at the political and organisational level: member-state provisioning by the end of 2026, registration duties, acceptance deadlines. But anyone who actually wants to accept the wallet eventually faces a technical question: how exactly do I verify that a presented attribute is genuine, valid and sufficient for my purpose? This article looks at the verification side and the building blocks that come together there.

Archiving Structured E-Invoices the GoBD Way: The Eight-Year Question

Tue, 21 Apr 2026 00:00:00 +0000

The debate around e-invoicing mostly turns on issuing and receiving. The quieter but longer-lived obligation only begins afterwards: retention. A structured invoice is not a document in the classic sense but a data set, and it must remain unalterable and machine-readable for years. Building that into your processes from the start avoids costly rework later.

What changed about the retention period

For a long time, accounting records had to be kept for ten years. Germany’s Fourth Bureaucracy Relief Act (BEG IV) shortened this to eight years as of 1 January 2025. The new period applies to all records whose previous ten-year period had not yet expired at that point.

NIS2 in Practice: From Reporting Duty to Defensible Evidence

Tue, 14 Apr 2026 00:00:00 +0000

Since 6 December 2025, NIS2 is law in Germany. The NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) was passed by the Bundestag on 13 November 2025, confirmed by the Bundesrat on 20 November, and entered into force with no transition period. Around 29,500 companies across 18 sectors are in scope. The BSI registration deadline on 6 March 2026 has passed; late registration remains possible and is advisable.

Many organisations treated the rollout as a registration and documentation task. The harder part begins afterwards: being able to prove, when it counts, what actually happened.

ACME Beyond the Web Server: Certificate Automation for Internal Services and mTLS

Tue, 17 Mar 2026 00:00:00 +0000

Shortening public TLS lifetimes towards an eventual 47 days has created an awareness that manual renewal no longer scales. What often gets overlooked: inside a company there are usually far more certificates than at the outward-facing edge. Service-to-service communication, mTLS in a service mesh, internal APIs and database connections all live on certificates, and these follow different patterns than the public web.

Why “internal” does not mean “simpler”

At the public web server the situation is tidy: a handful of domains, a public CA, a clearly defined validation path. Internally the ratio inverts. Here there are often hundreds or thousands of short-lived endpoints that appear and vanish dynamically, for instance when an orchestrator starts new containers. An internal CA issues certificates for them that nobody sees publicly, but which expire just the same, must renew just the same, and take down a service just the same when they fail.

DORA for ICT Providers: Third-Party Risk and Incident Reporting

Tue, 09 Dec 2025 00:00:00 +0000

DORA, the Digital Operational Resilience Act (Regulation (EU) 2022/2554), has applied to the European financial sector since 17 January 2025. Since 19 November 2025, oversight has become concrete: the European Supervisory Authorities EBA, EIOPA and ESMA published the first official list of 19 ICT third-party providers designated as critical, among them AWS, Google Cloud, Microsoft, Oracle, SAP, IBM and Deutsche Telekom. The list is updated annually.

The instinctive reaction of many IT providers is: this does not concern me, I am not a bank. That is a fallacy. DORA travels down the supply chain.

Post-Quantum Cryptography: Why the Migration Starts in 2026, Not 2030

Tue, 16 Sep 2025 00:00:00 +0000

Since August 2024, the first three post-quantum standards have been final. NIST published FIPS 203 (ML-KEM, derived from Kyber), FIPS 204 (ML-DSA, from Dilithium) and FIPS 205 (SLH-DSA, from SPHINCS+), concluding an eight-year selection process. Many read the headline, see the frequently cited year 2030 and put the topic back on the shelf. That is a misunderstanding: 2030 is a deadline, not a starting gun.

“Harvest now, decrypt later” makes it urgent

The threat does not wait for the first capable quantum computer. Attackers intercept encrypted traffic today and store it to decrypt later. Anything that must stay protected for a long time is therefore already exposed: contracts, health and HR data, long-lived keys, intellectual property, state and trade secrets. For this data, what matters is not when a quantum computer becomes practical, but how long the data must remain secret.

Germany's E-Invoicing Mandate: The 2025 to 2028 Roadmap Without the Myths

Tue, 11 Feb 2025 00:00:00 +0000

Since 1 January 2025, e-invoicing in German B2B business is no longer optional. The first stage of the new mandate is in force: every domestic company must be able to receive structured electronic invoices. Issuing them electronically is not yet compulsory, but receiving them is. The legal basis is the Growth Opportunities Act (Wachstumschancengesetz), passed by the Bundesrat on 22 March 2024; the details are set out in the Federal Ministry of Finance guidance of 15 October 2024.