Tag: CRA

A. Effective date of regulatory reporting obligations pursuant to Art. 14(1), (3) CRA

The CRA entered into force on 10 December 2024. As the first European legal act of its kind, it introduces binding cybersecurity requirements for products with digital elements throughout their entire life cycle, as well as corresponding obligations for economic operators. The requirements and obligations of the Regulation apply in principle from 11 December 2027 in accordance with Art. 71(1) CRA. An exception to this are the reporting obligations pursuant to Art. 14(1), (3) CRA, which must already be complied with from 11 September 2026. On the one hand, actively exploited vulnerabilities must be reported and, on the other hand, serious security incidents that compromise the security of a product with digital elements. Manufacturers should have implemented a functioning monitoring system in good time that enables the identification of security vulnerabilities and the timely submission of the necessary reports.

While the new reporting system is generally viewed positively, the very short deadlines have been met with criticism. Many manufacturers fear damage to their image and economic disadvantages if they inform authorities about their own security problems. To alleviate this concern, Art. 17(4) CRA clarifies that a report has no preliminary effect on liability issues.

B. AI Act

The AI Act, which came into force on 1 August 2024, is the world’s first set of rules establishing binding requirements for the development and use of artificial intelligence. The Regulation takes a risk-based approach to protect fundamental rights, democracy, the rule of law and personal safety from high-risk AI applications.

The central subject of the AI Act is so-called high-risk AI systems with potential risks to health, safety, fundamental rights, the environment, democracy and the rule of law. They are subject to strict requirements, such as a mandatory impact assessment for fundamental rights (Art. 27 AI Act). In addition, so-called general AI systems (GPAI) also fall within the scope of application; these must, for example, have technical documentation, ensure compliance with copyright law and provide information on training data (cf. Art. 53 AI Act). Additional requirements are also imposed on GPAI with high systemic risk.

The AI Act was originally supposed to come into full effectiveness on 2 August 2026, with one exception (Art. 113 AI Act), after a number of provisions (e.g. on GPAI) had already come into effect on 2 February 2025 and 2 August 2025. Following increasing criticism, the Commission has published a legislative proposal to simplify and relax the regulations. This initially concerns the “full” entry into force scheduled for 2 August 2026. This rigid deadline is now to be replaced by a dynamic mechanism. As there are some delays in the preparation of harmonised standards and guidelines, for example, the date of application of the obligations is now to be linked to their availability.

• For systems covered by Annex III of the AI Act, companies are to be given an additional six months to implement the new regulations. This applies to systems used in employment, critical infrastructure or law enforcement.
• For systems covered by Annex I of the AI Act, companies will now have 12 months longer to adapt to the changed legal situation. This applies, for example, to high-risk AI systems in the scope of the EU Radio Equipment Directive, the EU Machinery Directive or the EU Toy Safety Directive.

Nevertheless, the Commission still envisages a strict deadline: the regulations are to apply in any case by 2 December 2027 (AI systems under Annex III of the AI Act) and 2 August 2028 (AI systems under Annex I of the AI Act) at the latest. This adjustment may give economic operators some much-needed leeway, but at the same time it increases the effort companies must make to keep track of regulatory developments.

This is accompanied by planned relief measures for small and medium-sized enterprises: the privileges for SMEs have been extended to larger companies, which simplifies the technical documentation requirements and means lower fines in the event of an emergency. In addition, the AI competence requirement for providers and operators has been relaxed (Art. 4 AI Act); it is now primarily a funding obligation of the Member States and the Commission. Another simplification: there is to be a clear legal basis for all AI systems (Art. 4a of the future AI Act) in order to avoid discrimination, allowing sensitive personal data to be processed in exceptional cases, provided that strict protective measures are observed.

Parallel to the European relaxation, the national structure for implementing the AI Act in Germany is taking shape. On 12 September 2025, the Federal Ministry for Digital and State Modernisation published a draft law for the implementation of the AI Act (draft AI Market Surveillance and Innovation Promotion Act – KI-MIG-E). On the basis of this law, the Federal Network Agency (BNetzA) will be established as the market surveillance authority in the sense of a catch-all authority (Section 2 KI-MIG-E). Germany is pursuing a hybrid approach: a coordination and competence center for the AI Regulation (KoKIVO) is being created at the BNetzA, which is intended to support other specific market surveillance authorities with primary responsibility (such as the Federal Motor Transport Authority or BaFin) in their tasks.

C. NIS 2 Implementation Act – Strengthening cyber security for businesses and public administration

On 5 December 2025, the “Act Implementing the NIS 2 Directive and Regulating Essential Features of Information Security Management in the Federal Administration” was published in the Federal Law Gazette. Alongside the CRA and the Cyber Security Act (CSA), the NIS 2 Directive forms the third pillar of the EU’s efforts to strengthen cybersecurity with a focus on the resilience of selected economic sectors. Unlike the CRA, the directive does not refer to products, but to organisations. It replaces the first NIS Directive from 2016 and introduces numerous innovations in network and information security law.

In addition to the enactment of a law on the Federal Office for Information Security and on information security in institutions (BSI Act – BSIG), a number of other regulations are being amended (e.g. the BND Act, the BSI Critical Infrastructure Regulation and the Whistleblower Protection Act).

The law focuses on the following areas, which are of central importance for companies:

• Extended scope of application: Regulation is no longer limited to operators of critical infrastructures (KRITIS) or digital services. The introduction of new “facility categories” significantly expands the group of companies affected.
• New security standards: The EU’s minimum security requirements (Art. 21 NIS-2 Directive) are incorporated directly into the BSI Act. Positive for practice: The intensity of the required measures should be based on proportionality and differentiated according to category.
• Three-tier reporting system: The previous single-tier reporting requirement for security incidents will be replaced by the three-tier system of the NIS 2 Directive. The legislator promises to keep the bureaucratic effort within the scope of national discretion as low as possible.
• Stronger supervision: The Federal Office for Information Security (BSI) will be given extended powers and a wider range of tools to enforce the new requirements.

In addition to the obligations for the business sector, the draft also revises the IT security of the federal government. This includes harmonised requirements for the federal administration and the creation of the role of a “CISO Bund” as the central coordinator for information security at the government level.

D. Implementation of the EU Product Liability Directive

On 11 September 2025, the Federal Ministry of Justice published a draft bill to reform product liability law (ProdHaftG-E) – the reason for this is the implementation of the new EU Product Liability Directive (Directive (EU) 2024/2853) into national law. This marks the first comprehensive reform of the current product liability law since 1989. According to Art. 22 (1) of EU Product Liability Directive, implementation must take place by 9 December 2026.

The new ProdHaftG is scheduled to enter into force on 9 December 2026. The previous ProdHaftG will continue to apply to products placed on the market before this date. Accordingly, software updates or upgrades for products placed on the market before the cut-off date will not lead to the application of the new product liability law. Nevertheless, affected economic operators should familiarise themselves with the new regulations in good time so that they can identify and address liability risks at an early stage.

The most important changes at a glance:

I. Expansion of the definition of product

The new Section 2 of the ProdHaftG-E significantly expands the definition of product. In addition to movable goods and electricity, it will in future also include, for example:

• Software, including cloud-based and AI software, regardless of its embodiment
• digital manufacturing files, e.g. CAD files for 3D printing.

II. Definition of defect pursuant to Section 7 ProdHaftG-E

Section 7 ProdHaftG-E adopts the EU definition of defect and emphasises that a product is defective if it does not meet legitimate safety expectations. The aspects to be taken into account here include:

• Learning capabilities of the product (AI systems): undesirable developments after the product has been placed on the market can lead to defectiveness
• Combination risks: The effects of other products on the product – for example, in the smart home ecosystem – are gaining independent significance in product liability law for the first time
• Cybersecurity requirements: Compliance with product safety regulations (e.g. under the CRA) is effectively becoming a minimum standard
• Recalls and regulatory measures: Although they do not give rise to a legal presumption of defectiveness, they will have significant consequences in terms of the burden of proof in practice
• Specific needs of particular user groups: For example, in the case of life-sustaining medical devices

III. Expansion of liability addressees

Sections 3–5 and 9–13 of the ProdHaftG-E redefine the parties liable. In future, authorised representatives of the manufacturer, fulfilment service providers and online platform providers will also be liable. The manufacturer’s authorised representative is liable on the same level as the importer. The supplier continues to be liable only subsidiarily, namely if “no manufacturer, importer, agent or fulfilment service provider based in the European Union can be identified”. Anyone who significantly modifies a product (e.g. through “upcycling”) will in future be considered the manufacturer of the significantly modified product.

IV. Protected legal interests

The term “damage” (Section 1 (1) ProdHaftG-E) will in future expressly include:

• impairments to mental health,
• privately used items,
• data, unless used (exclusively) for professional purposes.

This is a comprehensible adjustment to digital usage scenarios – such as data loss due to faulty software updates.

V. Disclosure obligation

The changes in the law of evidence are fundamental. In future, defendant economic operators may be obliged to disclose evidence in order to make it easier for injured parties to enforce their claims. The prerequisite for this is a conclusive presentation of the claim requirements on the part of the claimant. If the defendant fails to comply with such an order, they will then be subject to the legal presumption of a product defect in accordance with Section 20 (1) No. 1 ProdHaftG-E. The old liability limit no longer applies: manufacturers will now be liable for unlimited financial damages..

Do you have any questions about this news, or would you like to discuss the news with the author? Please contact: Dr. Gerhard Wiebe

A. Before the outlook, a brief look back: EU Product Liability Directive and Cyber Resilience Act

In terms of product liability law and product-related cybersecurity law, 2024 has come to a rather special end. In the final spurt of the year, the EU adopted the new EU Product Liability Directive (Directive (EU) 2024/2853) and the Cyber Resilience Act (Regulation (EU) 2024/2847 – CRA). The EU Product Liability Directive, published on 18 November 2024, which increases liability in some cases, must be transposed into national law by the Member States by 9 December 2026. In contrast, the CRA, which for the first time establishes cybersecurity requirements for so-called products with digital elements, will be directly applicable in the member states as of 11 December 2027; for more information on the CRA, see our blog post.

B. Delegated Regulation (EU) 2022/30

The Delegated Regulation (EU) 2022/30 introduced data protection and cybersecurity requirements for certain radio equipment for the first time. The focus here is on radio equipment connected to the internet (see Art. 1(1) Regulation (EU) 2022/30 for the definition). Such radio equipment must not have a harmful effect on the network or its operation, nor cause misuse of network resources, thereby causing an unacceptable degradation of any service (Art. 1(1) Regulation (EU) 2022/30). They must also have security features that ensure that personal data and the privacy of the user and the subscriber are protected (Art. 1(2) Regulation (EU) 2022/30). This data protection-related requirement also applies to other radio equipment, such as wearables and toys.

The Regulation was initially scheduled to come into application on 1 August 2024, but this date has now been postponed by one year to 1 August 2025 because it will take longer to develop the harmonised standards published in the Official Journal of the European Union that will flesh out the Regulation. As long as no harmonised standards published in the Official Journal of the European Union exist, the manufacturer of a radio equipment connected to the internet shall involve a notified body in the conformity assessment procedure (Art. 17(4) Directive 2014/53/EU).

C. AI Act (Regulation (EU) 2024/1689)

On 1 August 2024, Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act) entered into force, becoming the world’s first set of rules to create binding requirements for the development and use of artificial intelligence. The Regulation takes a risk-based approach to protect fundamental rights, democracy, the rule of law and safety from high-risk AI applications.

The AI Regulation focuses on high-risk AI systems that pose potential risks to health, safety, fundamental rights, the environment, democracy and the rule of law. They are subject to strict requirements, such as a mandatory fundamental rights impact assessment (Art. 27 AI Act).

General purpose AI (GPAI) systems, for example, must have technical documentation, ensure compliance with copyright law and provide information on training data (see Art. 53 AI Act). Additional requirements are also imposed on GPAI with high systemic risk.

The AI Act provides for sanctions, which must be transposed into national law by the Member States. Violations are to be punishable by fines, the amount of which varies depending on the severity of the violation and the size of the company – from EUR 7.5 million or 1.5% of global turnover to EUR 35 million or 7% of global turnover (Art. 99 AI Act).

The AI Act will apply – after a transitional period of 24 months – essentially from 2 August 2026. However, there are a number of exceptions: Chapters I (General Provisions) and II (Prohibited AI Practices) will apply from 2 February 2025, while Chapter III, Section 4 (Notifying authorities and notified bodies), Chapter V (General-purpose AI models), Chapter VII (Governance) and Chapter XII (Penalties; with the exception of Art. 101 AI Act) as well as Art. 78 AI Act (Confidentiality) the 02.08.2025 is determined as the date of application (Art. 113 AI Act).

D. NIS 2 Directive (Directive (EU) 2022/2555)

In addition to the Cyber Resilience Act (CRA) and the Cybersecurity Act (CSA), Directive (EU) 2022/2555 (NIS 2 Directive) forms the third pillar of the EU for strengthening cybersecurity with a focus on the resilience of selected economic sectors. However, the directive is not product-related, but organisational. It replaces the first NIS Directive from 2016 and brings with it numerous innovations in network and information security law. It is no longer expected that the NIS 2 Directive, which came into force at the beginning of 2023, will be transposed into German law before the new Bundestag convenes in the course of 2025, although the deadline for transposing the directive was 17 October 2024; however, a draft of an NIS-2 implementation law (the so-called NIS-2 Implementation and Cybersecurity Strengthening Act) from the current legislative period is already available.

The NIS 2 Directive affects numerous particularly large or relevant organisations in critical sectors, which are listed in the annexes and range from the energy, finance, health and waste water sectors to space travel. A relevant size threshold is reached if an organisation has more than 50 employees or an annual turnover or balance sheet of more than EUR 10 million.

If an entity is affected, numerous obligations in the areas of governance and risk management, as well as new reporting requirements, must be observed. In particular, risk management must include technical, operational and organisational risks and measures. In the future, significant security incidents must be reported as early as 24 hours (!) after they come to light, as part of an early warning.

Finally, violations will result in severe sanctions. Depending on the size and relevance of the institution, the competent authorities will have risk identification and risk defence powers, management will be personally liable, and fines will be imposed. In serious cases, the withdrawal of certifications or authorisations and the suspension of management may even be considered.

E. AI Liability Directive

After the entry into force of the AI Act, work on the AI Liability Directive also resumed: in September 2024, the European Parliament published an impact assessment on the directive.

The basic idea is that the AI Liability Directive should not contain any substantive product liability rules. Rather, it should serve to facilitate the assertion of non-contractual fault-based claims for damages caused by an AI system. However, AI systems are also subject to the new EU Product Liability Directive, which applies regardless of fault. Nevertheless, the European Parliament sees areas of application for the AI Liability Directive that are not covered by the EU Product Liability Directive. These include, for example, pure financial losses, discrimination or violations of fundamental rights. Overall, the European Parliament tends to redesign the AI Liability Directive into a general software liability regime.

Due to the many open questions and the new ideas of the European Parliament, an end to this legislative process is not in sight. Even if the stakeholders were to agree on a legal text in 2025, there would in any case be a certain implementation period before the new liability rules would apply.

Do you have any questions about this news or would you like to discuss it with the author? Please contact: Dr. Gerhard Wiebe