This article outlines which companies are affected by the new rules, which obligations and liability risks they face, and which recommendations for action can be derived from this.

I. Affected Companies

The new rules significantly expand the group of potentially liable actors. The manufacturer remains at the centre, but in future the term will also cover anyone who develops or manufactures software, irrespective of whether it is embedded in a physical product or distributed on a stand-alone basis. As a result, manufacturers and providers of artificial intelligence systems will be subject to product liability for the first time.

According to the explanatory memorandum to the draft act, it is irrelevant how the software is provided, i. e. whether it is stored locally on a device, accessed via cloud technologies or used as software-as-a-service. The only exception is free and open-source software that is developed or supplied outside the course of a commercial activity. However, where such software is integrated by a company as a component into a commercial product, that company is liable for defects caused by it.

In addition to the manufacturer of the overall product, the manufacturer of a defective component may also be held liable, including providers of related digital services. A related service is a digital service without which one or more functions of the product could not be performed. If, for example, a navigation service integrated into an autonomous vehicle with the consent of the vehicle manufacturer fails and this causes an accident, both the vehicle manufacturer and the provider of the navigation service are liable. For providers of digital services, who have so far rarely been confronted with product liability issues, this may give rise to a new risk situation.

Where manufacturers are established outside the European Union, a number of further actors become liable so that injured persons have a tangible defendant within the internal market. These may include the importer, the manufacturer’s authorised representative established in the Union, the fulfilment service provider and, on a subsidiary basis, any distributor and, under certain conditions, the provider of an online platform. This becomes relevant in practice where, for example, a private individual purchases a device of an unknown brand from a third country via an online marketplace and that device causes damage. If there is no manufacturer or importer established in the Union, the fulfilment service provider responsible for warehousing, packaging, addressing or dispatch may be liable and, in certain circumstances, also the platform provider, provided that it creates the impression, from the perspective of an average consumer, that it is itself supplying the product. For the software sector, this means that sales and distribution structures for applications developed outside the Union must also be taken into account.

Finally, a person who substantially modifies a product already placed on the market without the consent of the original manufacturer and subsequently makes it available on the market may also be liable as a manufacturer. With regard to software, it should be noted that updates or upgrades can also constitute a substantial modification if they change the risk profile of the product. Companies that further develop or refurbish third-party products may thus find themselves in the role of manufacturer for the first time.

II. Obligations and Liability Risks

The extended scope of application entails changed obligations and increased liability risks for the companies concerned, which are likely to be felt above all in the software sector.

First, the standard of defectiveness is adapted to digital products. A product is defective if it does not provide the safety that can be expected, and additional circumstances will have to be taken into account in future. These include a product’s ability to continue learning or to acquire new features after being placed on the market, its interaction with other products, and the relevant cybersecurity requirements. For manufacturers of self-learning AI systems, this means that unexpected behaviour of the system arising only after it has been placed on the market may also become relevant for liability purposes. Cybersecurity vulnerabilities may render a product defective, for example where they can be exploited by third parties.

A significant tightening lies in the extension of liability over time. Although the relevant point in time for the assessment is, in principle, the placing on the market, the manufacturer retains control over the product if it can provide software updates or upgrades or consents to their provision by third parties. In that case, the relevant point in time shifts, and the manufacturer may also be liable for defects caused by a later update. Omissions are covered as well: anyone who fails to provide safety-relevant updates may be liable for the resulting damage for as long as they retain control over the product. Although the Directive itself does not impose an obligation to provide updates, a de facto duty (Obliegenheit) to continuously maintain digital products arises, because failing to do so can trigger liability. A product that was free of defects when placed on the market may therefore become relevant for liability purposes solely because the manufacturer subsequently fails to adapt it to new safety requirements.

These risks are reinforced by new rules on the taking of evidence. At the request of a claimant, the court may order the defendant manufacturer to disclose relevant evidence at its disposal, such as design and safety documentation or information on the software. If the manufacturer fails to comply with such an order, the product is presumed to be defective.
Whether and to what extent erroneous outputs of generative AI systems, such as incorrect information provided by a chatbot, trigger product liability has not yet been conclusively resolved. Some classify such cases as pure information liability, which falls outside the protective purpose of product liability law. Others argue in favour of liability because an AI system does not merely convey information but generates it independently. Until this has been clarified by the courts, manufacturers of AI systems should assume a potential liability risk.

III. Recommendations for Action

Several practical priorities can be derived from the extended liability risks, which companies should address even before the new rules enter into force.

First, it is advisable to take stock of one’s own role in the value chain. Since the group of potential defendants is being expanded considerably, companies should examine whether, in their specific distribution model, they qualify as a manufacturer, component or service provider, importer, fulfilment service provider or platform provider. Anyone who, for example, integrates open-source components into their own software, refurbishes third-party products or distributes applications from third countries may find themselves in a manufacturer’s position that they had not previously anticipated. This classification forms the basis for all further measures and should also include the related digital services integrated into the company’s own products.

Second, processes for providing software updates should be reviewed, and the security maintenance of digital products should be safeguarded organisationally throughout their entire life cycle. Since in future both defective updates and the failure to provide safety-relevant updates may trigger liability, it is advisable to establish a structured procedure for monitoring security vulnerabilities, assessing the need for action and providing updates promptly, and to document this procedure. For self-learning AI systems, it should also be determined how the behaviour of the system will be monitored after it has been placed on the market.

Third, documentation becomes of central importance for any later defence. Since defectiveness is presumed as soon as ordered evidence is not produced, and the burden of proof shifts to the detriment of companies, design, test and safety documentation as well as the development and release history, including training and version states in the case of AI systems, should be prepared in such a way that the absence of defects in a product can be demonstrated in the event of a dispute. In view of the period being extended to up to 25 years for latent damage, the corresponding retention periods should be extended significantly.

Finally, contractual relationships within the supply chain and insurance coverage should be adapted to the new liability situation. Since several actors are jointly and severally liable, it is advisable to review recourse and indemnification arrangements with suppliers, component and service providers and to clearly allocate responsibilities for software maintenance and security updates. At the same time, the scope of insurance coverage should be reassessed in light of the abolition of the liability cap and the increased cost of defence.

IV. Conclusion and Outlook

The modernisation of product liability law expands the group of liable actors, adapts the concept of defect to digital and self-learning products and makes it noticeably easier to enforce claims. For manufacturers and providers of software and AI systems, this results in an increased liability risk, which is further aggravated by the extension of responsibility over time, the new evidentiary relief and the abolition of the liability cap. As the act is still in the parliamentary process, amendments remain possible; however, in view of the largely fully harmonising requirements of the Directive and the transposition deadline of 9 December 2026, no fundamental deviations are to be expected. Companies are advised to initiate the preparations outlined above at an early stage in order to be ready when the new rules enter into force.

This article was created in collaboration with our student employee Emily Bernklau.

The First Senate of the Federal Constitutional Court (BVerfG) will hear on 12 October 2026 an application for abstract judicial review of statutes concerning inheritance and gift tax (Case No. 1 BvF 1/23). The proceedings concern several key provisions of the Inheritance and Gift Tax Act (ErbStG), namely:

• § 12 Abs. 3 ErbStG – valuation of real property,
• § 16 Abs. 1 ErbStG – personal tax allowances,
• § 19 Abs. 1 ErbStG – tax rates.

On 13 October 2026, the First Senate will then hear a constitutional complaint that is indirectly directed against several provisions of the ErbStG (Case No. 1 BvR 804/22). At issue, in essence, is whether the inheritance and gift tax reliefs (including the provisions relevant to relief for business assets, §§ 13a, 13b, 13c, 28a ErbStG) and the valuation rules applicable to business assets are compatible with the Basic Law. The constitutional complaint is directed against these provisions only indirectly; the relief provisions are reviewed incidentally in the constitutional complaint proceedings. The complainant argues that, when acquiring other assets that do not qualify for relief, the provisions place him at a disadvantage in a manner that is unconstitutional.

Even though §§ 13a, 13b ErbStG are not directly challenged, the decisions in these procee-dings may have significant implications for the relief available for business assets.

An Oral Hearing Is Not Yet the Decision

An important point of context is that the proceedings on 12 and 13 October 2026 are merely oral hearings – not the decision itself. The judgment will be handed down only at a later date, which is not yet known. Experience shows that several weeks to months generally elapse between an oral hearing and judgment.

There is therefore no immediate need for action merely because of the hearing dates. Never-theless, clients should monitor developments closely, as both proceedings may have fundamental implications for inheritance and gift tax as a whole.

What Happens If the BVerfG Declares the Provisions Unconstitutional?

If the BVerfG concludes that the challenged provisions violate the Basic Law in whole or in part, the central question will be: What happens during the transitional period pending new legislation?

The following principles can be derived from the BVerfG’s previous approach in comparable cases – particularly its judgment of 17 December 2014 concerning the unconstitutionality of the reliefs for business assets (§§ 13a, 13b ErbStG, BVerfG, Urt. v. 17.12.2014 – 1 BvL 21/12, DStR 2015, 31):

1. Declaration of Incompatibility Rather Than Nullity

In its 2014 decision, the BVerfG did not declare the challenged provisions void; instead, it merely established that they were incompatible with the Basic Law. Such a declaration of incompatibility is issued in particular where the legislature has several options for remedying the unconstitutional situation (BVerfG, Urt. v. 17.12.2014 – 1 BvL 21/12, DStR 2015, 31 Rn. 286). It is likely that, if it finds a constitutional violation in the current proceedings, the BVerfG will take the same approach.

2. Continued Effect of Existing Law

As a general rule, a declaration of incompatibility means that courts and administrative authorities may no longer apply the provision to the extent of the incompatibility identified and that pending proceedings must be stayed (BVerfG, Urt. v. 17.12.2014 – 1 BvL 21/12, DStR 2015, 31 Rn. 286). In the interests of reliable financial and budgetary planning and consistent administration for periods in which assessments have largely already been completed, however, the BVerfG has repeatedly – including in its 2014 decision – held that continued application of unconstitutional provisions is justified and ordered that existing law remain in force until new legislation is enacted (the so-called order for continued effect) (BVerfG, Urt. v. 17.12.2014 – 1 BvL 21/12, DStR 2015, 31 Rn. 287). The 2014 judgment stated:

“In light of the foregoing considerations, the Senate orders that the provisions found to violate the principle of equality shall remain in force until new legislation is enacted." (BVerfG, Urt. v. 17.12.2014 - 1 BvL 21/12, DStR 2015, 31, Rn. 292)

This means that, if the BVerfG again orders the continued effect of the unconstitutional provisions in these two proceedings, the current inheritance tax rules would initially continue to apply even after a finding of unconstitutionality, until the legislature enacted new legislation compatible with the Constitution. There would therefore be no legal vacuum in which no inheritance or gift tax could be levied.

3. Time Limit for the Legislature

In addition to ordering the continued effect of existing law, the BVerfG typically requires the legislature to enact new legislation within a reasonable period. In its 2014 judgment, the Court gave the legislature until 30 June 2016 – approximately 18 months after the judgment was handed down. In the case involving the unconstitutionality of the 2006 ErbStG, the period for enacting new legislation was approximately two years (until 31 December 2008).

It can therefore be assumed that, if it finds a constitutional violation, the BVerfG would likewise set a period of several months to two years in the current proceedings. In the past, the legislature has generally used the entire period and even exceeded it in 2016: the new ErbStG was not promulgated in the Federal Law Gazette until 9 November 2016, even though the deadline had already expired on 30 June 2016.

Irrespective of the length of the period, however, the question arises whether the new provisions can also be enacted with retroactive effect for measures already taken during the intervening period. Experience shows that this is possible: The 2016 amendments to the ErbStG applied retroactively to acquisitions in respect of which the tax became due after the deadline (30 June 2016) had expired (see § 37 Abs. 12 ErbStG). It is therefore advisable to monitor not only the latest possible trigger – the promulgation of the new provisions in the Federal Law Gazette – but also the expiry of the deadline for any new legislation.

If the legislature fails to fulfil its duty to enact new legislation in time, the BVerfG has far-reaching enforcement powers under § 35 BVerfGG.

Implications for the Reliefs for Business Assets (§§ 13a, 13b ErbStG)

Even though the current proceedings do not directly concern §§ 13a, 13b ErbStG, their potential implications are significant: for example, if the BVerfG were to deny the Federation’s legislative competence for parts of the ErbStG in the abstract judicial review proceedings, this could call into question the basis of the ErbStG as a whole – including the relief provisions for business assets. In addition, it is to be expected that, in connection with new legislation concerning parts of the ErbStG, the relief provisions for business assets would also be amended or tightened.

Our Recommendation

We recommend not delaying or accelerating planned asset transfers solely because of the upcoming hearing dates. If transfers of business assets have been planned for some time in any event, however, there is much to be said for implementing them promptly, as any new legislation is more likely to tighten the rules. Potential risks can, for example, be addressed through appropriate revocation or rescission clauses in the transfer agreements. Please feel free to contact us to discuss this.

Once the BVerfG’s decision is available, we will inform you of the specific implications and any action that may be required.

I. Facts of the Case

The plaintiff (owner) entrusted the defendant, by contract dated July 13, 2020, with the management of 129 residential units and 134 garages. The property management agreement encompassed ongoing management, including the conclusion of lease agreements in the plaintiff's name. The monthly management fee amounted to EUR 24 per residential unit and EUR 4 per garage, in each case plus VAT.

In addition, the agreement provided for a supplementary new-letting commission in the amount of two months' net cold rent (plus VAT), capped at EUR 10,000 gross per year.

On this basis, the defendant brokered 13 new lettings and invoiced a total of EUR 16,815.71 in commissions. Following termination of the property management agreement, the plaintiff demanded repayment of the commissions paid. The Regional Court of Krefeld (LG Krefeld) largely dismissed the claim (only EUR 149.51 was recognized). The Higher Regional Court of Düsseldorf (OLG Düsseldorf) allowed the claim on appeal and awarded the plaintiff EUR 16,666.20 plus interest. The Federal Court of Justice (Bundesgerichtshof – BGH) upheld the decision of the Higher Regional Court; the defendant's appeal on points of law was unsuccessful.

II. The Decision of the BGH

The plaintiff has a claim for restitution of the brokerage commissions paid against the property manager, as the commission agreement violates the WoVermittG (Wohnungsvermittlungsgesetz – German Housing Brokerage Act). The German Housing Brokerage Act aims to protect tenants and prospective tenants from unjustified burdens and conflicts of interest – without being limited to commission agreements with the prospective tenant themselves. In the present case, this means that the agent has no entitlement to a brokerage commission against the landlord either; the new-letting commission agreed in the property management contract is void pursuant to § 2 Abs. 2 S. 1 Nr. 2 Var. 2 in conjunction with § 2 Abs. 5 Nr. 1 WoVermittG. The commissions received by the property manager without legal basis must be repaid in full to the landlord under § 812 Abs. 1 S. 1 BGB (Bürgerliches Gesetzbuch – German Civil Code).

The BGH based its decision on a comprehensive interpretation of § 2 Abs. 2 WoVermittG. § 2 Abs. 2 S. 1 Nr. 2 Var. 2 WoVermittG is formulated in general terms – without restriction to claims against the prospective tenant. This stands in contrast to § 2 Abs. 1a, 3 WoVermittG, which explicitly refer to the prospective tenant. From this, the BGH infers that the legislature intentionally adopted a more comprehensive regulation in Abs. 2. Accordingly, a teleological reduction of the provision is also not warranted.

The WoVermittG pursues the objective of protecting tenants from unjustified burdens and creating market transparency. The BGH emphasizes that the economic position of the tenant may also be indirectly weakened when it is not the tenant themselves but the landlord who owes the commission. In the typical scenario – where the property manager and the letting agent are one and the same person – there is a risk that the landlord will pass on the incurred fees to the tenant by way of a higher rent.

III. Conclusion and Recommendations for Action

The BGH's decision provides legal clarity: residential letting agents who simultaneously act as property managers of the brokered apartment have no entitlement to a commission – not even against the landlord.

The decision primarily affects institutional owners – asset managers, capital management companies, and alternative investment funds (AIFs) – that hold residential real estate portfolios and commission their property managers to also handle new lettings.

A significant need for adjustment arises with respect to existing property management agreements, as commission, special remuneration, and success fee clauses for the brokerage of managed residential premises are void under the WoVermittG. Existing remuneration structures should be restructured accordingly.

In addition, any existing restitution claims for commissions wrongfully paid in the past must be asserted in a timely manner – taking into account the applicable limitation periods.

I. Legal framework

By recasting the eIDAS Regulation through Regulation (EU) 2024/1183, the EU legislature laid the foundation for digital identity credentials to be issued and recognised under the same rules in all Member States. The core of this framework is the EUDI Wallet, a smartphone application that allows customers, contractual counterparties and employees to identify themselves and present evidence such as a driving licence, professional qualification or proof of age, without having to rely on copies of identity documents or video identification. Each Member State is required to make at least one such wallet available by 24 December 2026, for citizens to use free of charge and on a voluntary basis. Users decide for themselves which information to disclose. An online retailer that only needs to verify that a customer has reached the age of majority should receive only that information, rather than the customer’s complete identity record.

This gives rise to two principal requirements for businesses. Anyone wishing to use the Wallet must first register and specify which data they request and for what purpose (Art. 5b). Businesses that are required to identify their customers using strong authentication under statutory or contractual requirements, such as banks, energy suppliers or telecommunications providers, are required to accept it (Art. 5f). Unless a business in one of these sectors qualifies as a microenterprise or small enterprise, it must enable its customers, at their request, to identify themselves using the Wallet from the end of December 2027. The same applies to very large online platforms, while public authorities are required to accept it in any event.

II. Germany’s EUDI Wallet “d-you”

Germany is relying on a state-run wallet, developed under the name “d-you” on behalf of the Federal Ministry for Digital and State Modernisation (BMDS) by the Federal Agency for Disruptive Innovation (SPRIND). The DIdG, currently being debated in the Bundestag, is intended to supplement the requirements of the eIDAS Regulation with national rules, including rules on responsibilities and the registration of businesses as relying parties. The Federal Government is pursuing a phased approach. The Wallet is expected to launch at the beginning of 2027 with a basic offering and then be expanded gradually to include additional credentials and applications.

At launch on 2 January 2027, only the digital identity card is initially expected to be usable. To set it up, the user reads the data from the chip in their identity card using the identity-card PIN via the smartphone’s NFC interface and then sets a personal Wallet PIN. According to the Ministry, the data is stored in encrypted form on the device, while signatures are created through a secure cloud connection using a person-specific key. A photo identity credential is expected to follow shortly after launch, and a driving licence somewhat later, although no fixed date has yet been set for the latter. Further credentials, including those issued by municipalities and universities, are in preparation. Around 40 partners from business, academia and public administration are currently developing use cases intended to be available at launch. These include parcel collection, proof-of-age checks in retail and customer verification in the banking sector.

Several functions that the eIDAS Regulation provides for the Wallet will not yet be available at launch. For the time being, the Wallet can only be used with an internet connection because cryptographic authenticity verification takes place on a server rather than on the device. Offline use will only become possible once device manufacturers make the required security components of smartphones available. Nor is it possible to confirm merely that a user has reached a minimum age without transmitting additional identity data. Authorities also cannot send administrative notices to the Wallet because it does not have a notification function.

If the smartphone is replaced, the identity data must be read in again because device-bound content cannot be transferred and cloud backups cannot be created. A Wallet locked after multiple incorrect PIN entries must be set up again in full. It also remains unclear whether a PIN-reset service will be available in time, as does the pending security assessment. At present, the app can only be obtained through the Apple App Store or Google Play Store, making a user account with one of these providers necessary.

Businesses that wish to integrate the Wallet into their processes, or will be required to do so from the end of 2027, should therefore not expect broad use immediately after launch. Existing identification procedures will have to be maintained in parallel for the foreseeable future. Planning should also take into account that the Wallet’s functionality will expand gradually over the coming months.

III. The European Business Wallet (EBW)

While the EUDI Wallet is intended for natural persons, the EBW is intended to provide businesses with their own instrument for conducting digital legal transactions with authorities and business partners. In November 2025, the Commission presented a proposal for a regulation to this effect. Unlike the EUDI Wallet, the EBW is conceived as cloud-based infrastructure rather than a smartphone application, because business processes should not in every case require the personal involvement of an executive.

Under the proposal, businesses would be able to identify themselves across the EU via the EBW, electronically sign and seal documents, and store and present credentials such as a VAT identification number or a trade licence. Employees could be granted different levels of authorisation. A secure delivery channel would also enable legally binding communications with authorities, comparable to a digital registered letter. The Commission identifies tax returns, applications for grants, procurement procedures and the establishment of a branch in another Member State as potential use cases, among others. Transactions conducted through the Wallet would be legally equivalent to paper-based procedures or appearing in person. Use of the EBW would be voluntary for businesses, self-employed persons and associations, but public authorities would be required to accept it.

The Council and the European Parliament established their negotiating positions in June and September 2026, respectively. Among other things, the Parliament is calling for providers not to be controlled directly or indirectly by third countries and for the data to be stored exclusively in the EU. A political agreement is sought by the end of 2026. Since formal adoption and technical implementing acts will still be required thereafter, the EBW is unlikely to be practically available for at least several years.

IV. Recommendations for action

Businesses should first clarify whether they are subject to the acceptance obligation under Art. 5f. The key questions are whether they are required to identify their customers using strong authentication under statutory or contractual requirements and whether they exceed the thresholds for small enterprises. Even without a corresponding obligation, voluntary integration may be worthwhile, for example where proof of age or identity is checked regularly. The currently limited functionality suggests that this decision should not be based solely on the launch date.

A review should then be undertaken of the processes in which customers, contractual counterparties or employees are identified, for example when opening an account, entering into a contract or restoring access. This provides the basis for planning where the Wallet can be integrated technically. Since it will initially function only online and individual features will be added gradually, existing procedures should be retained as a fallback option. Businesses that use external service providers for identity verification should clarify at an early stage whether and when those providers will offer integration with the Wallet.

Registration as a relying party should be prepared before use. It must be determined which data is actually required for which purpose, since no data may be requested beyond the information registered. Users should also be able to understand the requests and report suspected unlawful data requests to the data protection authorities. Registration should therefore be combined with a data protection law review. This should cover, in particular, the legal basis, information obligations, the records of processing activities and, where appropriate, a data protection impact assessment (DPIA).

Organisational questions must also be addressed. Responsibilities for implementation and operation should be defined, as should procedures for technical disruptions. Since the Wallet must be set up again after a device change or lockout, customer enquiries should be expected. Customer-service staff should be prepared for them.

With regard to the EBW, monitoring and preparing is currently more appropriate than implementation. Businesses can, however, already identify the procedures in which they communicate with authorities and review their rules on representation and signing authority. Such an inventory will make it easier to develop an authorisation concept for the Wallet later. It should also be clarified how incoming deliveries through a digital channel would be recorded and processed within the applicable deadlines. The further legislative process should be monitored, particularly with regard to the requirements for providers and the transitional periods.

V. Conclusion and outlook

With the launch of “d-you” at the beginning of 2027, the EUDI Wallet will become practically usable in Germany for the first time, although initially with significantly limited functionality and subject to the DIdG being adopted in time. For businesses, the end of December 2027 is particularly important, when the acceptance obligation will apply to many private providers. The extent to which the Wallet will be useful in everyday life will depend largely on how quickly key functions, such as offline use, confirmation of individual attributes and additional credentials, are added.

The EBW, by contrast, is still in the legislative process. Even if a political agreement is reached by the end of 2026, some time is likely to pass before it becomes practically available. Businesses would therefore be well advised to prepare for the foreseeable obligations relating to the EUDI Wallet and initially monitor the development of the EBW.

This article was created in collaboration with our student employee Emily Bernklau.

This update summarizes the most important changes for companies arising from this regulatory package and identifies areas where action is required.

I. Modernization of Design Law

1. Expanded Definition of Design – New Subject Matter of Protection

The definition of “design” in Sec. 1 DesignG will be significantly broadened. In the future, animated, dynamic, and state-changing designs will also be eligible for protection – for example, loading animations, animated logos, or interactive user interfaces. The definition of “product” (“Erzeugnis”) is likewise extended: it now expressly covers non-physical forms, graphical user interfaces (GUIs), logos, surface patterns, and interior designs.

What this means for companies: Companies developing digital products, apps, or software with visual design elements now have significantly expanded options for protecting them as registered designs. At the same time, the risk of infringing third-party design rights increases.

2. 3D Printing: New Acts of Infringement

One of the most practically significant changes concerns 3D printing. Preparatory acts such as creating, downloading, copying, and distributing 3D printing files that contain a protected design now constitute independent acts of infringement (Sec. 38(1) sentence 3 DesignG (new version)). In concrete terms, this means that merely making a 3D printing template for a design-protected product available on a platform may constitute a design infringement – regardless of whether the product is actually manufactured.

Companies operating 3D printing platforms or offering 3D printing files will need to carefully review their content for potential design infringements. Conversely, the new regulation provides design holders with effective means to combat the digital dissemination of their designs.

3. Transit Provision – Protection During Transit

A new Sec. 38a DesignG allows design holders, for the first time, to take action against goods that infringe design rights and are merely transiting through Germany (transit goods) without being released for free circulation. Previously, this option was available only for imported or exported goods. The transit provision (“Transit Ban”) (“Durchfuhrverbot”) is an important instrument in the fight against product counterfeiting, particularly for supply chains that pass through European ports and logistics hubs.

4. Expanded Defenses

The expanded rights are balanced by new defense options. Sec. 40 DesignG now contains additional limitations:

• Commentary, criticism, and parody of a registered design will be permissible in the future (Sec. 40(1) no. 7 DesignG), provided they are compatible with fair commercial practices.
• Acts for the purpose of identification of a product (Sec. 40(1) no. 6 DesignG) – for example, for comparison or reference purposes – are expressly permitted.
• The right of prior use (Sec. 41(1) DesignG) is clarified: anyone who developed and began using a design independently and in good faith before the filing date may continue to use it. However, the granting of licenses is expressly excluded.

For defendant companies, these limitations provide new lines of defense. Design holders should keep these defenses in mind when enforcing their rights.

5. Invalidity Proceedings – Simplified and Harmonized

The terminology in invalidity proceedings is being harmonized: in the future, the only term will be “declaration of invalidity” (“Erklärung der Nichtigkeit”) (replacing the former “determination or declaration”). The option for third parties to intervene in invalidity proceedings before the DPMA (Sec. 34c DesignG (old version)) is being eliminated – however, the consolidation of proceedings remains possible.

Important: Invalidity can now also be declared after the term of protection has expired or after the design has been surrendered (Sec. 33(5) DesignG (new version)). This is particularly relevant for pending damages claims.

6. Repair Clause and Registration Symbol

The existing repair clause (Sec. 40a DesignG) is being amended: manufacturers and sellers of spare parts will in the future be required to inform consumers through a clear and visible indication of the commercial origin of the component. The transitional period for existing design rights is shortened to December 9, 2032.

New is also the registration symbol Ⓓ (Sec. 38b DesignG), which allows holders to inform the public about the design protection – comparable to the ® symbol in trademark law.

7. Terminological Adjustment: "EU Design" (Unionsdesign)

The former term "Community design" (Unionsgeschmacksmuster) is being replaced throughout by "EU design" (Unionsdesign). This follows the codified Regulation (EU) 2026/715 on EU designs, which entered into force on July 1, 2026. All references in the DesignG are being updated accordingly.

8. Transitional Periods and Key Dates at a Glance

The key dates:

• Entry into force of the main provisions (Articles 1–4): December 9, 2027
• Applications filed before December 9, 2027: The previous rules continue to apply to pending application proceedings (Sec. 72(2) DesignG).
• Pending invalidity applications and counterclaims before December 9, 2027: The previous law applies (Sec. 72(4), (5) DesignG).
• Repair clause for existing rights: Applies only from December 9, 2032 (Sec. 73(2) DesignG).

II. Conclusion and Recommended Actions

Design law: The modernized design law significantly expands the scope of protection – in particular for digital and animated designs and against 3D printing piracy. Companies should review their design portfolios and assess whether previously unprotected digital design elements are now eligible for registration. At the same time, increased attention must be paid to third-party design rights in product development, as the range of infringing acts has grown considerably. The transitional periods – in particular the key date of December 9, 2027 – should be used for timely preparation.

We would be happy to advise you on the specific implications for your company.

What is already noteworthy is the legislative-technical placement of the provision: § 15b UWG is not being introduced through an independent legislative procedure but is instead appended by way of an amendment motion (Änderungsantrag) of the coalition parliamentary groups CDU/CSU and SPD to the Act on the Modernisation of Design Law (Gesetz zur Modernisierung des Designrechts, BT-Drs. 21/6215). The substantive connection to design law is nil – this is a legislative piggyback manoeuvre that is unprecedented in its short notice.

Content of § 15b UWG-E

The new provision bears the title “Special Provisions on the Third Act Amending the Act against Unfair Competition” (Sondervorschriften zum Dritten Gesetz zur Änderung des Gesetzes gegen den unlauteren Wettbewerb) and provides that the assertion of injunctive relief claims under § 8(1) UWG for violations of the new EmpCo provisions – in particular § 5(2) No. 1 UWG (ecological and social characteristics), § 5b(3a) UWG, as well as the new items of the Annex (Nos. 2a, 4a, 4b, 4c, 10a, and 23d) – with respect to goods placed on the market before 27 September 2026 shall be exercised in good faith (nach Treu und Glauben) taking into account the principle of proportionality (Grundsatz der Verhältnismäßigkeit).

The following balancing criteria are specified:

1. the severity of the legal violation,
2. the efforts undertaken by the business to remedy the legal violation,
3. the costs associated with remediation, and
4. the environmental burden associated with remediation.

The provision has a sunset clause: pursuant to Article 6 in conjunction with Article 7(3) of the draft law, § 15b UWG will automatically expire on 27 September 2028.

Criticism

1. Timing: Three Days Do Not Constitute a Legislative Procedure

The vote on § 15b UWG on 24 September 2026, only three days before the entry into force of the EmpCo rules, is legislatively highly problematic. Directive (EU) 2024/825 was adopted on 28 February 2024 and published in the Official Journal on 6 March 2024. The transposition deadline ran until 27 March 2026, and the application deadline until 27 September 2026. The German legislator thus had more than two and a half years to develop a transitional solution for existing inventory. Instead, the regulation came literally at the last minute.

2. Practicability: No Safe Harbour, but Case-by-Case Judicial Assessment

§ 15b UWG-E is expressly not a blanket sell-off period. A violation of the new greenwashing rules remains a legal violation even for existing stock – the provision merely modifies the enforceability of the injunctive relief claim at the level of proportionality. The result is a graduated legal consequence: ranging from additional disclosure obligations, through a court-granted sell-off period, to the complete exclusion of the injunctive relief claim.

In practice, this means: where exactly a specific case falls on this spectrum will have to be determined by the courts. For companies that are currently implementing what is perhaps the most significant overhaul of their environmental communications in recent decades, § 15b UWG-E offers, at best, an argument but not a shield. The open-ended wording “in good faith, taking into account the principle of proportionality” (nach Treu und Glauben unter Berücksichtigung des Grundsatzes der Verhältnismäßigkeit) is unlikely to prevent a wave of cease-and-desist letters (Abmahnwelle) but will, at most, shift the litigation to the level of legal consequences.

There is also a documentation risk: the legislative explanatory memorandum (Gesetzesbegründung) presupposes that companies are able to demonstrate their “efforts to remedy the legal violation.” Any company that is not already comprehensively documenting – cut-off date inventory, order dates, packaging changeovers, corrective measures – will hardly be able to successfully invoke § 15b UWG.

Finally, it should be noted that the provision expressly does not privilege online advertising and websites – these must be fully adapted to the new requirements by 27 September 2026. The purported facilitation applies only to physical existing stock.

3. Relationship to the CPC Common Understanding

In June 2026, the consumer protection authorities of the CPC Network (Consumer Protection Cooperation) agreed on a Common Understanding on “old stock situations.” This represents a coordinated, EU-wide enforcement framework that requires the authorities to adopt a proportionate, case-by-case enforcement approach in genuine old stock scenarios.

The fundamental principles of the Common Understanding are largely congruent with the balancing criteria of § 15b UWG-E: good-faith compliance, consideration of packaging cycles, inventory volumes, production orders, shelf life, and avoidance of disproportionate measures such as destruction or recall.

However, whereas the Common Understanding is addressed directly to the competent authorities, § 15b UWG-E governs the civil law enforcement of injunctive relief claims – precisely the area where, in Germany, the bulk of enforcement is carried out by competitors and trade associations, not by public authorities.

EU Law Risk

It should not go unmentioned that the Unfair Commercial Practices Directive (UGP-Richtlinie, Directive 2005/29/EC), which is amended by the EmpCo Directive, is, in the view of the European Commission, in principle a fully harmonising directive. National deviations – whether stricter or more lenient rules – are in principle not permissible.

The legislative explanatory memorandum relies on the Commission’s Q&A paper of September 2026 as justification; however, the Q&A paper is expressly only a non-binding interpretive aid of the Commission services. Whether § 15b UWG-E would withstand scrutiny under EU law is, at the very least, uncertain.

Conclusion

§ 15b UWG-E is a symptomatic example of reactive legislation under time pressure: well-intentioned, but difficult to apply in practice. The provision offers no clear sell-off deadlines, no reliable safe harbours. Companies should not rely on § 15b UWG-E to protect them from cease-and-desist letters (Abmahnungen) or injunctions (einstweilige Verfügungen). The recommendation remains: achieve full EmpCo compliance as quickly as possible and document the transition process comprehensively – § 15b UWG-E is an argument in litigation, but not a carte blanche.

I. Legislative Status and Timeline

The Data Omnibus proposal stems from the Commission’s efforts to simplify the Union’s digital legal framework and to reduce the compliance burden on companies. It was published on 19 November 2025 together with a second initiative, the Digital Omnibus on Artificial Intelligence (AI Omnibus). Both drafts pursue the same overarching objective but address different subject matter: the AI Omnibus is limited to amendments of the AI Act and has already entered into force as Regulation (EU) 2026/1744 of 8 July 2026, whereas the Data Omnibus addresses data law and touches on the core of the GDPR (we reported in Data Protection Update No. 250).

Unlike the AI Omnibus, the Data Omnibus has not yet been adopted. The procedure remains in its first reading, during which the Council first establishes its negotiating position. Following several compromise proposals discussed under the Cypriot Council Presidency, the file is now with the Irish Council Presidency, which presented a revised proposal in early September 2026. This proposal continues to be assessed differently across Member States on several points, so that a common Council position is not yet foreseeable.

Several procedural steps are therefore still required before a final regulation is reached. Only after the Council agrees on a general approach can the European Parliament determine its position, before negotiations between the institutions commence in the trilogue. Against this background, a conclusion of the procedure is not expected before 2027, although the precise timeline cannot be reliably predicted given the current state of negotiations.

II. Key Regulatory Content

The draft addresses four areas that are closely interlinked in practice: the GDPR, the Data Act together with adjacent data legislation, the cookie rules of the ePrivacy Directive, and the notification framework for cyber and data protection incidents. Central among these are the amendments to the GDPR, as they intervene directly in the regulatory substance of the Regulation for the first time and affect its core concepts.

1. Personal Data Status of Pseudonymized Data

For the first time, the draft directly clarifies the definition of personal data in Article 4(1) GDPR. It clarifies that pseudonymized data are not automatically personal data for a recipient merely because they constitute personal data in the hands of the controller. Instead, the decisive factor is whether the specific entity has means that are reasonably likely to lead to identification. This incorporates into the text of the Regulation the concept of a relative, recipient-focused approach to identifiability known from the case law of the Court of Justice of the European Union. In practical terms, the same dataset may in the future be personal data for one company, while for another company that lacks realistic means of identification, it falls outside the scope of the GDPR.

For companies, this represents a noticeable expansion of their room for maneuver, but also an increased documentation requirement, since the absence of identifiability must be demonstrated on a case-by-case basis. In the Council negotiations, this point is among the comparatively consensus-capable ones. Currently under discussion are primarily safeguard mechanisms intended to prevent circumvention through disclosure to entities that possess means of identification.

2. AI Training Based on Legitimate Interest

The draft clarifies that the training, testing, and validation of AI systems using personal data can in principle be based on a legitimate interest under Article 6(1)(f) GDPR. The established assessment framework for legitimate interest remains unaffected, meaning that a balancing of interests must still be carried out on a case-by-case basis and the principles of the Regulation continue to apply. However, the draft specifies which considerations are to be taken into account in this balancing exercise, in particular the benefit of the processing, the reasonable expectations of data subjects, and the envisaged safeguards, which include a right to object and compliance with technical signals indicating opposition to use for training purposes.

In addition, the draft provides for a narrowly circumscribed exception for special categories of personal data. Under the new Article 9(2)(k) GDPR, the processing of such data in the AI context is to be permissible insofar as it does not occur in a targeted manner, but rather sensitive data are merely unavoidably contained in the training data, and the controller implements technical and organizational measures to avoid and remove such data to the greatest extent possible. This aspect is one of the most contentious elements of the proposal. While certain Member States consider the approach viable, it is rejected elsewhere – partly because AI-specific special rules are considered misplaced in the fundamentally technology-neutral GDPR, and partly because a more far-reaching waiver of the case-by-case burden of proof is demanded. A viable majority has not yet emerged on this point.

3. Adjustments to Data Law (Data Act and Adjacent Legislation)

A substantial portion of the draft concerns the consolidation of data law, in which the Data Act is to be developed into the central legal act, while the Data Governance Act, the Regulation on the free flow of non-personal data, and the Open Data Directive are to be merged into it. In addition to numerous supplementary definitions, two areas of practical relevance are being recalibrated. First, the protection of trade and business secrets is strengthened: data holders are to be able to refuse the sharing of data more easily, particularly where sensitive information could reach third countries with lower levels of protection. Second, public authority access to corporate data is more narrowly defined, with disclosure being required only in the case of a public emergency and no longer in the case of a general exceptional necessity.

For data-holding companies, this tends toward a reduction in burden, as both the protection of trade secrets and the limits on governmental access rights are tightened. In the Council negotiations, discussions continue regarding the precise scope of the trade secret exception and accompanying interpretive guidance; the general direction of a more restrictive design of access rights is largely undisputed.

4. Integration of Cookie Rules into the GDPR

The draft transfers the consent requirement for storing and reading information on end-user devices – previously regulated in the ePrivacy Directive – into the GDPR, and seeks to reduce the burden described as “consent fatigue” caused by the multitude of cookie banners. The proposal envisages transmitting users’ individual decisions in the future via automated, machine-readable signals – such as those from the browser or operating system – directly to websites. In addition, a catalog of consent-free grounds is to be established, specifying in which cases storage is permissible without separate consent.

5. Simplification of Notification Obligations

Finally, the draft aims to consolidate the notification and reporting obligations currently scattered across multiple legal acts. In the area of the GDPR, the notification to the supervisory authority is to be waived where a data breach is unlikely to result in a high risk, although the documentation obligation remains in place. Beyond this, the Commission pursues the objective of replacing multiple notifications under the GDPR, NIS 2, and other legal acts with a common notification procedure through a single reporting point, so that an incident would only need to be reported once and would be forwarded in the background to the competent authorities.

For companies operating in multiple Member States, this would represent a noticeable reduction in burden. However, the concrete design of this single reporting point is particularly contentious in the Council and has already moved significantly away from the original model of a uniform European reporting office in the course of the negotiations, so that the practical benefit for those subject to notification obligations cannot yet be reliably assessed.

III. Recommendations for Companies

The Data Omnibus has not yet been adopted, so there is no immediate need for implementation at present. Nevertheless, preparatory steps can already be taken that will reduce the subsequent adjustment effort and make potential room for maneuver usable.

First, it is advisable to review one’s own data inventories with regard to the proposed recipient-focused approach to personal data status. Companies should document what means of identification they actually possess and in what constellations re-identification can realistically be excluded. Such an inventory creates the basis for quickly assessing, in the event of the draft’s adoption, which processing operations could in the future fall outside the scope of the GDPR, and it is also beneficial regardless of how the legislative process proceeds.

Second, companies that use personal data for the development or operation of AI systems should review their legal bases for processing and their safeguards at an early stage. Since the draft bases training on legitimate interest but leaves the required balancing of interests unaffected, a careful and comprehensibly documented balancing assessment is of particular importance. It is advisable to incorporate the envisaged safeguard mechanisms – in particular a practicable right to object and compliance with technical signals indicating opposition to use for training purposes – into one’s own processes already now.

Third, existing notification and consent processes should be examined to determine whether they can be adapted to the foreseeable changes. This concerns both the internal handling of data breaches, where the notification threshold is to be aligned with the high-risk standard in the future, and the design of cookie consent, which could be restructured through machine-readable signals and a catalog of consent-free grounds. Since the concrete design of these areas is still open in the Council, companies should monitor further developments and refrain from premature restructuring, while at the same time preparing their own processes so that they can be adapted with reasonable effort.

IV. Conclusion and Outlook

The Data Omnibus addresses central points of data law through the redefinition of personal data status, the legal basis for AI training, and the consolidation of notification obligations, combining relief for companies with shifts in established obligations. Its practical significance will only become apparent with the final text, which is currently not foreseeable, as neither a common position within the Council nor the stance of the European Parliament has yet emerged. Given the early stage of the legislative process, there is no immediate need for companies to act, but there is reason to follow further developments and to prepare their own processes for the foreseeable changes.

This article was created in collaboration with our student employee Emily Bernklau.

I. AI Training as a Data Protection Operation

When companies wish to use their data holdings for AI training, this can occur in two ways. On the one hand, they can train a model themselves or adapt an existing system with their own data, for example through fine-tuning. On the other hand, they can provide their data to an external provider whose system is then further developed on that basis. In both cases, the same fundamental question arises: whether, and under what conditions, the data in question may be used for this purpose at all.

As soon as an AI system processes data relating to identified or identifiable natural persons, the GDPR applies (Art. 2(1), Art. 4(1) GDPR). This is the case regardless of whether the data are collected for the purpose of creating a training dataset, used for the actual training, or processed only in the system’s outputs. The use of AI rarely constitutes a single operation; rather, it breaks down into several phases that must each be considered separately: the collection of data, their use for training or adapting a system, ongoing operations, and finally the generation of results. Each of these phases may involve its own purposes, categories of data subjects, and consequently its own requirements.

Of fundamental importance is first the clarification of the role in which the company acts. Whoever decides on the purposes and means of processing is the controller within the meaning of Art. 4(7) GDPR and bears the primary data protection burden. If the company trains the system itself, it is without question responsible for this processing. If, however, it provides the data to a provider, the classification depends on in whose interest and for whose purposes the training takes place. If the provider processes the data solely under the company’s instructions, it is a processor, which requires an agreement pursuant to Art. 28 GDPR. If, by contrast, the provider uses the supplied data to improve its own models – and thus for its own purposes – joint controllership under Art. 26 GDPR or independent controllership of the provider may be applicable.

II. Requirements Under the GDPR

1. Legal Basis for Processing

Every processing of personal data is subject to the requirement of a legal basis under Art. 6(1) GDPR. For AI training with a company’s own or supplied datasets, the primary bases to consider are consent (Art. 6(1)(a) GDPR) and legitimate interest (Art. 6(1)(f) GDPR).

Consent initially appears to be the most legally certain path, but proves operationally unstable in the training context. Since it may be withdrawn at any time pursuant to Art. 7(3) GDPR, significant difficulties arise because the effect of data already incorporated into a fully trained model can hardly be reversed after the fact. As the supporting basis for a training project, consent is therefore suitable only in narrowly defined constellations.

The practical default is thus the legitimate interest under Art. 6(1)(f) GDPR. Reliance on this basis requires a three-stage assessment: the identification of a legitimate interest, the determination of necessity, and a balancing against the interests and fundamental rights of data subjects. The Higher Regional Court of Cologne (Oberlandesgericht Köln) confirmed in summary proceedings that the development and training of AI can constitute a legitimate economic interest (judgment of 23 May 2025, case no. 15 UKl 2/25), albeit only on the basis of a summary review. What remains decisive, however, is the balancing in the individual case, which becomes more rigorous the more intensely the processing interferes with the rights of data subjects. Since the controller must demonstrate lawfulness (Art. 5(2) GDPR), careful documentation of the assessment steps is advisable.

A separate issue arises when data originally collected for a different purpose are to be used for training – for example, customer data from contract performance. In this regard, the principle of purpose limitation (Art. 5(1)(b) GDPR) must be observed, which permits further use only where both purposes are compatible. The compatibility assessment required under Art. 6(4) GDPR becomes more difficult the further the training purpose diverges from the original collection purpose, so that the use of such data for an unrelated AI model regularly requires separate justification.

Regarding the future legal framework, reference should be made to the proposed Art. 88c draft GDPR, which would expressly extend the legitimate interest basis to the development and operation of AI (as reported in Data Protection Update No. 223).

2. Specific Considerations for Sensitive and Employee Data

An increased level of difficulty arises as soon as special categories of personal data within the meaning of Article 9(1) GDPR are affected – such as information concerning health, ethnic origin, or political beliefs. These data are subject to a general prohibition on processing, which may only be overridden under the narrow conditions set out in Article 9(2) GDPR. A legitimate interest is expressly insufficient for this purpose; rather, a separate legal basis is required. This problem is particularly acute in the context of AI training, because the large underlying datasets almost inevitably contain sensitive data, especially since such information can already be inferred indirectly from seemingly innocuous data points. The mere possibility of such an inference may trigger the prohibition, irrespective of any corresponding intent on the part of the controller. That said, the scope of the prohibition with respect to the non-targeted processing of sensitive data during AI training remains disputed. The Higher Regional Court of Cologne (OLG Köln) has adopted an activity-based limitation in this regard, whereas the Higher Regional Court of Schleswig (OLG Schleswig, judgment of 12 August 2025, case no. 6 UKl 3/25) considered a violation of Article 9(1) GDPR to be likely, leaving the question unresolved for the time being.

This risk can be mitigated through data-minimizing design. Anonymization, pseudonymization, and the use of synthetic data substantially reduce the intensity of the interference with data subjects' rights. However, pseudonymized data remain personal data as long as re-identification is possible with the aid of additional information (Article 4(5) GDPR), and the generation of synthetic or anonymized data may itself constitute processing. Moreover, the controller bears the burden of demonstrating that a trained model is in fact anonymous. With regard to the future legal framework, the Data Omnibus proposes a dedicated provision in Article 9(5) GDPR-E for incidentally captured sensitive data, although this provision has not yet entered into force and, in its current form, is not free from criticism.

Where employee data are used for training purposes, the processing must ultimately be assessed directly against Articles 6 and 9 GDPR. In addition, co-determination rights of the works council under Section 87(1) no. 6 of the Works Constitution Act (BetrVG) are triggered as soon as the system is capable of monitoring employee conduct or performance, which is why the works council should be involved at an early stage.

3. Data Subject Rights in Relation to the Trained Model

The rights of data subjects continue to apply without restriction in the context of AI, in particular the rights to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), and objection (Art. 21 GDPR). Their enforcement with respect to the trained model, however, presents particular difficulties, because individual personal data are not stored there as discrete data records but have been absorbed into the model parameters.

The question therefore arises whether the erasure of individual data points from the database suffices, or whether the model must be retrained – especially since complete “unlearning” of data already incorporated is, according to the current state of technology, hardly feasible. This is compounded by the phenomenon of memorization, in which a model can reproduce training data in its outputs in whole or in part.

The mere use of output filters that suppress such reproduction does not satisfy data subject rights requirements, because the underlying data continues to exist within the model and still poses a risk. The controller is therefore not released from its obligations. What is required instead is a comprehensible concept that sets out how such requests will be handled and at what intervals models will be reviewed and, if necessary, retrained. In practice, it is advisable to establish these processes before an AI system is deployed, rather than improvising them only when a complaint arises.

III. Copyright Limitations on Training with Third-Party Data

Where not only a company’s own holdings but also third-party content is used for training – for example, texts, images, or other works retrieved from the internet – a separate copyright protection strand applies alongside data protection.

The relevant provision is the limitation in § 44b of the German Copyright Act (Urheberrechtsgesetz – UrhG), which permits reproductions for the purpose of text and data mining (TDM) and thus also covers AI training in principle. However, the use is excluded insofar as the rights holder has declared a reservation of use, which, in the case of works accessible online, must be in machine-readable form (§ 44b(3) UrhG).

The scope of this limitation in the AI context is the subject of case law that has not yet been consolidated. The Regional Court of Munich I (Landgericht München I), in its judgment of 11 November 2025 (case no. 42 O 14139/24 – GEMA/OpenAI), held that the mere capacity for reproduction of memorized content inherent in the model can constitute a reproduction under § 16 UrhG, and that such reproduction is no longer covered by § 44b UrhG because the limitation only covers preparatory reproductions for the compilation of the training corpus. The decision is not final and has been subject to considerable criticism, among other things because it insufficiently accounts for the technical particularities of generative models and because a referral to the CJEU was not made.

For companies, this means that the copyright permissibility of training with third-party content is currently subject to considerable legal uncertainty, and that compliance with declared reservations of use requires particular diligence.

IV. Checklist for AI Training in Companies

• Clarify roles and provider agreements: First, it must be determined whether the company acts as controller, processor, or joint controller, as the respective obligations follow from this classification. Where an external system is used, an agreement pursuant to Art. 28 GDPR must be concluded, and it must be contractually ensured that the provider does not use the supplied data for its own purposes, in particular not to improve its own models.
• Determine and document the legal basis: A viable legal basis must be established for the processing – typically the legitimate interest under Art. 6(1)(f) GDPR – and its three-stage assessment must be documented in a comprehensible manner. If existing data holdings are to be used, the compatibility with the original collection purpose must additionally be assessed under Art. 6(4) GDPR.
• Handle sensitive and employee data separately: For special categories of data, the legitimate interest is not sufficient. A separate legal exception under Art. 9(2) GDPR is required, along with measures to avoid sensitive data in the dataset as far as possible. If the project involves employee data, Art. 6 and Art. 9 GDPR must be applied directly, and the co-determination rights of the works council under § 87(1) no. 6 BetrVG (German Works Constitution Act) must be observed, which is why the works council must be involved at an early stage.
• Leverage data minimization and ensure data subject rights: Anonymization, pseudonymization, and synthetic data should be employed to reduce the intensity of interference, while bearing in mind their limitations. At the same time, a comprehensible concept must be maintained for how access, rectification, erasure, and objection requests in relation to the trained model will be addressed, since output filters alone are not sufficient.
• Review third-party content and other protective rights: Where third-party content or content sourced from the internet is included, the limitation under § 44b UrhG (German Copyright Act) and any machine-readable reservations of use must be observed. Confidential information, trade secrets, and professional secrecy obligations (§ 203 StGB (German Criminal Code)) are subject to independent restrictions that apply alongside the GDPR and must be separately secured by contract.
• Observe obligations under the AI Act: Irrespective of the data protection assessment, the operator is subject to independent obligations under the AI Regulation (AI Act), in particular the requirement to ensure adequate AI competence (Art. 4 AI Act) as well as transparency and labeling obligations (Art. 50 AI Act).

V. Conclusion and Outlook

The use of a company’s own and third-party data for AI training is legally demanding but manageable. The existing legal framework already provides a robust assessment program, centered on the GDPR and supplemented by copyright limitations as well as the operator obligations under the AI Act. Those who carefully determine the legal basis, appropriately account for sensitive data and data subject rights, and contractually secure cooperation with providers can already design training projects in a legally sound manner today. The planned Data Omnibus will expressly regulate certain of these questions in the future, in particular through a dedicated legal basis for AI training (Art. 88c draft GDPR) and a specific rule for sensitive data (Art. 9(5) draft GDPR). Since the proposal is still in the legislative process and its content has not yet been finalized, its practical significance remains to be seen.

This article was created in collaboration with our student employee Emily Bernklau.

Especially with market-dominant platforms such as Instagram and Facebook, the following question arises:

Are platforms permitted to suspend commercially used accounts or restrict functionalities at their own discretion? Or are there legal limits to platform power?

In addition to contractual claims, competition law claims are particularly relevant. These offer an important advantage: despite the terms of service stipulating the application of Irish law and the jurisdiction of Irish courts, such claims can, in principle, be asserted under German law and before German courts.

1. Dominant Market Position of Meta

A prerequisite for a competition law analysis is, first and foremost, a corresponding dominant market position of Meta. Factors such as user numbers, network effects, data holdings, switching costs, lock-in effects, and the actual alternatives available on other platforms may be relevant for this assessment.

The decisive factor is not merely whether other social networks exist. Rather, the key question is whether these offer economically viable and reasonable alternatives.

A professionally used account consolidates reach, followers, customer contacts, content, reviews, and established communication structures. These cannot simply be transferred to another platform.

Accordingly, courts have already affirmed a dominant market position for Meta in numerous decisions.

2. Account Suspension as Unfair Hindrance

Under § 19 GWB, the abuse of a dominant market position is prohibited. This includes, in particular, the unfair hindrance of other undertakings and their discriminatory treatment without objectively justified reasons. It is required that the competitive position of the affected undertaking is impacted.

An account suspension may, under these conditions, constitute an unfair hindrance.

This requires a balancing of the interests of both sides.

On Meta’s side, the following interests may be relevant:

• protection against unlawful content,
• combating fraud and spam,
• enforcement of Community Standards,
• protection of other users,
• prevention of abusive or automated use.

On the other hand, the following considerations may apply on the part of the affected undertaking:

• existing customer relationships and community,
• established reach and followers,
• ongoing advertising campaigns,
• monetization and revenues,
• existing cooperation agreements,
• investments in building the account,
• loss of customer contacts and digital reputation,
• lack of, or only hardly reasonable, alternative options.

The greater the economic dependence on the platform, the higher the requirements for objective justification of a suspension may be.

3. Relative Market Power as a Catch-All Provision

Even if classical market dominance by Meta cannot be established with certainty, § 20 GWB may be relevant.

In this case, a dominant market position is not required. The decisive factor is rather whether an undertaking is dependent on the intermediary services of the platform and whether no sufficient and reasonable alternatives are available. Particularly in the case of professionally built social media accounts, such relative market power may come into consideration on a case-by-case basis.

4. Art. 102 TFEU

Where trade between Member States is affected, Art. 102 TFEU may also be applicable. This provision prohibits the abuse of a dominant position within the internal market or a substantial part of it.

An abuse may exist in particular where a market-dominant undertaking uses its position to exclude a business partner or competitor from access to a platform essential for its economic activity without objective justification.

5. Choice of Law in Favor of Ireland Does Not Exclude German Competition Law

Meta offers its European services through an Irish company. The terms of service stipulate the application of Irish law and a place of jurisdiction in Ireland. However, this does not preclude the enforcement of German or European competition law before German courts.

For non-contractual obligations arising from anticompetitive conduct, the law of the state in whose territory the restriction of competition takes effect, or is likely to take effect, is, in principle, applicable.

If an account suspension on the German market affects the economic activity of an undertaking operating in Germany, this may support the application of German competition law. A contractual choice of law in favor of Irish law cannot readily override mandatory German or European competition law.

6. The DSA: Requirements for Justifying a Suspension

The Digital Services Act (DSA) also sets limits on platform power. Hosting service providers must provide affected users with a clear and specific statement of reasons for certain restrictions. This includes, in particular, the suspension or closure of a user account.

A generic notification such as

“Your account violates our Community Standards.”

may therefore be insufficient if it is not apparent which specific information or conduct triggered the measure.

The statement of reasons should enable the affected party to understand the decision and, where applicable, to effectively challenge it.

7. Claim for Reactivation

If an account suspension proves to be an unfair hindrance in violation of competition law, claims under § 33 GWB may arise.

This provision grants, in the event of a competition law violation, in particular a claim for the removal of the impairment as well as, where there is a risk of repetition, an injunctive relief claim.

Accordingly, in individual cases, the restoration of account access may also be demanded.

Conclusion

An account suspension by Meta is not to be assessed solely based on whether the terms of service generally permit a suspension.

In the case of professionally used accounts, several regulatory levels interact:

Contract law determines the rights and obligations between the platform and the user.

The DSA establishes binding requirements for content moderation decisions, particularly regarding their justification and the available complaint mechanisms.

Competition law limits the exercise of platform power where it turns into an abusive hindrance of economically dependent market participants.

The stronger the economic dependence on a platform, the less an account suspension can be viewed as a purely autonomous private decision. Where market dominance or relative market power, unfair hindrance, and a lack of objective justification are established, claims for remediation and injunctive relief under competition law may be available in addition to the requirements of the DSA.

President Ursula von der Leyen and Commissioner Andrius Kubilius announced a proposed EUR 131 billion combined defence, security and space envelope for 2028–2034, described in public materials as five times current EU-level funding, alongside an accelerated IRIS² constellation and a European Space Shield.

For clients in aerospace, defence and space, that change has immediate practical consequences. Secure connectivity, resilient positioning, navigation and timing, Earth observation, space protection and launch autonomy are moving to the centre of European procurement.

1 What happened in Paris

In her keynote, President von der Leyen said that space is “increasingly central to security.” She pointed to Russia's war against Ukraine as evidence that events in orbit shape the battlefield on the ground. The global space economy is expected to almost triple by 2035, from approximately USD 630 billion today to around USD 1.8 trillion. Europe, she said, must “act together, invest at scale, and turn its market into a competitive advantage.”

Commissioner Andrius Kubilius said that “It is impossible to defend Europe without space.” He identified radiofrequency interference, jamming and spoofing, suspicious proximity operations, anti-satellite weapons, missiles, robots and lasers as threats to European and national assets. He also thanked the French and German governments for putting “space for defence and defence of space” on the same agenda.

2 Budget and Funding Vehicles

The European Commission's proposed 2028–2034 Multiannual Financial Framework, published on 16 July 2025, would allocate approximately EUR 131 billion through the European Competitiveness Fund (ECF) to “defence, security and space”.

No official sub-split between defence and space has been published, and the proposal does not identify a clear space-only allocation. However, the Commissioner called for attribution of 50% of this to Space assets and did call for a substantial, approximately fivefold increase in space spending.

By comparison, the current EU Space Programme for 2021–2027 totals EUR 14.88 billion at current prices, comprising EUR 9.02 billion for Galileo/EGNOS, EUR 5.42 billion for Copernicus and EUR 0.44 billion for Space Situational Awareness and GOVSATCOM.

Other disclosed vehicles and commitments reinforce the picture. IRIS² currently has EUR 2.4 billion in EU budget support, while the Cassini Investment Facility is expected to mobilise EUR 2 billion in risk capital for European space companies. The Scaleup Europe Fund would make EUR 5 billion available for strategic technologies, including space.

3 What Europe is buying

IRIS² is being accelerated to more than 350 satellites, with first launches from 2029, backed by EUR 2.4 billion in EU budget support and additional Member State commitments.

Its secure-communications mission, together with GOVSATCOM and planned Ukrainian participation, would support a more pooled and interoperable capability across Member States.

The wider priorities emerge from disclosed programme budgets, announced scale and repeated strategic emphasis:

• Galileo/EGNOS accounts for EUR 9.02 billion of the current EU Space Programme, making resilient positioning, navigation and timing (PNT) the largest disclosed capability area.
• The emphasis on encrypted Galileo services and a new LEO component indicates continued investment in resilient PNT and Galileo PRS integration.
• Earth observation is also prominent. Copernicus represents EUR 5.42 billion, while the planned Earth Observation Governmental Service would provide near-real-time, all-weather, day-and-night geo-intelligence for Member States.
• To counter interference and other threats in orbit, the Commission plans stronger SST and radiofrequency-interference alerts.
• The European Space Shield would connect the EU, Member States, NATO, and civilian, military, public and private actors through an integrated governance and protection architecture, with proposed capabilities including space-based early warning, anti-jamming and anti-spoofing resilience, and satellite protection.

Ariane 6, Vega-C and Germany's emerging commercial launch sector provide the current base for launch autonomy and space transportation. The summit's emphasis on sovereign access to orbit supports continued investment in launch infrastructure, vehicles and related services. In practice, in-space services and operations, cyber and electronic-warfare interfaces, protected ground infrastructure and military mobility sit alongside these priorities.

4 Implications for industry / What to expect

From 2028 onwards, the ECF's approximately EUR 131 billion defence, security and space window will sit alongside SAFE, which totals EUR 150 billion and is fully subscribed by 19 Member States, and a proposed tenfold increase in military mobility to EUR 17.65 billion. Together with the Cassini and Scaleup Europe facilities, the package is likely to push procurement towards more centralised and interoperable models, with practical consequences for tender design, consortium structures and supply-chain requirements across Europe.

From 2028, the ECF would consolidate 14 existing programmes, including the European Defence Fund, the European Space Programme, IRIS², Digital Europe and InvestEU, and would deploy grants, loans, equity, quasi-equity, blending, procurement and guarantees, including support for SMEs.

In practice, procurement will favour pan-European consortia, mandatory interoperability with EU systems such as IRIS² and structured participation by SMEs.

Large institutional tenders will be contested by Tier 1 primes and launch providers, including Airbus Defence and Space, Thales Alenia Space, OHB and ISAR Aerospace.

Tier 2 suppliers and deep-tech firms, by contrast, can enter through subcontracting routes designed to channel defined contract value to SMEs and new entrants.

Near-term demand is likely to centre on secure satellite connectivity, encrypted PNT receivers and Galileo PRS integration into military command-and-control, as well as next-generation SAR and multispectral Earth-observation payloads. It will also extend to AI-driven orbital-tracking and SSA platforms, optical laser cross-links, cyber-resilient ground infrastructure and radiation-hardened semiconductors.

For German market participants, practical priorities are to align technology stacks with common EU architectures, audit export-control and dual-use compliance, and assess cross-border partnerships, M&A and procurement readiness. This includes alliances combining manufacturing capacity with software, cyber-security and start-up ecosystems.

For companies, the practical response is to prepare now.

• The 12-year IRIS² concession with the SpaceRISE consortium (SES, Eutelsat and Hispasat) is in implementation, and its industrial team includes Airbus Defence and Space, Thales Alenia Space, OHB, Aerospacelab and others. The subcontracting chain is intended to channel defined contract value to SMEs and new entrants.
• EDF and EDIP calls, SAFE joint procurement, Horizon Europe's EUR 175 billion budget and the EIC open routes into procurement and financing.
• The EUR 2 billion Cassini facility and the EUR 5 billion Scaleup Europe Fund add further financing options.
• EDF's 2026 work programme commits EUR 1 billion across 10 calls covering 31 topics, including a dedicated EUR 50 million Galileo PRS topic. The 2027 cycle is expected to be the last under the current MFF before the ECF takes over in 2028.

How HEUKING can assist

• EU and German Space Policies
• EU and German public procurement – Procurement strategy, tender procedures, consortia and SME-friendly routes.
• EU funding access – EDF, ECF, IRIS², Horizon Europe/EIC, SAFE, InvestEU and cohesion instruments.
• Consortia, JVs and industrial cooperation – Teaming, IP, data-sharing and modular-architecture arrangements.
• Foreign investment control and security approvals – FDI screening, reliability checks, clearances and classified programmes.
• Export controls and sanctions – EU dual-use, German export law, allied regimes and cross-border compliance.
• Space and dual-use commercialisation – IRIS², Galileo PRS-adjacent uses, Earth-observation data, licensing and spectrum.

I. Supervision of AI Services Under the DSA and the AI Act

At the center of recent developments is the increasing supervision of AI and platform services under already applicable law, as evidenced by a designation decision under the Digital Services Act (DSA) and the first enforcement measures taken by the AI Office under the AI Act.

On 31 August 2026, the Commission designated ChatGPT as a Very Large Online Search Engine (VLOSE) and Reddit and Roblox as Very Large Online Platforms (VLOP) within the meaning of the DSA. All three services had declared that they reach at least 45 million average monthly users in the EU, thereby exceeding the threshold for such designation. The designation of ChatGPT is of particular significance, as it extends a legal framework originally tailored to social networks, search engines, and marketplaces for the first time to a general-purpose AI assistant. For other AI services with comparable functionality and reach, the decision could set a precedent.

The designation means that the affected services must comply with the additional obligations for particularly large services within four months, in particular the annual assessment and mitigation of systemic risks, independent audits, and data access for research purposes. Indirectly, all companies that have integrated ChatGPT or comparable services into their own business processes may be affected by this decision – for example, in customer communications or content creation – since the adjustments required for compliance may impact response generation, search functionality, or data processing. This applies particularly to providers that integrate such services into their own products via application programming interfaces (APIs). It is therefore advisable to inventory the use of such services, including API integrations, and to review contracts with AI providers with regard to provisions on regulatory changes, liability, and data access.

In parallel, enforcement of the AI Act vis-à-vis model providers has commenced. In early September 2026, the AI Office announced that it had sent initial requests for information to more than 30 AI model providers, following the entry into force of enforcement powers with respect to providers of general-purpose AI models (GPAI) on 2 August 2026. According to the Commission, the requests concern both safety issues relating to the most advanced models and questions of copyright and transparency. Since the AI Office may impose fines for inaccurate or incomplete responses, even the answering of these requests carries considerable significance. For companies deploying AI systems, the transparency obligations under Article 50 of the AI Act have also been applicable since 2 August 2026, requiring disclosure of interaction with an AI system and machine-readable labeling of synthetic content. For legacy systems, a transitional period applies until 2 December 2026.

These measures fit into a broader debate on protection against problematic design practices, in the context of which the Commission has already addressed the potentially addictive design of certain platforms as well as issues of youth protection and age verification. A proposal for a Digital Fairness Act (DFA) is also expected for the fourth quarter of 2026, which would further develop digital consumer protection, for example with regard to manipulative user interfaces (so-called dark patterns) and the protection of minors. Whether there is a need for such legislation is disputed, as critics argue that the gaps to be closed by the DFA are narrowing as DSA enforcement progresses.

II. Simplification and Consolidation of Data Law

In addition to the supervision of existing services, the Commission is advancing several initiatives to simplify and consolidate data law. The basis is the "Digital Omnibus" presented in November 2025, which aims to consolidate key digital legislation and make it more practical. The part of this package relating to the AI Regulation (AI Omnibus) already entered into force on 27 July 2026 (as reported in Data Protection Update No. 256). The focus for the coming months is therefore on the so-called Data Omnibus, which aims at simplifying data law including the General Data Protection Regulation (GDPR) and is still at an early procedural stage.

In terms of substance, the Data Omnibus proposal envisages, in particular, establishing the Data Act as the central legal framework in data law and integrating adjacent regulatory frameworks such as the Data Governance Act and the Open Data provisions into it. Targeted amendments are planned for the GDPR, including a clarification of the concept of special categories of personal data, an explicit legal basis for training AI systems based on legitimate interests subject to technical safeguards, and simplified information and notification obligations for smaller enterprises (as reported in Data Protection Update No. 223). As a complementary measure, a central European notification portal is intended to consolidate multiple notifications under the GDPR, NIS-2, DORA, and the Cyber Resilience Act (CRA). The initiatives are not designed as a substantive reduction of the level of protection but rather as a structural simplification; for companies, the practical benefit lies primarily in more uniform terminology, less regulatory overlap, and clearer allocation of responsibilities.

Procedurally, the Data Omnibus has not yet entered into final negotiations. In the European Parliament, the amendments tabled by Members have been available since mid-July 2026 and are expected to be incorporated into the Commission’s proposal by February 2027.

Criticism of the Data Omnibus comes particularly from the data protection sector. The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) had already expressed reservations about individual proposals at the beginning of the process and warned against a reduction of the data protection level, specifically with regard to interventions in core concepts such as personal data and pseudonymization. Further adjustments are therefore to be expected in the ongoing proceedings. Regardless of the outcome, the already applicable obligations under the Data Act, whose key provisions have been directly applicable since 12 September 2025, remain binding for the affected companies.

III. Digital Sovereignty and Cloud

A further focal point of EU digital policy is the strengthening of digital sovereignty, particularly in the cloud sector. The central initiative is the proposal for a Cloud and AI Development Act (CADA), presented by the Commission on 3 June 2026, which forms part of a broader sovereignty package. The aim of the initiative is to expand cloud and AI infrastructure in the EU and to reduce dependencies on third-country providers, especially in critical areas. The core element of the draft is a tiered system of so-called sovereignty levels (Union assurance levels) that links security, resilience, and sovereignty requirements to the permissibility of use in the public sector.

The legislative process for the CADA is still at an early stage. The proposal is currently being deliberated in the Council and the European Parliament, with divergent views already emerging – particularly on how strictly the concept of sovereignty should be interpreted and whether large non-European providers (hyperscalers) should be excluded. The Commission is also collecting feedback on the initiative until the end of October 2026, meaning that substantive adjustments in the further proceedings are to be expected.

As a complementary measure, the Commission has announced a reform of European procurement law, with stronger legal anchoring of sovereignty criteria; a corresponding proposal for a Public Procurement Act is expected to be presented in September 2026. Also assigned to the sovereignty objective is the Chips Act 2.0, presented in early June 2026, which aims to strengthen domestic chip production.

In parallel with these legislative initiatives, a first-time application of the Digital Markets Act (DMA) to cloud services is taking shape. On 25 June 2026, the Commission preliminarily determined that Amazon Web Services (AWS) and Microsoft Azure, as the two largest cloud services in the EU, should be designated as gatekeepers within the meaning of the DMA. Notably, the Commission did not base this preliminary finding on the quantitative thresholds of the DMA, which both services do not meet, but rather on a qualitative overall assessment, according to which both services constitute an important gateway between businesses and their customers in the EU. A final decision is expected by the end of 2026. Should it confirm the preliminary assessment, AWS and Azure would be the first cloud services subject to the obligations of the DMA and would have to comply, within a transitional period, with requirements regarding interoperability and facilitating provider switching, among others. For companies using the cloud services of these providers, this could indirectly lead to greater ease in switching providers and in interconnecting various services.

IV. Conclusion and Outlook

The developments outlined above demonstrate that EU digital policy is currently moving on two levels simultaneously. On one level, the application of already existing law is gaining clearer contours, as evidenced by the designation of ChatGPT, Reddit, and Roblox under the DSA, the first requests for information by the AI Office, and the emerging extension of the DMA to cloud services. On the other level, several legislative procedures remain pending with the Data Omnibus and the sovereignty initiatives in the cloud sector, the outcome and timeline of which are still uncertain.

For companies, this means that the practically relevant requirements are increasingly arising not solely from future legislation but from the enforcement of the existing legal framework. Anyone deploying AI or cloud services, or integrating them into their own products, should therefore continuously monitor the developments described above – in particular the implementation of the expanded DSA obligations by the affected providers, the applicability of the transparency obligations under Article 50 of the AI Act, and a potential designation of AWS and Azure as gatekeepers. Immediate action is also triggered by two key dates in September 2026: the notification obligations under Article 14 of the Cyber Resilience Act, effective as of today (11 September 2026) (further information available here), and the access-by-design obligation under Article 3(1) of the Data Act for newly placed connected products, effective from tomorrow (12 September 2026) (further information available here). At the same time, it is advisable to follow the deliberations on the Data Omnibus, as the amendments to the GDPR and data law envisaged therein may have direct medium-term implications for compliance structures and data use.

This article was created in collaboration with our student employee Emily Bernklau.

Internal compliance investigations are a standard instrument in corporate practice to investigate breaches of employment contract obligations. When personnel measures are initiated on the basis of such proceedings, the question regularly arises as to the extent to which the affected individual may demand access to the investigation results. In its judgment of 16 April 2026 (8 AZR 169/25), the Federal Labour Court (Bundesarbeitsgericht – BAG) ruled for the first time on the entitlement to a copy of a compliance investigation final report under Article 15 GDPR, thereby clarifying the limits of the data protection right of access in the context of internal investigations.

Facts of the Case

The plaintiff was employed as a senior executive by the defendant. In early April 2023, the defendant’s ombudswoman informed the compliance department of complaints from three whistleblowers, who independently described the plaintiff’s management style as intimidating, demeaning, disrespectful, and dishonest. The defendant thereupon commissioned a law firm to conduct a compliance investigation, which was carried out from 25 August 2023 to 11 January 2024. Two versions of the final report exist: a preliminary version dated 31 January 2024 containing supplementary legal analyses and client advisories, and a final version dated 6 February 2024 without these components. Both versions contain, in identical substance, a structured summary of the investigation findings as well as the commissioned firm’s assessments of witness statements by named whistleblowers and witnesses.

The plaintiff had been on parental leave since 21 July 2023. On 20 February 2024, the defendant applied to the Trade Supervisory Authority (Gewerbeaufsichtsamt) for approval of a dismissal during parental leave, relying on the results of the compliance investigation. The Trade Supervisory Authority did not approve the dismissal. The plaintiff sought the production of complete copies of the compliance reports in order to be able to verify what statements had been made and stored about her and whether they were accurate.

Decision

The Munich Labour Court (Arbeitsgericht München) granted the claim. On the defendant’s appeal, the Munich Higher Labour Court (LAG München) dismissed the requests for the provision of copies of the compliance reports, but ordered the defendant to grant the plaintiff inspection of the compliance final report. The BAG dismissed the plaintiff’s appeal on points of law (Revision). The decision addresses two central aspects:

No Entitlement to a Complete Copy Under Article 15(1) in Conjunction with Article 15(3) GDPR

The BAG clarified that Article 15(3), first sentence, GDPR does not confer an independent entitlement to the provision of a document as such, but only to the personal data contained therein. While the compliance report did contain personal data of the plaintiff – the concept being understood broadly and encompassing subjective information such as opinions and assessments regarding management behaviour – the report did not contain exclusively personal data: in particular, the legal analyses and client advisories contained solely in the preliminary version of 31 January 2024 did not constitute personal data. A copy of entire documents would only permissable where this is “indispensable” for the effective exercise of GDPR rights, for instance where contextualization of the data is necessary for their comprehensibility. In the case at hand, the BAG denied this requirement: the plaintiff did not need knowledge of the legal analyses in order to exercise her rights to rectification, erasure, or restriction of processing under Articles 16–18 GDPR.

No Entitlement to a Complete Copy Under the Right to Inspect the Personnel File

The BAG also denied an entitlement to make a complete copy of the compliance final report from the perspective of the plaintiff’s right to inspect her personnel file (Section 26(2) of the Senior Staff Committee Act (Sprecherausschussgesetz – SprAuG) and Section 83(1) of the Works Constitution Act (Betriebsverfassungsgesetz – BetrVG)). While the right of inspection in principle encompasses the right to make copies from the personnel file at one’s own expense, it is limited to a reasonable scope. This right does not extend to a complete copy of the entire personnel records. Additionally, the BAG expressed doubt as to whether the legal analyses and client advisories contained in the version of 31 January 2024 can be regarded as part of the substantive personnel file at all.

Practical Guidance

The BAG’s decision clarifies the scope of the data protection right of access in the context of internal compliance investigations and has immediate practical implications for employers.

Employers should, already at the time of commissioning a compliance investigation, ensure that the factual report and interview documentation are kept separate – both organisationally and in documentary form – from the legal assessment and client advisories.

In addition, versions capable of anonymisation and reliable redaction protocols should be prepared at an early stage. The Munich Higher Labour Court has clarified that a failure to anonymize does not justify a blanket denial of access.

Before promising absolute confidentiality to whistleblowers and witnesses, employers must consider the legal limits of the right of inspection.

The use of investigation results for personnel measures – as in this case, the application for approval of a dismissal – increases the likelihood that investigation documents will be classified as part of the substantive personnel file. This applies irrespective of the formal filing location or the engagement of an external law firm. Employers should not assume that the preparation by legal counsel or the mere designation as a trade secret will categorically exclude the report from the right of inspection.

Employers are well advised to consider, already at the planning and documentation stage of internal investigations, the subsequent management of data access and personnel file inspection requests.

In its judgment of April 16, 2026 (Case No. 6 SLa 574/25), the Higher Labour Court of Cologne (Landesarbeitsgericht Köln) held that the dismissals and the rescission of the employment relationship of a severely disabled employee by the employer were invalid, as there was no duty to disclose the severe disability at the time the contract was concluded and the required approval of the Integration Office (Integrationsamt) for the dismissals had not been obtained.

A. Facts of the Case

The plaintiff, who held a degree of disability (Grad der Behinderung, GdB) of 60 and was thus classified as severely disabled, had been employed as a cleaning worker at the defendant’s law firm since September 1, 2021. The employment relationship ended no later than with the plaintiff’s own resignation of January 15, 2024, effective February 29, 2024.

Prior to this resignation, the defendant issued a total of four dismissals to the plaintiff:

• an ordinary dismissal dated September 8, 2023,
• an extraordinary dismissal without notice dated September 27, 2023,
• a dismissal dated November 2, 2023, and
• a dismissal dated November 20, 2023.

None of these dismissals had been approved by the Integration Office (Integrationsamt). At the time of the first dismissal, the defendant was not yet aware of the plaintiff’s severe disability, but the plaintiff informed him of it within three weeks. However, the defendant was already aware of the plaintiff’s cancer diagnosis, which had been his reason for terminating the employment relationship.

In addition, on December 1, 2023, the defendant declared the rescission of the employment contract on the grounds of fraudulent misrepresentation (arglistige Täuschung), contending that the plaintiff had been obligated to disclose her severe disability to him at the time the contract was concluded. However, according to the defendant’s own submissions, he had not asked the plaintiff any corresponding question about a severe disability during the conclusion of the contract.

The plaintiff filed an action with the Labour Court of Aachen (Arbeitsgericht Aachen) on September 21, 2023, challenging all of the dismissals and additionally claiming payment of vacation pay, continued remuneration during illness, default wages, and the issuance of a work reference.

The Labour Court of Aachen largely granted the claim in its judgment of July 11, 2025 (Case No. 4 Ca 2741/23). The defendant filed an appeal.

B. Reasoning of the Higher Labour Court of Cologne

The Higher Labour Court of Cologne dismissed the defendant’s appeal.

1. Invalidity of the Dismissals Pursuant to § 168 SGB IX in Conjunction with § 134 BGB

The Higher Labour Court of Cologne upheld the first-instance decision and found that all four dismissals were invalid pursuant to § 168 SGB IX in conjunction with § 134 BGB due to the absence of approval from the Integration Office. With respect to the ordinary dismissal of September 8, 2023, the court noted that although the defendant was not yet aware of the plaintiff’s severe disability at the time this dismissal was issued, the plaintiff had informed him of it within three weeks. For the dismissals of September 27, 2023, November 2, 2023, and November 20, 2023, the defendant already had knowledge of the severe disability, yet no approval decisions from the Integration Office had been obtained for any of these dismissals.

The Higher Labour Court further clarified that the consent requirement under § 168 SGB IX applies irrespective of whether the employer was aware of the employee’s severe disability at the time of the dismissal.

2. No Ground for Rescission Due to Absence of a Duty to Disclose

The Higher Labour Court of Cologne held that the defendant’s declaration of rescission dated December 1, 2023, was without effect, as there was no ground for rescission within the meaning of § 123 BGB.

The court clarified that, until 1995, a severely disabled person was still obligated to truthfully answer questions regarding a severe disability (cf. Federal Labour Court (BAG), Judgment of October 5, 1995 – 2 AZR 923/94). However, at the latest since the entry into force of § 81 (2) SGB IX (now § 164 (2) SGB IX) in 2001 and the entry into force of §§ 1, 7 AGG (General Equal Treatment Act) in 2006, no duty to disclose the status of severe disability exists any longer. Since then, an employee is permitted to give an untruthful answer to a question about a severe disability; such a permissible lie therefore cannot constitute a ground for rescission.

The court further emphasized that, in the present case, it was not even necessary to reach the question of the plaintiff’s right to lie regarding her severe disability, because, according to the defendant’s own submissions, he had not even asked the plaintiff a corresponding question during the conclusion of the contract. Without a question having been posed beforehand, no duty to disclose arises from any legal perspective.

Leave to appeal to the Federal Labour Court was not granted, as the decision was based on the circumstances of this particular case.

C. Practical Guidance

For employment law practice, it should be noted that employers must obtain the approval of the Integration Office pursuant to § 168 SGB IX before every dismissal of a severely disabled employee – irrespective of whether the employer was aware of the severe disability at the time the dismissal was issued. If the severe disability is disclosed by the employee within three weeks of receipt of the dismissal, the special protection against dismissal (Sonderkündigungsschutz) applies retroactively. Employers should therefore, in case of doubt, always ascertain whether the employee may hold severely disabled status and, as a precaution, apply for approval. Where the special protection against dismissal applies retroactively because the employee disclosed the severe disability within three weeks of receipt of the dismissal, the employer’s only recourse in most cases is to apply for approval from the Integration Office and, once approval has been granted, to issue a new dismissal. This is because a dismissal issued without prior approval from the Integration Office is irremediably invalid.

Asking about a severe disability during a job interview is impermissible and may therefore be answered untruthfully by employees without this constituting a ground for rescission of the concluded employment contract under § 123 BGB. Employers should therefore generally refrain from asking about a severe disability during the hiring process. Even without such a question, there is no independent duty of disclosure on the part of the applicant, as is rightly inferred from § 164 (2) SGB IX and §§ 1, 7 AGG.

Rescission on the grounds of fraudulent misrepresentation pursuant to § 123 BGB is therefore precluded where a severe disability has been concealed, as, in the absence of a duty to disclose, there is no unlawful act of deception on the part of the employee. Accordingly, employers cannot rely on the argument that they would not have entered into the contract had they known of the severe disability.

The works council election is a central instrument of workplace co-determination. The election committee is tasked with properly preparing and conducting the election – including determining the size of the works council to be elected. But what happens when the election committee deliberately and without any factual basis inflates the number of regularly employed workers far beyond the actual figure in order to create an oversized body? In a recent decision, the Lower Saxony Regional Labor Court (Landesarbeitsgericht, LAG) made clear: such an election is not merely voidable – it is null and void and must be terminated.

Facts of the Case

Two companies jointly operate a staffing services business as a joint establishment (Gemeinschaftsbetrieb) with approximately 357 employees across Germany. Due to the economically difficult situation at their principal client, a major automotive group, extensive workforce reductions had already been carried out in early 2025, which were agreed upon and implemented under a reconciliation of interests (Interessenausgleich).

The works council, whose term of office was due to expire on May 31, 2026, appointed an election committee for the works council elections. The election committee initially adopted an election notice providing for a nine-member works council. However, this notice was never posted. On the day following this internal resolution, a minority faction of the election committee – without any further resolution or coordination with the remaining members – published an election notice providing for the election of 17 works council members.

The minority faction of the election committee relied on an outdated "key issues paper" (Eckpunktepapier) on staffing plans, according to which at least 1,545 eligible employees were regularly employed in the establishment. In reality, all works council and election committee members involved were fully aware of the current staffing plans and the preceding workforce reductions.

Particularly noteworthy: Three members of the election committee stated in an open letter to the entire core workforce that the assumption of 17 seats was "indefensible" and that no concrete assignments or plans existed that could justify such a number.

The employers thereupon applied for interim injunctive relief (einstweiliger Rechtsschutz) seeking termination of the election. The labor court initially dismissed the applications. While it found that a violation of Section 9 of the German Works Constitution Act (Betriebsverfassungsgesetz, BetrVG) had occurred, it did not consider the violation sufficiently obvious to establish the nullity of the election. The employers appealed this decision to the LAG Niedersachsen.

Decision

The appeal was successful. The LAG did not share the labor court’s assessment: it upheld the appeal and ordered the termination of the works council election.

The court affirmed the established case law that the nullity of a works council election can be assumed only in exceptional circumstances. A particularly gross and obvious violation of fundamental principles of electoral law must be present, such that not even the appearance of an election conforming to the law remains.

In the present case, the court concluded that the erroneous assumption of 17 works council members to be elected was made intentionally. The forecast of "at least 1,545 employees" lacked any factual basis whatsoever. Only approximately 360 employees were actually working in the establishment, and no expansion was foreseeable. The underlying key issues paper was substantively outdated, a fact known to the election committee.

The LAG inferred from the overall circumstances of the case that a faction of the election committee had deliberately relied on the outdated staffing plan in order to establish a larger works council pending a potential new election. The works council and election committee had knowingly accepted the voidability of the election and sought to rely on the "normative force of the factual" (die normative Kraft des Faktischen), thereby installing a significantly excessive number of employees in works council positions.

Such conduct constitutes an abusive exercise of a formal legal position in violation of the principle of trustful cooperation (Section 2(1) BetrVG) and need not be tolerated by the employer. The principle of trustful cooperation sets the standard for how the parties to the establishment must exercise their mutual rights and obligations. They must also take into account the interests of the other party. Ultimately, this concerns the application of the principles of good faith (Treu und Glauben) within the framework of the works constitution. This duty expressly applies to the election committee as well.

Practical Guidance

The termination of a works council election is ordered only in rare cases. However, the present decision demonstrates that, particularly in cases of serious breaches of duty by the works council or the election committee, it can certainly be worthwhile to seek interim injunctive relief. The decision of the Lower Saxony Higher Labor Court (LAG Niedersachsen) provides interesting guidance on when and under what circumstances violations of statutory election rules carry such weight that the termination of a works council election can be successfully petitioned for.

General Counsel, holders of Prokura (commercial power of attorney), and senior executives at the highest level are often quickly treated in practice as managerial employees (leitende Angestellte). The Essen Labor Court demonstrates that it is not titles, hierarchy, or Prokura that are decisive, but rather the actual authority and the specific scope of duties. For dismissal practice, this decision is therefore relevant far beyond the individual case.

Facts

The plaintiff had been employed by an international chemical corporation since 2010. Since 2021, he had been positioned as “General Counsel” at “Level 1,” directly below the management board. He held a general Prokura and headed the legal department. In Germany, however, only eight employees were assigned to him.

In December 2025, the employer terminated the employment relationship for operational reasons – without first consulting the works council. The employer considered the plaintiff to be a senior executive (leitender Angestellter) within the meaning of § 5(3) of the BetrVG (Works Constitution Act) due to his prominent position, his Prokura, and his purported authority over personnel and decision-making. In support of the dismissal, the employer further cited a planned merger of the Legal and Compliance departments.

The plaintiff filed an unfair dismissal claim and demanded continued employment. The employer alternatively requested that the employment relationship be dissolved in exchange for severance pay pursuant to § 14(2) sentence 2 of the KSchG (Dismissal Protection Act).

Decision

The Essen Labor Court granted the unfair dismissal claim. Despite the general Prokura and the classification at “Level 1,” the plaintiff was not a senior executive within the meaning of § 5(3) BetrVG. Ultimately, the court rejected all three statutory criteria.

1. Authority to Hire and Dismiss

Under § 5(3) sentence 2 no. 1 BetrVG, what matters is an independent authority to hire and dismiss. Here, the plaintiff’s personnel responsibility in Germany extended to only eight employees – a subordinate group of individuals relative to the total headcount. In addition, the employees reporting to the plaintiff (predominantly in-house counsel) were highly qualified but did not have broad entrepreneurial decision-making authority. Moreover, at least since 2024, the plaintiff was required to obtain approval from the management board or the CFO for all hiring and dismissal decisions. In the court’s view, this was not merely a budgetary control mechanism. An independent authority therefore did not exist.

2. Prokura (Commercial Power of Attorney)

Under § 5(3) sentence 2 no. 2 BetrVG, Prokura alone is not sufficient. What is decisive is not the formal power of representation in external dealings, but rather the entrepreneurial tasks associated with the Prokura. The plaintiff, however, performed “only” a staff function without revenue responsibility. His work was primarily advisory and distinctly not decision-making in nature. He therefore did not perform entrepreneurial management tasks; the Prokura was not of sufficient significance in relation to the employer.

3. Outstanding Position

Under § 5(3) sentence 2 no. 3 BetrVG, the functional title is likewise not determinative; what matters is the specific scope of duties and the actual decision-making authority. The legal department did not generate revenue and was not a core business area of the chemical corporation. The plaintiff advised the management board but did not have decision-making authority; his recommendations were not binding. Participation of entrepreneurial relevance therefore did not constitute the focus of his activity. Accordingly, the Labor Court also held that the catch-all criterion was not met.

In the absence of senior executive status, consultation of the works council would have been required, meaning the dismissal was already invalid pursuant to § 102(1) sentence 3 BetrVG. Consequently, the dissolution request was not only inadmissible but also unfounded.

Practical Tip

The Essen Labor Court examines the requirements of § 5(3) BetrVG in a virtually textbook manner, thereby illustrating the high threshold for classification as a senior executive (leitender Angestellter). The 3rd Chamber closely follows the purpose and spirit of the provision. The status is intended to apply only to those who genuinely stand in a conflict of interest with the works council and who, as a representative of the employer, independently make entrepreneurial (personnel) decisions. In practice, however, the classification is often made hastily – a high hierarchical level, the granting of Prokura, or an impressive title tempt one to assume the status without scrutinizing the actual authority in the internal relationship. In case of doubt, the works council should always be consulted as a precautionary measure. Otherwise, the dismissal risks being invalid under § 102(1) sentence 3 BetrVG.

This article summarises the proposed amendments, provides an initial assessment and discusses the extent to which companies may need to take action.

The Code

The Code was adopted in 2002 by a commission established by the Federal Government. In addition to a description of the statutory requirements for the governance of German listed companies, referred to as principles, it contains recommendations and suggestions for good and responsible governance. The Management Board and the Supervisory Board must declare annually whether they comply with the Code’s recommendations. To the extent they do not follow them, they must state why they do not do so. This so-called Declaration of Compliance must be published on the company’s website. Deviations from suggestions need neither be disclosed nor explained.

The obligation to issue a Declaration of Compliance applies to companies whose shares are admitted to trading on an organised market (such as the regulated market of a German stock exchange), as well as to companies that have issued securities other than shares for trading on an organised market and whose shares are, at their instigation, traded on a multilateral trading system (such as the open market (Freiverkehr) of a German stock exchange). Compliance with certain recommendations of the Code is also a prerequisite for the company’s shares to be included in a DAX selection index.

Since its introduction, the Code has been amended several times. In particular, it was supplemented with more detailed provisions on remuneration rules as well as on aspects of sustainability, corporate responsibility and the consideration of social and environmental factors. Changes to statutory requirements have also resulted in recommendations and suggestions of the Code being superseded by new statutory provisions.

The Proposed Amendments

The revision of the Code is intended to achieve a clearer and more principles-based structure. Accordingly, unlike in previous amendments, the focus is on deletions and simplifications. Of the 66 recommendations and suggestions in the Code, 13 are to be deleted in whole or in part, five are to be simplified or consolidated, and two recommendations are to be converted into suggestions. Recommendations that have become statutory obligations are being deleted. Overly rigid requirements are to be dispensed with, without diluting the standards of good corporate governance. The key proposed amendments are outlined below:

• The suggestion that the Management Board should convene an Extraordinary General Meeting in the event of a takeover offer, at which the shareholders would discuss the takeover offer and, if applicable, resolve on corporate actions, has been deleted. The suggestion – which was intended only for target companies – has proven generally impractical given the tight time constraints of the German Securities Acquisition and Takeover Act (WpÜG). The practical relevance of such “Defensive General Meetings” has therefore remained limited.

• The previously recommended stipulation of an age limit for Management Board and Supervisory Board members has been downgraded to a suggestion. An age limit for Management Board members is no longer common international practice; for Supervisory Board members, an age limit represents only one of several instruments to achieve an appropriate board composition.

• With regard to the composition of the Supervisory Board, the draft dispenses with the specific emphasis on expertise in sustainability matters in the profile of skills and expertise to be developed by the Supervisory Board. Such expertise is already required under European law. Moreover, a selective highlighting of individual areas of expertise does not appear appropriate.

• In the future, it will no longer be recommended that the rules of procedure of the Supervisory Board be made accessible on the company’s website. This does, however, entail reduced transparency with respect to approval requirements pursuant to Section 111(4) sentence 2 of the German Stock Corporation Act (AktG) that are set out therein.

• The recommendation to establish “professionally qualified” committees of the Supervisory Board is to be dispensed with in the future. In particular, for companies with only three Supervisory Board members, the absence of committees gave rise to a need to provide explanations in the Declaration of Compliance, even though the establishment of committees is clearly not appropriate in such cases.

• The specification of the expertise in the field of accounting already required by law under Section 100(5) AktG and the identification of the members of the Audit Committee together with a description of their expertise have been moved to the explanatory memorandum to the Code; no independent significance is attributed to them beyond the statutory requirements already applicable in this respect.

• The previously recommended disclosure of the format of Supervisory Board meetings (in-person, video or telephone conference) in the report of the Supervisory Board to the General Meeting on its review of the management of the company is to be dispensed with in the future. Virtual and hybrid meeting formats have become common practice and are considered uncontroversial. The internal organisation of the Supervisory Board is to be liberalised in this regard.

• Shorter publication deadlines for annual financial reports (90 days instead of four months) and half-year financial reports (45 days instead of three months) compared to the statutory requirements are no longer to be recommended. While the rules for the DAX selection indices refer to these shorter deadlines, they allow grace periods up to the respective end of the statutory reporting periods.

• The requirements for the remuneration system and remuneration structure are being streamlined and more closely aligned with existing statutory requirements.

• The timing requirements for determining the performance criteria for the variable remuneration of Management Board members are to be relaxed. It was previously recommended that these be determined in the preceding financial year. However, the company’s planning for the current year is often only finalised at the beginning of a new financial year. Accordingly, it is now to be recommended that performance criteria based thereon be determined during the first quarter on the basis of the adopted plan.

• The proportion of the Management Board’s variable remuneration that is to be granted on a share-based basis is being made more flexible. In the future, it will no longer be recommended that, taking into account the tax burden, the variable remuneration be predominantly share-based. Instead, the Code will in the future merely recommend that a substantial portion of the variable Management Board remuneration be granted on a share-based basis; the reference to taxation is being deleted.

• The recommendation that remuneration for intra-group Supervisory Board mandates of Management Board members should, as a matter of principle, be offset, and that Supervisory Board mandates at non-group entities be dealt with at the discretion of the Supervisory Board, is being deleted, as this already corresponds to prevailing practice.

Practical Implications

From a practical perspective, the question arises as to whether and how an amendment to the Code affects existing or future Declarations of Compliance pursuant to Section 161 AktG, and in particular whether an existing declaration needs to be updated in light of the amendments.

The Declaration of Compliance, which must be issued annually, comprises a retrospective part and a forward-looking part: the retrospective part must state whether the recommendations of the Code have been complied with since the most recent full Declaration of Compliance was issued; the forward-looking part declares whether the recommendations will be complied with in the future. The retrospective part covers the period since the last full Declaration of Compliance was issued, while the forward-looking part extends until the next declaration is issued.

For the forward-looking part, the version of the Code in force at the time the declaration is issued is determinative. For the retrospective part, by contrast, the prevailing view in the event of a mid-year amendment to the Code is that the “old” version is determinative, i. e. the version to which the most recent regular Declaration of Compliance referred. Otherwise, the retrospective declaration would have a different reference point than the previous regular declaration, thereby defeating the purpose of the critical self-assessment. Moreover, a false signal would be sent to the capital market if deviations had to be declared for a period in which the corresponding recommendations were not yet regarded as “best practice”. In practice, however, an additional statement on the Code recommendations current at the time of the declaration is frequently included in the declaration.

According to the prevailing view in legal literature and the case law of the Federal Court of Justice (Bundesgerichtshof), an obligation to issue an extraordinary update during the year of an existing Declaration of Compliance should only arise where the declaration was incorrect from the outset or has become incorrect due to a change in the originally declared intentions happening in the course of the current year.

Where the German Corporate Governance Code is amended between two regular declarations, no obligation to update arises by contrast. The determinative reference point for the forward-looking part is the version of the Code in force at the time the declaration is issued; a subsequent amendment does not render the previously issued declaration incorrect. An obligation to update solely on the basis of the Code amendment would, moreover, undermine the statutory declaration cycle under Section 161(1) sentence 1 AktG. Companies that comply with the current Code are not required to amend their Declaration of Compliance solely on account of the revised version before the next regular declaration is due; in individual cases, however, the revised Code may open up additional flexibility.

Summary and Assessment

The revision of the Code proposed by the Government Commission is to be welcomed in principle. The planned streamlining eliminates overlaps with statutory law already in force; moreover, greater flexibility is introduced in a number of areas. The selective emphasis on particular aspects of corporate governance, such as sustainability, is being scaled back in the interest of greater balance and objectivity.

The amendment to the Code does not, however, give rise to an obligation to update the current Declaration of Compliance. Companies that comply with the existing Code are not required to amend their Declaration of Compliance solely on account of the revised version; in individual cases, however, the revised version may open up additional flexibility.

Only in the context of the next regular declaration will the new Code apply to the forward-looking part of the declaration. For the retrospective part, reference must continue to be made to the “old” version. In practice, however, an additional statement on the Code recommendations current at the time of the declaration is frequently included in the declaration.

Further information:

• German Corporate Governance Code and GCGC Consultation 2026

• DAX Equity Index Methodology Guide

I. Background

The control module of a modern machine does far more than simply control operating sequences. Embedded software captures operating parameters, controls processes and records status information, which is transmitted to the manufacturer via a network or platform connection. This makes it possible to identify maintenance needs at an early stage, analyse operating data and offer additional services such as remote diagnostics or predictive maintenance. The resulting body of data is generally heterogeneous and includes machine and sensor data as well as configuration, usage and fault logs.

A considerable proportion of this data is not personal data but describes technical conditions and processes. The exchange of machine-generated data is governed by the Data Act, which grants the user rights of access to and sharing of non-personal product data without thereby conferring ownership of the data or any other inherent rights of use, and permits the manufacturer to use the data itself only on a contractual basis.

The distinction between personal and non-personal data is not, however, entirely clear-cut. Operating, maintaining and configuring a machine often requires the relevant user to log in, for example a member of the operating staff or an external maintenance technician. If access credentials, timestamps or individual operating actions are recorded in a way that allows them to be attributed to an identified or identifiable person, they constitute personal data within the meaning of the General Data Protection Regulation (GDPR). The data in question therefore remain subject to the requirements of data protection law, in particular the need for a valid legal basis under Article 6(1) of the GDPR. In practice, this means that one and the same data stream may have to be assessed differently under different legal regimes, and manufacturers should determine at the design stage which data, with what link to an identified or identifiable person, are processed for what purpose.

II. Data access under the Data Act

The Data Act has applied since 12 September 2025 and is tailored to data generated through the use of connected products and related services. Machine manufacturers will generally fall within its scope because their products continuously generate data during operation. Micro and small businesses with fewer than 50 employees and an annual revenue or total assets of no more than 10 million euros are largely exempt from these obligations.

Since 12 September 2025, users have had a right of access to readily available product data and related service data (as reported in Data Protection Update No. 214). This right applies irrespective of the date of manufacture and therefore also to existing machines, provided that the data holder already holds the relevant data, for example in a manufacturer’s portal or service back end. Users – typically the owners, tenants or lessees of the machine – can already rely on this right to request disclosure of the data generated through its use and to have that data made available to third parties. Users can therefore claim access to data to an extent that goes beyond the contractual arrangements. This is because the statutory right may also cover raw data and metadata and cannot effectively be limited by contractual arrangements to the contrary. Under Article 7(2) of the Data Act, contractual clauses that exclude or restrict the user’s access to the user’s detriment are not binding on the user.

The new requirement taking effect on 12 September 2026 concerns the design of the product itself. Under Article 3(1) of the Data Act, connected products and related services must in future be designed, manufactured and provided so that the data generated through their use are, by default, accessible to the user easily, securely, free of charge and in a comprehensive, structured, commonly used and machine-readable format. Where relevant and technically feasible, access must be possible directly from the product itself. This principle, known as Access by Design, requires the access capability to be built into the product architecture from the outset and generally cannot be implemented retrospectively without considerable effort.

Unlike the right of access that has existed since 2025, the design obligation applies only to connected products and related services placed on the market after 12 September 2026. There is no general obligation to retrofit existing products in this respect. However, because development cycles in mechanical engineering are long, the requirement has practical implications well before that date: products scheduled to be launched after the relevant date must take the access requirements into account during the preceding development phase. The design obligation is supplemented by the pre-contractual information obligations under Article 3(2) and (3) of the Data Act, which require, among other things, information on the nature, scope and format of the data generated and on ownership of trade secrets.

III. Reporting obligations under the CRA

Whereas the Data Act regulates who may access a machine’s data, the Cyber Resilience Act (CRA) focuses on the machine itself and, for the first time across the EU, establishes binding cybersecurity requirements for products with digital elements. Connected machines and their control modules generally fall within its scope because they contain software and have data connections. The obligations are addressed primarily to the manufacturer. For these purposes, that term covers not only the traditional hardware manufacturer but also anyone who markets products under its own brand or provides software.

The CRA does not become applicable at a single point in time but in stages. The Regulation will not become fully applicable until 11 December 2027. At that point, the substantive core requirements will apply, in particular the essential cybersecurity requirements for design and development (Security by Design), vulnerability management throughout a support period to be specified, conformity assessment, technical documentation and CE marking. Only the reporting obligations under Article 14 of the CRA have been brought forward: they already apply from 11 September 2026 and therefore constitute the first binding set of obligations for manufacturers.

Article 14 of the CRA requires the reporting of two types of event: actively exploited vulnerabilities in a product with digital elements and serious security incidents that have an impact on its security. By contrast, a vulnerability that has merely been discovered but not exploited does not trigger a reporting obligation. Reporting takes place in stages: an initial early warning must be submitted within 24 hours after the manufacturer becomes aware of the event, followed by a more detailed report within 72 hours and a final report. In addition, affected users must be informed of the incident and of available remedial measures. The reporting obligation applies not only to new products but also to products already placed on the market, provided that the manufacturer becomes aware of an actively exploited vulnerability after the relevant date.

For machine manufacturers, the real difficulty lies less in the reporting itself than in the conditions required for reporting. Compliance with the short deadlines presupposes that the manufacturer knows the software composition of its products and has channels through which it can learn of an ongoing exploitation in time. This is generally possible only if the manufacturer knows which software and third-party components are contained in each machine and has a process for detecting and internally categorising such incidents. The reporting obligation brought forward to September 2026 therefore has practical knock-on effects on requirements that formally apply only from December 2027, in particular structured vulnerability management and the recording of software components in the form of a software bill of materials (SBOM).

IV. Requirements under the AI Act

Control modules increasingly contain software components based on artificial intelligence, for example for adaptive process control, fault detection or the optimisation of operating processes. If a machine contains such an AI system, the AI Act may apply in addition to the Data Act and the CRA. For mechanical engineering, however, the relevant regulatory route has recently shifted: requirements for safety-related AI in machinery no longer arise from the AI Act’s set of obligations for high-risk AI systems, but from the sector-specific requirements of the Machinery Regulation governing AI-enabled safety components.

That classification is based on the system set out in Article 6(1) of the AI Act. Under that provision, an AI system is high-risk if it is used as a safety component of a product covered by the harmonisation legislation listed in Annex I to the AI Act, or is itself such a product, and the product is subject to third-party conformity assessment. For the machinery sector, this route previously ran through the Machinery Regulation, which was listed in Section A of Annex I to the AI Act. The AI Omnibus – Regulation (EU) 2026/1744 of 8 July 2026 – has, however, removed the entry for the Machinery Regulation from Section A and included it as No. 21 in Section B of Annex I. The amendment entered into force on 27 July 2026. The classification as a high-risk AI system therefore remains in principle. Under the amended Article 2(2) of the AI Act, however, AI systems in products listed in Section B are now subject only to Article 6(1), Article 60a and Articles 102 to 112 of the AI Act. In particular, the requirements of Chapter III and a separate conformity assessment under the AI Act no longer apply.

The requirements for safety-related AI do not therefore disappear; rather, their legal basis changes. Regulation (EU) 2026/1744 requires the Commission to supplement Annex III to the Machinery Regulation by means of delegated acts to include essential health and safety requirements for AI systems that are used as safety components in machinery or themselves constitute machinery, taking into account the requirements of Chapter III, Section 2 and Articles 17, 19, 72 and 73 of the AI Act. These delegated acts are intended to apply from 2 August 2028, thereby ensuring alignment with the date on which the obligations for high-risk AI systems under Annex I to the AI Act begin to apply. The relevant requirements will therefore be the sector-specific requirements of the Machinery Regulation and the newly worded definition of a safety component, which expressly includes software and learning systems. Under Annex I, Part A, Nos 5 and 6 of the Machinery Regulation, this includes in particular safety components with fully or partially self-evolving behaviour based on machine-learning approaches and performing safety functions.

It therefore remains decisive whether the AI system performs a safety function. The AI Omnibus has sharpened this distinction (as reported in Data Protection Update No. 256). Under the clarified definition, a safety function exists only if the AI system’s intended purpose, as specified by the provider, is to avert or mitigate risks to health, safety or property. AI systems whose sole purpose is to assist users, optimise performance, improve service efficiency, automate processes or enhance ease of operation are expressly excluded. An AI module that merely optimises operating processes or processes diagnostic data, without itself performing a safety function, is therefore generally not a safety component and is not subject to the stricter requirements. A careful case-by-case assessment nevertheless remains necessary, because the same function may have to be assessed differently depending on the type of machine and the risk situation.

If, following this assessment, an AI system performs a safety function, the manufacturer is subject to the requirements applicable to AI-enabled safety components. For machinery, these do not arise directly from the obligations imposed on providers of high-risk AI systems – particularly not from the obligation under Article 9 of the AI Act to establish a risk-management system – but from the requirements transposed into the Machinery Regulation by delegated acts. In substance, the familiar requirements remain, namely risk management covering the entire life cycle and requirements relating to data governance, technical documentation, logging, transparency and human oversight. The international standard ISO/IEC 42001 may serve as a practical implementation tool, as it provides a framework for an AI management system and can map the requirements described above in a structured way. A distinction must be made as to timing: the Machinery Regulation already applies from 20 January 2027, from which date machine-learning-based safety components will be subject to conformity assessment by a notified body. The AI-specific requirements of Annex III to the Machinery Regulation, however, are not intended to apply until 2 August 2028, in parallel with the application date – postponed by the AI Omnibus – of the obligations for high-risk AI systems under Annex I to the AI Act.

V. Conclusion and outlook

In autumn 2026, machine manufacturers will face several regulatory instruments whose key dates are close together. From 12 September 2026, the Data Act’s Access by Design principle requires newly placed products to be designed so that the data generated are accessible to the user by default, easily, securely and in a machine-readable format and, where relevant and technically feasible, that access is possible directly from the product itself. The CRA brings the reporting obligations forward to 11 September 2026 and therefore already presupposes structured vulnerability management and knowledge of their own software composition before the remaining requirements apply from December 2027. The requirements for safety-related AI also apply whenever a control module performs a safety function. Since the AI Omnibus, these requirements for machinery are no longer to be met through the AI Act’s set of obligations for high-risk AI systems but through the sector-specific requirements of the Machinery Regulation, whose AI-specific requirements are intended to apply from 2 August 2028.

Despite their different objectives, the requirements often focus on the same areas, namely product architecture, data flows and internal processes. It is therefore advisable to consider these topics together rather than address them in isolation. As the relevant terms and requirements have so far been neither clarified by the courts nor conclusively specified in regulatory guidance, companies should keep a close eye on further developments.

For manufacturers of connected machines, we have developed a tailored Digital Compliance package that brings together the requirements of the Data Act, the CRA and the AI Act in a coordinated approach and provides support from the initial assessment through contract and process design to implementation within the business. Please feel free to contact us.

This article was created in collaboration with our student employee Emily Bernklau.

I. Who is affected?

The Data Act addresses a broad range of actors. Art. 1 Abs. 3 DA names, among others, manufacturers of connected products, providers of related services, users of such products or services, data holders and data recipients, as well as providers of data processing services. Whether and in what capacity a company is affected is not determined in the abstract, but by the specific link to a connected product.

1. The “connected product" as the central point of reference

The personal and material scope of the Data Act stands or falls with the concept of a connected product. Under Art. 2 Nr. 5 DA, this means a tangible object that obtains, generates or collects data concerning its use or environment and can transmit that product data via an electronic communications service, a physical connection or an on-device access point, provided that its main function does not consist in storing, processing or transmitting data on behalf of a third party. As a starting point, this therefore covers virtually any tangible object across all sectors of the economy, from vehicles and medical equipment to household appliances and consumer goods, and extending to agricultural and industrial machinery and equipment. The mobility of the object is irrelevant, meaning that infrastructure and installations may also qualify.

The definition is, however, less clear-cut than it may initially appear. It does not refer to data in general, but to product data, which in turn are defined in Art. 2 Nr. 15 DA by reference to the connected product that is itself to be defined. This circular relationship has a practically significant consequence: a connected product would presumably exist only if the manufacturer has envisaged access to the generated data as part of the product’s design. If the manufacturer designs its product so that data can be stored only locally and cannot be transmitted, no product data exist and the obligations under Art. 3 and 4 DA do not apply in that respect. Whether a product falls within the scope is therefore, to a considerable extent, a matter of how the manufacturer designs the product—an area of freedom that may come into tension with the Access by Design obligation taking effect on 12 September 2026.

2. Manufacturers as the addressees of the obligation under Art. 3 Abs. 1 DA

For the Access by Design obligation added as of 12 September 2026, the group of parties directly subject to the obligation is narrower. Art. 3 Abs. 1 DA is directed at the person who designs and manufactures the connected product or designs and provides the related service, but not at every person who merely distributes such a product. The relevant criterion is placing on the market after the cut-off date, which is why the obligation is limited to new products and does not require products already placed on the market to be retrofitted. It should also be noted that, through Art. 1 Abs. 4 DA, the group of addressees may extend to providers of virtual assistants insofar as those assistants interact with a connected product or related service, which is likely to include, in particular, providers of voice and user interfaces. Finally, it must be borne in mind that the same company may simultaneously assume several roles, for example as manufacturer and data holder, so that the respective obligations overlap.

II. Obligations of the manufacturers concerned

Since 12 September 2025, the user’s right of access under Art. 4 DA has been in force. Accordingly, the data holder must make the readily available product data and related service data accessible to the user and, upon request, also to a third party designated by the user (Art. 5 DA). This right covers the entire existing inventory, including products already placed on the market, insofar as the data holder already has the relevant data. It is supplemented by the pre-contractual information obligations under Art. 3 Abs. 2 and 3 DA, under which the provider must inform the prospective user, before the contract is concluded, about the nature, scope, format and methods for retrieving the generated data.

On 12 September 2026, the Access by Design obligation under Art. 3 Abs. 1 DA will be added. It requires connected products and related services to be designed from the outset so that the product data and related service data are accessible to the user by default, easily, securely, free of charge and in a structured, commonly used and machine-readable format, and, where relevant and technically feasible, directly from the device. The difference from the right of access already in force lies in the point of departure: while Art. 4 DA concerns data that already exist, Art. 3 Abs. 1 DA shifts the requirement to the product-development stage. Unlike the right of access, which concerns existing data holdings, this obligation applies only to products newly placed on the market after the cut-off date and does not require existing products to be retrofitted.

There are also requirements governing the handling of the data made available. Access must in principle be granted free of charge; charges imposed on third parties are subject to the requirement that they be reasonable and non-discriminatory. The protection of trade secrets remains intact, but justifies a refusal of access only exceptionally and under strict conditions, meaning that the relevant data holdings must be classified in advance and subject to appropriate protective measures. In addition, Art. 13 DA places limits, in business-to-business relationships, on abusive contractual terms concerning data access and data use.

III. Recommendations for action

• Separate the product portfolio by the cut-off date: Manufacturers should categorize the upcoming product generations according to which models will be placed on the market for the first time after 12 September 2026, because only these are subject to the Access by Design obligation under Art. 3 Abs. 1 DA. For example, a manufacturer that places a machine series on the market in August 2026 can still supply it without direct access, whereas the successor model launched in October must meet the requirements. For products with long development lead times, such as vehicles or medical devices, the access channel should therefore already be built into ongoing development, because retrofitting later is technically more complex than taking it into account from the outset.
• Make deliberate use of the design discretion: Since a product falls within the scope only if the manufacturer envisages transmission of the generated data at all, it is worthwhile, before any new development, to determine which sensor and usage data should be retrievable in the future. A household-appliance manufacturer that processes operating data exclusively locally in the device and does not provide an external interface does not, in that respect, trigger obligations under Art. 3 and 4 DA. If, however, it makes the same data accessible through an app or cloud portal, this creates product data along with the corresponding follow-on obligations. This decision should be coordinated from both business and legal perspectives and documented.
• Coordinate pre-contractual information with trade-secret protection: The information obligations under Art. 3 Abs. 2 and 3 DA can in practice be fulfilled only if it has first been determined what data the product generates and which of them require protection. An industrial-machinery provider should classify the generated data holdings in advance, for example distinguishing between operating data to be made freely available, on the one hand, and design or process data requiring confidentiality, on the other, and should establish specific protective measures for the latter, such as tiered access rights or confidentiality agreements. This is the only way to grant access without disclosing competitively relevant know-how, because a blanket refusal based on trade secrets is permissible only exceptionally.
• Adapt contracts to reflect the parties’ roles: Because a company may simultaneously be a manufacturer, data holder and user, existing supply, rental, leasing and service agreements should be reviewed to determine who receives access to which data in each configuration. A lessor that has previously reserved the exclusive right to analyse vehicle or machine data must take into account that the user now has its own right of access under Art. 4 DA and may require that the data be disclosed to third parties. Clauses that unilaterally restrict data access must also be assessed against the limits imposed by Art. 13 DA on abusive contractual provisions and adjusted where necessary.

IV. Conclusion and outlook

As of 12 September 2026, the Data Act’s obligations will include the Access by Design obligation under Art. 3 Abs. 1 DA, which, unlike the right of access already in force, applies only to connected products and related services newly placed on the market. Whether and in what capacity a company is affected continues to depend on the interpretation of the connected product, which, despite initial commentary in the legal literature, remains unclear at the margins. In practice, companies are therefore advised to organize their own product portfolio early on by reference to the cut-off date, make deliberate use of the design discretion, and adapt existing agreements to the new access rights.

The detailed impact of the requirements under Art. 3 Abs. 1 DA will become clear only through the administrative practice of the Bundesnetzagentur (Federal Network Agency), which has monitored compliance as the competent authority since the end of May 2026. Companies should closely monitor further developments, in particular any interpretative guidance from the authority and the first enforcement proceedings, and continually align their implementation measures accordingly.

This article was created in collaboration with our student employee Emily Bernklau.

By contrast, one central set of obligations has been brought forward: from 11 September 2026, the reporting obligations under Art. 14 CRA for actively exploited vulnerabilities and severe security incidents will apply. Companies therefore face the question of whether they even qualify as manufacturers subject to reporting – and if so, what exactly must be reported and how.

I. Who Is Affected by the New Reporting Obligations?

The reporting obligations under Art. 14 CRA apply exclusively to manufacturers. Importers and distributors are subject to their own inspection, monitoring, and cooperation obligations but are not addressees of the reporting and early-warning duties. The threshold question is therefore whether a company is to be regarded as a manufacturer within the meaning of the CRA for a given offering, and whether that offering constitutes a product with digital elements falling within the scope of the Regulation.

The manufacturer concept follows a functional approach. A manufacturer is any person who makes available a product with digital elements under its own name or trademark in the course of a commercial activity (Art. 3 No. 13 CRA). This captures not only classic hardware producers but also pure software providers. Of further practical significance is the fact that importers and distributors who market a product under their own name or trademark, or who substantially modify a product already placed on the market, are themselves deemed manufacturers under Art. 21 CRA and are thus also subject to the reporting obligations. A company’s self-classification as a mere reseller does not shield it from the manufacturer role (as we reported in Data Protection Update No. 243).

The decisive factor for whether an entity is affected is then the concept of a product with digital elements. Under Art. 3 No. 1 CRA, this is a software or hardware product, including its remote data processing solutions, provided that the intended or reasonably foreseeable use involves a direct or indirect data connection to a device or network. The scope is therefore broad, ranging from embedded software in connected devices through standalone software to standalone hardware. The guidance of the European Commission on the application of the CRA (Communication C(2026) 5252), published on 27 July 2026, elaborates on the scope in numerous places and provides an essential orientation aid for case-by-case classification—though it is not legally binding.

Typically affected are, first of all, manufacturers of connected hardware. These include providers of IoT and smart-home devices such as connected thermostats, cameras, or household appliances, as well as producers in mechanical and plant engineering whose products contain connected controllers or communication modules. Industrial control systems, network components such as routers, and the associated embedded software also regularly fall within the scope. The CRA does not depend on the mere presence of electronics but on the product’s ability to exchange digitally communicated data. A product whose electrical signals merely trigger a function or supply power without transmitting digitally encoded information does not, on its own, establish a data connection.

Standalone software is likewise captured. The Commission’s guidance highlights a practically important distinguishing criterion: software falls within the scope if it is made available to the user and executed on the user’s information system. This is the case, for example, for an application downloaded from an app store and installed on the end device, or for a locally installed desktop application, even if it was developed using web technologies. By contrast, software that is exclusively executed remotely and merely accessed by the user via a browser is, according to the guidance, not in itself a product with digital elements. This concerns in particular pure web and SaaS applications as well as websites that merely provide information. Such offerings fall within the scope only if they support the function of a product with digital elements and are thus to be classified as a remote data processing solution.

An underestimated use case concerns products consisting of hardware and separately provided software. According to the Commission’s guidance, hardware and software form a single product with digital elements if the software is required for the intended function of the hardware – even if it is obtained through a separate channel such as an app or a download. A connected printer with the drivers required for its operation, or a fitness wearable that only fulfils its function with the associated smartphone application, are therefore each to be regarded as a single product. For manufacturers of such combinations, this means that the reporting obligation extends to the interplay of the device and its accompanying software.

Special rules apply to free and open-source software (Free and Open-Source Software, FOSS) under Recitals 15, 18, and 19 of the CRA and the Commission’s guidance. The mere publication of such software does not in itself constitute placing on the market. FOSS is captured only if it is made available in the course of a commercial activity – for example, for a fee, through monetization of other services via the software, or through access conditioned on a donation.

By contrast, products that are already subject to certain other sectoral Union regulations with a cybersecurity dimension are entirely excluded. Under Art. 2(2) CRA, the Regulation does not apply, in particular, to products governed by the rules on motor vehicles (Regulation (EU) 2019/2144) or certain vehicle categories (Regulation (EU) No. 168/2013). According to the Commission’s guidance, this extends to components intended exclusively for installation in such vehicles, whereas generic parts that are also offered outside the supply chain through generally accessible distribution channels remain subject to the CRA. For further product groups such as medical devices, separate sectoral regimes exist that require an independent assessment.

Finally, the temporal scope of the reporting obligation reaches further than the date of full applicability might suggest. Under Art. 69(3) CRA, the obligation of Art. 14 CRA extends to all products with digital elements falling within the scope that were made available on the Union market before 11 December 2027. For the reporting obligation, what matters is the existing stock in the market, regardless of whether the product in question will ever be subject to the product requirements applicable from December 2027 or to CE marking.

II. Reporting Procedure Under Art. 14 CRA

Art. 14 CRA obliges manufacturers to report two types of events: actively exploited vulnerabilities contained in a product with digital elements (Art. 14(1) CRA) and severe security incidents that affect the security of such a product (Art. 14(3) CRA). An incident is deemed severe under Art. 14(5) CRA if it negatively affects or may affect the product’s ability to protect the availability, authenticity, integrity, or confidentiality of sensitive or important data or functions, or if it has led or may lead to the introduction or execution of malicious code. Both trigger criteria are narrower than they first appear, since not every known vulnerability is captured but only its actual active exploitation.

Reporting takes place in stages. Under Art. 14(2) and (4) CRA, an early warning must first be issued within 24 hours of becoming aware of the event; within 72 hours a vulnerability or incident notification follows, providing further details on the nature, impact, and measures taken. The final report must be submitted no later than 14 days after the availability of a corrective or risk-mitigation measure in the case of actively exploited vulnerabilities, or within one month after the 72-hour notification in the case of severe security incidents.

The commencement of the time limit depends on when awareness is gained. According to the Commission’s guidance, awareness does not arise as early as the first suspicion but only when the manufacturer, following an initial assessment, can assume with sufficient certainty that active exploitation or an impairment of product security exists. At the same time, the guidance emphasizes that this assessment must be carried out promptly and that the commencement of the time limit must not be deferred by a delayed examination.

The addressees are two bodies simultaneously: the CSIRT designated as coordinator and ENISA (Art. 14(1) and (3) CRA). Submission is made via the single reporting platform established under Art. 16 CRA, which is operated by ENISA. The platform is currently still in its testing phase and is scheduled to be operational by 11 September 2026. The locally competent CSIRT is determined under Art. 14(7) CRA generally by reference to the manufacturer’s main establishment, i.e., the Member State in which cybersecurity decisions regarding the products are predominantly made. The formal designation of CSIRTs by the Member States is still pending. In Germany, CERT-Bund, which is housed at the BSI, is expected to assume this role. For manufacturers without an establishment in the Union, a tiered fall-back connecting factor applies. The identification of the competent CSIRT and prior registration on the platform should be clarified early, since a report within 24 hours is otherwise practically unachievable.

In addition, Art. 14(8) CRA establishes a separate obligation to inform the affected users – and, where appropriate, all users—about the vulnerability or incident as well as possible remedial measures. According to the Commission’s guidance, this information is to be handled on a risk-based approach and does not necessarily require public disclosure, since premature disclosure of technical details may increase risk particularly in sensitive deployment environments. If the manufacturer fails to fulfil its information obligation in time, the CSIRTs may themselves inform the users.

The detailed modalities of official further dissemination are governed by Delegated Regulation (EU) 2026/881. It specifies the conditions under which the initially involved CSIRT may temporarily defer dissemination of a notification to the other competent CSIRTs – for example, where a patch is to be provided at short notice or a coordinated disclosure procedure is still ongoing. Finally, it should be noted that a notification under Art. 14 CRA does not replace other reporting obligations. Since the same root cause may simultaneously trigger obligations under the NIS 2 Directive or under Art. 33 GDPR, the respective connecting factors should be clarified in advance.

III. Recommendations for Manufacturers

• Determine manufacturer role and product inventory: As a first step, it should be documented for each product whether the company is a manufacturer within the meaning of the CRA for that product, including in cases of own-brand distribution or substantial modification under Art. 21 CRA. Since the reporting obligation under Art. 69(3) CRA extends to the market stock made available before 11 December 2027, this must include not only the current portfolio but also legacy products still in the market. The basis for this is a Software Bill of Materials (SBOM) for each product, without which it cannot be reliably assessed whether a publicly disclosed vulnerability affects one’s own product.
• Identify the competent CSIRT and set up platform access: Based on the main establishment under Art. 14(7) CRA, the CSIRT designated as coordinator must be identified, and access to the single reporting platform must be set up and tested in advance. Those who begin registration only when an event occurs will regularly be unable to meet the 24-hour deadline.
• Establish the internal decision chain before an emergency: For the 24-hour deadline, the internal assessment and approval chain is the critical factor. It must be determined in particular who triages incoming reports and performs the initial assessment relevant to the commencement of the time limit, by what criteria active exploitation or a severe incident within the meaning of Art. 14(5) CRA is affirmed, and who authorizes the notification. Since actively exploited vulnerabilities and incidents are not bound to business hours, this chain must be reachable and capable of making decisions outside regular working hours.
• Clarify interfaces with other reporting obligations and the supply chain: Since the same root cause may simultaneously trigger reporting obligations under the NIS 2 Directive or under Art. 33 GDPR, these procedures should be coordinated with the CRA notification, and the respective applicable deadlines and addressees should be allocated in advance. In addition, supply agreements should include information and notification obligations regarding vulnerabilities in supplied components, so that the manufacturer can meet the Art. 14 CRA notification and the reporting obligations to the component manufacturer under Art. 13(6) CRA within the prescribed time limits.

IV. Conclusion and Outlook

With the reporting obligations of Art. 14 CRA, the first set of CRA obligations takes effect on 11 September 2026 – well before the Regulation becomes fully applicable. For manufacturers, the real challenge lies less in the technical detection of vulnerabilities and incidents than in organization. The short 24-hour early-warning deadline can only be met if the manufacturer role, product inventory, competent CSIRT, platform access, and internal decision-making pathways have been clarified in advance. Since the obligation under Art. 69(3) CRA also covers existing stock already in the market, this applies not only to future products but also to products already placed on the market.

At the same time, the legal landscape remains in flux. The Commission’s guidance of 27 July 2026 clarifies key interpretive questions but is not legally binding and does not preclude further clarification through additional guidance, harmonized standards, and the practice of market surveillance authorities. Reporting and response processes should therefore not be implemented in isolation but embedded from the outset in CRA compliance as a whole.

This article was created in collaboration with our student employee Emily Bernklau.

In its judgment of 26 January 2026 (Case No. 7 SLa 435/25), the Hesse Regional Labour Court held that the defendant employer was required to pay the claimant compensation pursuant to Section 15 (2) of the General Equal Treatment Act (AGG) for a violation of the prohibition of discrimination under Section 1 AGG. The non-gender-neutral wording of the job advertisement established a presumption of direct discrimination. The defendant’s objection of abusive “AGG-hopping” was unsuccessful, as the defendant had failed to present and prove the facts required to establish such abuse.

A. Facts

On 23 May 2023, the claimant applied via the online platform “Indeed” by email for a position advertised by the defendant under the title “kaufmännische Mitarbeiterin/Bürokauffrau/Sekretärin” (commercial employee [female form]/office administrator [female form]/secretary [female form]). While the body text of the advertisement did not contain any gender-specific differentiation regarding the requirements or the nature of the role, the position was advertised as a full-time role with a gross monthly salary of EUR 3,300.00.

The claimant, who had completed training as an industrial clerk, attached a cover letter, a curriculum vitae and further application documents to his application. By letter dated 26 May 2024, he received a rejection from the defendant. The claimant took the view that he had been rejected on the basis of his gender, which constituted prohibited unequal treatment under Section 1 AGG, and that the job advertisement gave rise to a presumption of discrimination in accordance with Section 11 AGG. He considered compensation of at least two gross monthly salaries, i.e. at least EUR 6,600.00, to be appropriate, reasoning that he was still without employment. He further noted that compensation under Section 15 (2) AGG was, in principle, not capped at three gross monthly salaries. He rejected the defendant’s objection of abuse of rights and argued that the mere fact of having applied for several positions, including those at a considerable distance from his place of residence, did not constitute an abuse of rights, particularly since he maintained a genuine interest in full-time employment with the defendant.

The claimant further submitted that the distance between his place of residence and the potential workplace at the defendant’s premises did not undermine the seriousness of his application, as a change of workplace required a certain degree of geographical mobility, and that the large number of court proceedings for compensation that the claimant was pursuing against various defendants did not speak against the seriousness of his application. As an alternative explanation for his application behaviour, he referred to his obligation to register as unemployed pursuant to Section 141 (1) sentence 3 of the German Social Code Book III (SGB III) and the risk of blocking periods for unemployment benefits in the event of insufficient personal efforts pursuant to Section 159 (1) No. 3 SGB III. He also stated that his distance learning programme did not preclude his application, as it had already been completed.

The Frankfurt am Main Labour Court (cf. judgment of 2 April 2025 – Case No. 14 Ca 4541/24) had initially issued a default judgment dismissing the claim, against which the claimant lodged a timely and properly filed objection. The defendant raised the objection of abuse of rights and asserted that the claimant was a so-called “AGG-hopper” with a systematic business model, as he was conducting multiple court proceedings solely for the purpose of asserting compensation claims against various defendants.

The defendant based this claim on, among other things, an allegedly superficial cover letter, the incompatibility of the position with the claimant’s distance learning programme, a continuous adaptation of his litigation and application behaviour, and the considerable distance between the workplace and the claimant’s place of residence, for which the claimant had not presented any relocation plans.

The Frankfurt am Main Labour Court subsequently ordered the defendant to pay the claimant compensation in the amount of EUR 4,500.00, holding that the presumption under Section 22 AGG was triggered due to the defective, non-gender-neutral job advertisement pursuant to Section 11 AGG, and that this – with reference to the case law of the Federal Labour Court (cf. judgment of 19 September 2024 – Case No. 8 AZR 21/24) – established direct discrimination. The court did not consider either the application documents or the number of compensation proceedings brought by the claimant against various defendants to constitute a sufficient indication of abuse of rights.

B. Reasoning of the Hesse Regional Labour Court

The defendant’s appeal to the Hesse Regional Labour Court was unsuccessful. The Hesse Regional Labour Court upheld the first-instance decision and dismissed the defendant’s appeal as unfounded, holding that the claimant had been disadvantaged on the basis of his gender as a result of the defendant’s job advertisement, which, following the rejection, gave rise to the assumption of direct discrimination pursuant to Section 3 (1) AGG.

The personal scope of application of the AGG was open, as the claimant qualified as an employee within the meaning of Section 6 (1) sentence 2 AGG and the defendant as an employer within the meaning of Section 6 (2) AGG. The compensation claim had also been properly and timely asserted (cf. Section 15 (4) AGG, Section 61b (1) of the Labour Court Act (ArbGG), Section 167 of the Code of Civil Procedure (ZPO)).

I. Existence of Discrimination

The court found that the defendant had advertised the position in question contrary to Section 11 AGG in a non-gender-neutral manner, which indicated unequal treatment, and that the claimant had received less favourable treatment than a comparable person as a result of the rejection of his application, such that the requirements of Section 15 (2) AGG were met.

The defendant’s submission that the advertisement had merely contained a linguistic error without any gender-based preselection was, in the court’s view, insufficient to rebut the reversal of the burden of proof ordered under Section 22 AGG, particularly since the repeated use of the female form typically indicated unequal treatment on the basis of gender. The defendant would have had to demonstrate specific circumstances establishing an objective, standardised selection process focused exclusively on filling the position, which it had failed to do. The assertion that the position had ultimately been filled with a male applicant, or the reference to numerous subsequently gender-neutrally worded job advertisements in the period from August 2023 to October 2024, did not alter this finding, since the recruitment process at issue had already been concluded with the rejection in June 2024 and the defendant had not disclosed any selection criteria.

II. No Abuse of Rights Pursuant to Section 242 of the German Civil Code (BGB)

The court further held that a compensation claim could be subject to the defence of abuse of rights if the applicant had not applied for the position but only for the formal applicant status with the sole aim of asserting a claim, for which both an objective and a subjective element were required.

The burden of presentation and proof for the existence of these requirements lay with the employer, who had to present corresponding indications and, if contested, provide proof. The mere labelling of the claimant as an “AGG-hopper” did not in itself constitute a defence of abuse of rights and was not a suitable indication.

An abuse of rights could not be inferred merely from the fact that a person had sent a large number of unsuccessful applications and had conducted multiple compensation proceedings, as such behaviour could also be explained by a genuine interest in a position and the permissible exercise of rights under the AGG. Accordingly, high requirements had to be applied to the assumption of a defence of abuse of rights.

What was required was a systematic and targeted pattern of behaviour identifiable in the individual case, based on the consideration that, from an economic perspective, a sufficient “profit” would remain. The appeal chamber assumed in the defendant’s favour that the claimant had continuously applied nationwide for positions obviously advertised in a non-gender-neutral manner as “secretary” [female form] or “office administrator” [female form] and, following rejections, had attempted to enforce compensation claims through the courts. However, the court was unable to determine from the defendant’s factual submissions how the specific application processes had proceeded in detail, nor what adjustments the claimant had made to his application documents or his behaviour. The defendant’s reference to court decisions also did not evidence any such adaptation or change in behaviour. Referring to the requirements of the Federal Labour Court (cf. judgment of 19 September 2024 – Case No. 8 AZR 21/24) regarding the clarification of the facts, the court found that, in the absence of corresponding investigations by the defendant, it was unable to make any further findings regarding an established business model of the claimant on the basis of the principle of party presentation.

In the appeal instance, the court’s assessment was no different: abusive behaviour did not follow merely from the fact that a cover letter was standardised or superficially drafted, as there was neither an empirical rule that only a carefully drafted cover letter demonstrated genuine interest, nor the reverse. The fact that the claimant had not answered a question from the opposing counsel at a conciliation hearing and had subsequently applied for a further gender-neutrally advertised position was also insufficient to establish a business model, as the defendant had likewise not conducted the necessary clarification of the facts in this regard.

On the question of the lack of willingness to relocate, the court clarified that this alone could hardly constitute an indication of abuse of rights, particularly as the claimant had referred to his unemployment, his statutory obligation to apply for jobs, and his willingness to take up the position, and was entitled under Article 12 (1) of the Basic Law (GG) and under the social law requirements to apply for positions throughout Germany.

The defendant’s assertion that the application was incompatible with the claimant’s distance learning programme was also unsuccessful, as the claimant had demonstrated that the programme had already been completed and the defendant had not substantively challenged this.

Finally, the appeal chamber conducted an overall assessment of the circumstances cited by the defendant (the number of court proceedings brought by the claimant, further proceedings against the defendant, nationwide applications, distance from place of residence, and absence of relocation plans), but concluded that even the cumulation of these factors did not constitute proof of a business model aimed at generating a sufficient profit, as the defendant had not carried out the necessary clarification of the facts, for example through “data collection” regarding earlier application processes.

With regard to the subjective element of the abuse of rights, the court also found that the claimant’s individual factual submissions regarding his training, his experience of gender discrimination, and his situation of unemployment and receipt of basic social security benefits at least relativised a purely general-preventive motivation. The defence of abuse of rights therefore did not arise due to the defendant’s failure to carry out further clarification of the facts.

C. Practical Note

The decision illustrates that employers who wish to rely on the defence of abusive “AGG-hopping” in response to a compensation claim under the AGG bear the full burden of presentation and proof for both an objective and a subjective element of abuse of rights, with high requirements applying in this regard.

According to the decision, neither a large number of unsuccessful applications and compensation proceedings, nor the considerable distance of the workplace from the place of residence, a standardised or superficial application, or the claimant’s lack of relocation plans are, individually or cumulatively, sufficient to establish a systematic, profit-oriented business model if the employer is unable to adequately discharge its burden of presentation and proof for both an objective and a subjective element of abuse of rights – as was the case here due to insufficient clarification of the facts. Rather, what is required is a concrete clarification of the facts by the defendant employer, for example through “data collection” regarding the respective claimant’s other application processes, as well as proof of strategic adjustments between the individual proceedings brought in order to minimise risks. The decisive factor is that the employer is able to present and prove in substance a business model on the part of the claimant aimed at generating a profit.

Overall, the decision imposes high requirements on the burden of presentation and proof for employers regarding abusive conduct in the form of so-called “AGG-hopping.” In practice, such a degree of detail in the clarification of the facts will be difficult for employers to achieve – particularly with regard to potential parallel application and/or court proceedings of the claimant against other potential employers. It is to be feared that the defence of abuse of rights will be effectively rendered meaningless due to the considerable requirements that the courts impose on the burden of presentation and proof borne by employers.

Facts

Two employers operate several joint establishments and use a shared digital time-recording system. This system records the working hours of all employees – but also the reasons for absence, such as illness or maternity leave. The employers have a total of 20 locations, each with its own works council. In addition, there is a central works council responsible for matters spanning multiple locations. In 2018, the employers concluded a works agreement with the central works council, granting the individual works councils permanent electronic read access to employees’ time-recording data. The works councils could view at any time when employees had worked and whether they were ill or on maternity leave.

A local works council used this data access to create an Excel spreadsheet listing all employees’ sick days. This file was stored unencrypted on an internal drive – a clear breach of data protection requirements. The data protection officer responded and demanded that the works councils’ permanent access to the time-recording system be revoked immediately. The employers implemented this demand and blocked the local works councils’ access.

The central works council then demanded that the employers restore the electronic access rights for the local works councils, as had been provided for in the group works agreement.

The Decision of the Cologne Regional Labour Court

The Cologne Regional Labour Court (Landesarbeitsgericht Köln) rejected the central works council’s claim. The reasoning comprises two aspects.

The central works council was not competent. Granting the access rights was not subject to the central works council’s original co-determination right. The central works council only has jurisdiction over matters that cannot be regulated at the level of the individual establishment. Alternatively, in the absence of original jurisdiction, it would have needed to be duly authorized by the local works councils.

Where the central works council concludes a group works agreement with the employer within its original jurisdiction, it is in principle entitled, in its own right, to demand implementation of that group works agreement. The introduction of the time-recording system at issue here was meant to be implemented and administered uniformly across all establishments, so that an arrangement with the central works council was required. According to the court, however, this does not establish an all-encompassing jurisdiction of the central works council to regulate all related questions. The central works council is not superior to the local works councils, but only has jurisdiction where a matter cannot be regulated at the local level.

Any electronic access right of the works council is governed by Section 80(1) of the German Works Constitution Act (Betriebsverfassungsgesetz, “BetrVG”) (monitoring compliance with statutes – here, among others, the Working Hours Act). It is not governed by the co-determination right under Section 87 BetrVG. According to the Cologne Regional Labour Court, granting read access is not covered by the co-determination requirement of Section 87(1) No. 6 BetrVG (introduction and use of technical equipment designed to monitor the conduct or performance of employees).

A local works council is itself best placed to decide whether and how it performs its monitoring duties under Section 80 BetrVG. There is no need for a uniform arrangement spanning multiple establishments. No delegation of the right from the local works councils to the central works council had taken place. The question of how a works council performs its monitoring duties and what information it receives from the employer for that purpose falls within the responsibilities of the respective local works council. The central works council may therefore not regulate these rights without express authorization from the individual works councils. Accordingly, the central works council also has no corresponding right to demand implementation.

The Regional Labour Court further stated that enforcing a permanent access right for the local works councils would also have entailed obligations. The respective local works council would have to ensure that data protection requirements are complied with and take appropriate measures. This represents a significant responsibility accompanied by corresponding obligations.

Data protection precludes permanent read access. The court found that permanent electronic access to sensitive employee data is likewise incompatible with data protection requirements. A permanent means of access is not necessary.

The works council’s right to be informed under Section 80(2) BetrVG does not give works councils a statutory entitlement to permanent electronic access to working-time data. Permanent read access without a specific occasion goes beyond what works councils actually need in order to perform their statutory duties. Employers are also entitled to review information before disclosing it and, where appropriate, to remove data that is not relevant.

The time-recording system at issue here also contained specially protected health information, such as absences due to illness. The interests of the employees affected here are more deserving of protection and carry greater weight than any (permanent) interest the works councils may have in obtaining information.

Practice Tip

In data protection matters, the principle of data minimization must always be observed. Permanent access to a large volume of personal data is not necessary when one considers the works council’s actual duties. The handling of employee data must be limited to the minimum required. Such handling entails not only rights, but also obligations and responsibility.

When examining the central works council’s jurisdiction, the question to ask is whether the matter in question objectively cannot be regulated at the local establishment level.

The proper filing of a mass layoff notification pursuant to Section 17 of the German Protection Against Dismissal Act (Kündigungsschutzgesetz – KSchG) is one of the key formal requirements in larger workforce reduction projects. Errors in the notification procedure can render all dismissals issued invalid – a risk of considerable practical significance, particularly in the context of insolvency and restructuring. In practice, the question regularly arises whether minor inaccuracies in the information provided in the mass layoff notification already lead to the invalidity of the subsequent dismissals. A recent judgment of the Federal Labour Court (Bundesarbeitsgericht – BAG) of 25 June 2026 (6 AZR 7/26) provides welcome clarity on this issue.

Facts of the Case

The claimant was employed as a machine setter and operator at a lock manufacturer and machine builder (the subsequent debtor). In November 2024, insolvency proceedings were opened over the debtor’s assets and the defendant was appointed as insolvency administrator.

The insolvency administrator informed the works council established at the debtor’s premises about the intended plant closure and the dismissal of all remaining employees. On 25 February 2025, a reconciliation of interests (Interessenausgleich) was concluded. Subsequently, the defendant filed the mass layoff notification with the competent employment agency (Agentur für Arbeit) and, after its receipt, terminated the claimant’s employment relationship effective 31 May 2025.

In the notification, the defendant had stated the intention to issue 34 dismissals. In fact, however, only 31 or 32 dismissals were actually carried out. The claimant argued that the dismissal was invalid due to contradictory or erroneous information provided to the works council and/or the employment agency regarding the number of employees to be laid off.

Decision

The labour court of first instance had upheld the claim; the regional labour court (Landesarbeitsgericht) dismissed it. The claimant’s appeal on points of law (Revision) was unsuccessful. The disputed dismissal thus terminated the employment relationship effective 31 May 2025.

Key Issue: Compliance with the Purpose of the Notification Procedure

The BAG clarified that the notification procedure to be carried out before a mass layoff is intended to enable the competent employment agency to seek solutions within a period of 30 days to the problems raised by the intended dismissals. If the employer makes errors in the notification that do not conflict with this search for solutions and thus with the purpose of the notification procedure, the notification – depending on the circumstances of the individual case – satisfies the requirements of the Mass Layoff Directive (MERL).

The fact that the defendant had indicated a slightly higher number of employees to be dismissed in the mass layoff notification than were actually dismissed does not, in the BAG’s view, constitute a material error in the notification that would lead to the invalidity of the dismissal. The employment agency is not impaired in its task of mitigating the negative consequences of mass layoffs, as it can, on this basis, prepare for placing the employees to be laid off and review labour market policy measures. In such a case, the notification still ensures lawful action by the labour administration. It is therefore still proper and thus valid despite the objectively incorrect information.

The dismissal is not invalid due to an error in the mass layoff notification and therefore terminated the employment relationship upon expiry of the notice period.

Practical Guidance

The BAG’s decision provides an important clarification for practice: not every error in the information contained in a mass layoff notification necessarily leads to the invalidity of the subsequent dismissals. What is decisive is rather whether the error impairs the purpose of the notification procedure – i. e., the search for solutions by the employment agency. Minor deviations in the number of employees to be laid off “upwards” are therefore harmless, as they do not hinder the labour administration in its task.

In the context of restructurings and plant closures, this can provide relief for employers: provided that the consultation procedure was properly conducted and the notification fulfils the purpose of the procedure overall, minor inaccuracies in the number of announced layoffs do not lead to the invalidity of the dismissals. Nevertheless, it remains advisable to exercise the utmost care when preparing the mass layoff notification and to thoroughly review the information – in particular regarding the number of affected employees – before submission.

The judgment only indicates that, in individual cases involving only minor errors, the notification is not defective. In cases of serious misstatements, the invalidity of the notification and thus of the dismissals should still be assumed.

The full reasons for the decision are not yet available. It can be expected that they will contain further guidance on the purpose of the notification and the associated obligations of the employer.

While Germany has established the necessary national legal framework through the EBewMG (Elektronische-Beweismittel-Umsetzungs- und Durchführungsgesetz), implementation in numerous other Member States has not yet been completed. The following article examines the regulatory framework, the current status of registration and notification obligations, and highlights the measures that service providers should now take.

I. Regulatory Framework of the E-Evidence Regulation

The E-Evidence Regulation addresses a broadly defined group of service providers. Under Article 3(3) of the E-Evidence Regulation, this includes in particular providers of electronic communications services, providers of internet domain name and IP numbering services, and certain information society services. In addition to traditional telecommunications companies, this may include messenger and email services, domain registrars, as well as cloud and hosting providers. Platforms that provide their users with communication functionality or the ability to store or process data may also fall within the scope of the Regulation. What is decisive is therefore not the formal classification of the company, but the specific design of the service offered (as reported in Data Protection Update No. 249).

At the core of the new regulatory framework are the European Production Order and the European Preservation Order, which are transmitted to the service provider by means of EPOC and EPOC-PR certificates. The Production Order allows law enforcement authorities to request electronic evidence directly from a service provider or its designated addressee. The Preservation Order, by contrast, serves to provisionally preserve data in order to prevent its deletion or alteration pending a subsequent production request.

The Production Order must generally be complied with within ten days, while in emergencies a reduced period of eight hours applies. Following a Preservation Order, the affected data must initially be preserved for 60 days, with an extension of a further 30 days possible.

The direct addressing of orders to the service provider requires that the provider designates an appropriate addressee or representative within the European Union (Article 3(1) of the E-Evidence Directive). Orders are then addressed directly to this addressee (Article 7 of the E-Evidence Regulation). This addressee must have the necessary powers and resources to receive orders and to facilitate their execution.

II. Current Status of the Registration and Notification Procedure

1. German Implementation

Germany established the national legal framework for the application of the E-Evidence Regulation through the Act transposing Directive (EU) 2023/1544 and implementing Regulation (EU) 2023/1543, which was published in the Federal Law Gazette on 12 March 2026. The centrepiece is the EBewMG.

This Act specifies in particular the obligations of service providers under the E-Evidence Directive to designate an addressee or representative and the related notifications to the competent authority. Service providers with an establishment in the European Union must generally designate an appropriate establishment as addressee. Providers without an establishment in the Union must appoint a representative. The addressee must be equipped with the necessary powers and resources to receive European Production and Preservation Orders and to facilitate their execution.

The central authority for registration and monitoring of the relevant obligations is the Federal Office of Justice (Bundesamt für Justiz, BfJ). It monitors in particular compliance with the designation and notification obligations of service providers and cooperates with the competent authorities of other Member States. In the event of breaches of these obligations, fines of up to EUR 500,000 may be imposed under Section 18 EBewMG, and for service providers with a global annual turnover exceeding EUR 5 million, fines of up to 2 per cent of global annual turnover.

At the point of application, however, a significant discrepancy is apparent between the expected and the actually registered group of providers: according to the Federal Ministry of Justice, only 193 registrations had been received by the BfJ as of 18 August 2026, whereas the Federal Government had originally anticipated around 9,000 covered service providers.

The technical infrastructure for implementation is also fundamentally operational in Germany at the point of application. The EU-wide exchange between the judiciary, law enforcement authorities and service providers is to take place via a decentralised IT system with interoperable access points, based on the European e-CODEX infrastructure. Germany is connected to this system via a national access point. This point, including its connection to the specialist application Judex, has been operational since 18 August 2026. The technical prerequisites for securely transmitting and receiving orders between the parties involved are therefore in place.

Organisational coordination is carried out by the E-Justice Coordination Office Europe (EKE), located in North Rhine-Westphalia. All 952 courts and central offices reported by the state justice administrations are already connected to it. In addition, police as well as other federal and state authorities are being connected to the reference implementation software. Germany thus has in place at the point of application not only the necessary national legal framework, but also a largely established technical and organisational infrastructure for the practical implementation of the E-Evidence procedure.

2. European Comparison

A uniformly functioning EU-wide procedure does not yet exist, however. According to the current state of implementation, only eleven other Member States besides Germany have adopted implementing legislation. In six further Member States, draft legislation has already been presented, while in the remaining nine Member States no publicly discernible implementation activity can be identified to date. This has immediate practical consequences for cross-border exchange: according to the Federal Ministry of Justice, initially only Germany is expected to be able to both transmit and receive orders via the secure decentralised IT system. Orders may be transmittable to Ireland, but Ireland itself is not yet expected to be able to issue orders, as the legal bases for issuing and validating authorities have not yet been fully established there.

Ireland is of particular practical importance due to the European headquarters of numerous large US technology companies located there.

A further limitation arises from the scope of the E-Evidence Directive itself. Under Article 1(2), second sentence, of the E-Evidence Directive, the Directive does not apply to service providers that are established in the territory of only one Member State and offer their services exclusively there. This may be particularly relevant for corporate groups with national subsidiaries. If a group operates its services in the individual Member States through separate companies active exclusively at national level, the relevant company may in certain circumstances be regarded as a purely domestic provider falling outside the scope of the Directive, and thus be exempt from the obligation to designate an addressee. For cross-border investigations, this means that an addressee may be lacking and that not every service provider established in the Union can necessarily be reached via the E-Evidence regime by authorities of another Member State.

At the point of application, an ambivalent picture thus emerges: while Germany has established the legal, organisational and technical prerequisites for the new procedure, significant differences in the state of implementation and actual scope of application persist at European level.

III. Recommendations for Service Providers

For service providers, the need for action at the point of application of the E-Evidence Regulation is not limited to formal registration. What is critical is that the designated addressee is actually capable of receiving an EPOC or EPOC-PR at short notice, assigning it internally and processing it within the required timeframes. Companies should therefore take the following practical precautions in particular:

• Addressee and Accessibility: First, it should be verified that the registered addressee actually has the necessary powers and resources. For internationally active corporate groups, it should be clearly established which company or establishment is responsible for orders. Merely forwarding to a general legal or support address is insufficient given the short response times. For emergencies, a reachable point of contact must exist that can respond outside normal business hours.
• Rapid Internal Routing: When an EPOC is received by the addressee, it must be possible to determine within a short time which internal unit is responsible for review and execution. A clearly defined process is therefore advisable, providing for automatic escalation to legal, law enforcement teams and, where applicable, IT. This is particularly relevant for the eight-hour deadline in emergencies: an order received at night or on a weekend, for example, must not reach the responsible specialist department only on the next working day.
• Determining Data Category and Storage Location: Before production, it should also be immediately established which data are affected and where they are stored or technically accessible. This is particularly relevant for cloud and platform providers whose data may be distributed across different systems or Member States. A provider should therefore be able to document comprehensibly, for its own products, which subscriber, identification, traffic and content data are processed and which systems can access that data.
• Technical Capability to Execute Preservation Orders: In the case of an EPOC-PR, it must also be ensured that the affected data are actually protected from deletion or overwriting for the specified period. This is particularly relevant for services with automated deletion or rotation processes, such as for log or traffic data. Companies should therefore examine whether an incoming Preservation Order can be automatically forwarded to the systems responsible for data retention and how the preservation is documented.

IV. Conclusion and Outlook

With the point of application of the E-Evidence Regulation, a fundamentally capable instrument for cross-border access to electronic evidence is now available, though its practical effectiveness is currently still limited by the uneven state of implementation across Member States. While Germany has largely established the legal, organisational and technical prerequisites, it remains to be seen how quickly the remaining Member States follow suit and whether the registration rate of service providers – which has so far fallen significantly short of expectations – increases.

For practice, it will therefore initially be decisive that service providers complete their registration and design their internal processes so that Production and Preservation Orders can actually be processed within the required timeframes. Only when both the legal framework and technical connectivity are in place EU-wide will it become apparent whether the E-Evidence Regulation can fulfil the expectations associated with it for faster and more effective cross-border evidence gathering.

This article was created in collaboration with our student employee Emily Bernklau.

Since 2 August 2026, transparency and labelling obligations have applied to AI-generated content. Among other things, they require providers of generative AI systems to technically label AI-generated or AI-manipulated content in such a way that its artificial origin can be identified in machine-readable form. In addition, certain AI-generated or AI-manipulated content published by companies is subject to labelling obligations vis-à-vis users.

This raised the practical question: How is such technical labelling supposed to work for AI-generated texts?

Anthropic announced that it would equip future models with watermarking for texts.

What is “watermarking“?

When one thinks of watermarks, one initially thinks of visible indicators, such as logos, patterns, or lettering, that identify the origin or author of a document.

In AI-generated texts, however, watermarking operates through a statistical pattern in the choice of words that is not discernible to the reader.

How does “watermarking” work?

Generative AI produces texts by having the underlying model decide, step by step, which word is most likely to come next. There are often several words that fit equally well.

Example: “The film was quite…“

Here, “exciting“ or “captivating“ could follow. Both words fit well both linguistically and in terms of meaning. Which variant is chosen makes hardly any difference to the meaning of the sentence.

These “low-stakes decisions“ are used in watermarking: If several equally suitable words are available, the random selection among them is controlled so that a particular statistical pattern emerges over the course of a longer text.

In doing so, the model does not alter the content of the text or add any hidden characters or additional words.

The watermark is therefore not discernible to the reader. Anyone who has the relevant key, however, can check whether the text exhibits the expected statistical pattern.

The limitations of “watermarking“

A watermark does not prove that a text was created entirely by AI. Rather, it may indicate how likely it is that a particular AI system was involved in creating or editing the text.

The following applies: The fewer textual decisions the AI model makes itself, the fewer opportunities there are for “watermarking.”

If AI merely corrects a text written by a human, most of the words still originate with the human. The opportunities for incorporating “watermarking” are therefore more limited than with a text generated entirely by the AI itself.

Even with unambiguous answers, there is no room for choice of words.

Example: “2 + 2 = …“

There is no equivalent alternative to “4” here. Watermarking cannot be applied in this case.

What does this mean for companies?

The question of whether and how AI-generated content must be labelled is an important compliance issue.

Anyone using AI for marketing, product descriptions, customer communications, or other processes within the company should be sure to clarify the following three questions:

1. AI detection:

Are contents created or edited using AI, and can this be technically verified?

2. Transparency obligation:

Must the content be labelled for users as AI-generated or AI-manipulated?

Technical labelling, such as Anthropic’s watermarking, is not the same as a visible disclosure to the user.

3. Lawfulness of the content:

Is the company permitted to use the content at all, for example with regard to copyright, personality rights, or competition law, and who is responsible for its use?

Technical watermarks can help with the first question. However, they do not automatically answer the second question, and certainly not the third. Companies should therefore not only know whether they are permitted to use AI, but also which transparency obligations and other legal obligations are associated with the specific use.

I. The Background

In addition to securing individual claims through separate security agreements, broad-purpose security declarations in general terms and conditions are very common in banking practice. These are intended to comprehensively protect banks in their business relationship with the customer. Clauses 14 of the General Terms and Conditions for Banks (AGB-Banken) and 21 of the General Terms and Conditions for Savings Banks (AGB-Sparkassen) provide that customers grant the bank a lien over assets of any kind that come into the bank’s possession in the course of banking business, including the customer’s claims against the bank arising from existing account balances.

The lien thus serves to secure all existing and future claims of the bank against the customer arising from their business relationship.

In the case of KfW-refinanced subsidised loans, it is regularly agreed that the claims arising from the granting of the loan are assigned to KfW upon their creation. The house bank regularly remains authorised to collect until revocation by KfW. Pursuant to Section 7 of the General Conditions for Investment Loans in the contractual relationship between the house bank and the end borrower (AB-EKN), security interests that do not pass to KfW as a result of the assignment are to be held in trust for KfW; at the same time, the AB-EKN provide that the claims in question continue to be covered by the security purpose agreed between the house bank and the end borrower even after the security assignment.

II. The Decision of the OLG Stuttgart

1. Facts and Legal Background

The OLG Stuttgart’s decision concerned a KfW-refinanced subsidised loan of EUR 700,000. The debtor maintained a business account with the defendant bank, whose GTC provided for a lien with a broad security purpose clause securing all claims of the bank from the business relationship. On the day before the opening of insolvency proceedings, the account had a balance of EUR 400,232.73. After the opening of proceedings, the insolvency administrator demanded payment of the balance. The bank, however, relied on the GTC lien and only paid out the amount exceeding the lowest balance within the three-month period prior to the insolvency petition. The bank retained the remaining amount of EUR 84,133.63 as a purportedly avoidance-proof base amount.

The three-month avoidance period under Sections 130, 131 of the German Insolvency Code (InsO) thus formed the background of the bank’s defence. In the case of account balances, it must be considered that the customer’s claim against the bank ceases to exist upon debits and arises anew with subsequent credits; the same applies to a (GTC) lien attached thereto. Increases in the balance during the three-month period are therefore vulnerable to insolvency avoidance, while the lowest continuously existing balance may be considered an avoidance-proof base. However, this argument would only have helped the bank if a lien still existed that secured the loan repayment claim assigned to KfW. The OLG Stuttgart denied precisely this in the present case.

2. The Key Findings of the OLG Stuttgart

Unlike the Regional Court of Stuttgart (LG Stuttgart) as the court of first instance (judgment of 23 July 2025 – 27 O 259/24), the OLG Stuttgart left open whether the house bank’s GTC lien was originally validly created. According to the Senate, even a validly created lien no longer secures the loan repayment claim assigned to KfW.

While a lien, as an accessory security right, generally passes to the assignee upon assignment of the secured claim pursuant to Sections 401, 1273(2), 1250(1) sentence 1 of the German Civil Code (BGB), this does not apply without restriction in the case of a GTC lien with a broad security purpose declaration that covers all present and future claims of the bank arising from the business relationship and is thus creditor-related rather than claim-related. In this constellation, the lien cannot be split in proportion to the claims upon assignment of an individual claim (as also held by the prevailing view, see Wiegand, in: Staudinger, as of 31 July 2022, BGB § 1250 para. 6; Wilhelm, Sachenrecht, 7th ed. 2021, para. 1859, with a noteworthy reference to an analogy to Section 1190(4) sentences 1, 2 BGB). At the time of assignment, it is precisely uncertain whether and to what extent further claims of the bank from the continuing business relationship will arise in the future. The lien therefore remains with the bank but only secures the bank’s own claims and no longer the assigned individual claim.

Equally unhelpful, in the OLG Stuttgart’s view, is the trust arrangement provided for in the AB-EKN. Due to the strict accessory nature of the lien, the pledgee and the creditor of the secured claim must be identical. A fiduciary holding is therefore precluded, at least in the case of accessory security interests such as liens; the position may be different for abstract security interests, such as land charges (Grundschulden).

The Senate also ruled out a lien originally created in favour of KfW. The bank’s GTC only provide for a lien in favour of the bank; a separate creation in favour of KfW was not apparent. The OLG Stuttgart also rejected, in line with the established case law of the Federal Court of Justice (BGH) (see BGH, judgment of 8 July 1993 – IX ZR 222/92, BGHZ 123, 178 = NJW 1993, 2617 with further references), the assumption of a disposition in rem in favour of third parties. Unlike contractual stipulations in favour of third parties under Section 328 BGB, the law of property does not generally permit such a construction. The Senate relies in particular on the principle of numerus clausus in property law and on the fact that the creation of a lien establishes a statutory obligation with duties on the part of the pledgee.

III. Assessment from the Perspective of Lending Practice

The consequence is significant for lending practice: the repayment claim passes to KfW without the securing lien. The GTC lien remains with the house bank and no longer secures the assigned claim. This security gap is likely to be of particular practical relevance in the currently increasing restructuring cases, since all credit security is typically subjected to a thorough legal and economic review, and any deficiencies in the security structure directly affect the recovery prospects of creditors.

The decision is dogmatically convincing but stands in tension with the economic expectation of the parties involved in subsidised lending – also raised by the defendant before the OLG Stuttgart – that the lien would continue to secure the loan claim even after the assignment. The transfer, fiduciary holding, and continued inclusion of the lien provided for in the KfW’s AB-EKN underscore this expectation. However, the OLG Stuttgart reaches a different result in this regard and emphasises that the property law limitations of accessory security interests cannot be overcome.

IV. Conclusion and Practical Guidance

The OLG Stuttgart has granted leave to appeal to the BGH on account of the fundamental significance of the matter. The appeal has since been filed and is pending before the BGH under case number XI ZR 46/26. A ruling by the highest court is desirable for practice, as the question arises in a multitude of subsidised loan relationships.

Until then, affected institutions should not rely on the house bank’s GTC lien continuing to secure the claim assigned to KfW, but must instead take proactive structuring measures themselves. The decision makes clear that the widely assumed automatic transfer of the GTC lien upon assignment of loan repayment claims to development banks does not correspond to the legal position. It also shows that fiduciary holding of accessory liens for a third-party claim holder is not possible.

For banks and development institutions, the decision is not a mere dogmatic detail but a direct indication of potential security gaps in existing and future subsidised loan structures. The following is therefore recommended for banks:

• Existing subsidised loan agreements should be reviewed to determine whether assigned claims are actually individually secured or merely covered by a broad security purpose declaration in favour of the house bank.
• If the development bank is to be secured by a lien, a specific agreement involving the development bank is required. A mere security agreement between the house bank and the borrower does not create a lien in favour of the development institution.

This article was prepared in collaboration with our research assistant Christian Rühl.

Statutory rules governing dividend entitlement

Under the wording of the statute, however, the dividend entitlement attaching to new shares issued in a capital increase is a complex matter. The new shares are intended to carry only a pro rata entitlement for the current financial year, depending on the date and amount of the contribution made. That entitlement is to be calculated by reference to an advance dividend of 4 % of the contribution paid. The articles of association or, where applicable, the resolution on the capital increase may, however, provide otherwise. Existing shareholders whose share of the aggregate dividend is thereby reduced are protected by their subscription rights. Where subscription rights are excluded, their interests are deemed to have been adequately taken into account by the requirements governing the exclusion of subscription rights. It is nevertheless disputed in the legal literature whether this applies without restriction to retroactive dividend entitlement for a financial year that has already ended.

Market practice

In practice, new shares regularly carry retroactive dividend entitlement. This is because, in a listed stock corporation, new shares can generally be placed successfully with investors only if they are fungible (i. e. interchangeable) with the existing shares and can be sold at any time in liquid trading on a stock exchange. This applies in particular where subscription rights are excluded on a simplified basis, since the placement price for the new shares may not be materially below the stock market price of the shares already issued. Such a placement price can be achieved only if the new shares have the same rights and characteristics as the existing shares. The same considerations apply where the capital increase takes place at a time when the shareholders’ meeting has not yet resolved on the distribution of profit for a financial year that has ended and, consequently, on the relevant dividend distribution.

The decision of the Higher Regional Court of Munich

In a decision dated 28 May 2026, the Higher Regional Court (Oberlandesgericht – OLG) of Munich held that a capital increase was not registrable where it was resolved on the basis of authorised capital with a simplified exclusion of subscription rights and provided for the new shares to carry a retroactive entitlement to profits for a financial year that had ended. The shareholders’ meeting had not yet resolved on the appropriation of the profit for that financial year.

In the Court’s view, this constellation did not provide existing shareholders with sufficient protection against the impairment of their rights; a claim for damages would not suffice for this purpose. In particular, the Court criticised the fact that the interference with the existing shareholders’ entitlement to profits was compensated neither by a subscription right with respect to the new shares nor otherwise. The management board resolution on the capital increase also gave no indication that the objective justification for the exclusion of subscription rights had been examined. The management board must undertake that examination when exercising an authorisation to carry out a capital increase out of authorised capital and must weigh the interests of the company and the existing shareholders in relation to the exclusion of subscription rights and the proposed retroactive dividend entitlement.

The successful parallel case in Munich

It is noteworthy that, almost in parallel with the case underlying the Higher Regional Court’s decision, the commercial register in Munich registered a capital increase out of authorised capital with a simplified exclusion of subscription rights and dividend entitlement for the new shares in respect of a financial year that had ended. The difference between the two cases is that, in the successful case, the management board resolution contained a brief statement explaining why the management board considered the exclusion of subscription rights necessary and proportionate. It referred to a prompt strengthening of the equity capital base with a view to planned investments.

Summary and assessment

The decision of the Higher Regional Court of Munich is surprising not only because it conflicts with market practice and the long-standing practice of many commercial registers. It also disregards the fact that the legislature expressly declared the exclusion of subscription rights to be permissible “in particular” where the requirements of section 186(3), sentence 4, AktG are met. Accordingly, up to the statutory cap, initially 10 %, any uncertainty as to whether the exclusion of subscription rights required sufficient objective justification had been deliberately put to rest. In the ZuFinG, the legislature even increased the permissible amount of such a capital increase with a simplified exclusion of subscription rights to 20 % and confirmed the “established practice”, particularly where authorised capital is used. Unfortunately, the Court’s decision also fails to address the economic prerequisites for a successful short-term placing of shares on the capital market and the need for the new shares to be fungible with the shares already traded on the stock exchange.

In practice, this means:

• A capital increase resolved on by the shareholders’ meeting with retroactive dividend entitlement (a so-called direct resolution) should not be problematic.

• Likewise, even in light of the Higher Regional Court of Munich’s decision, a capital increase out of authorised capital with retroactive dividend entitlement for the new shares should be registrable if the shareholders are granted their statutory subscription rights.

• In the case of a capital increase out of authorised capital with a simplified exclusion of subscription rights, the management board resolution on the capital increase should set out sufficient objective reasons for excluding subscription rights and balance those reasons against the interests of existing shareholders, particularly where the new shares are to carry a retroactive dividend entitlement.

• The proposed capital measure, in particular the resolutions to be adopted by the corporate bodies, should be co-ordinated with the competent commercial register fairly in advance.

Further information:

• Higher Regional Court of Munich, decision dated 28 May 2026 – 31 Wx 82/26e – NZG 2026, 105

• de Boer, AG 2026 (forthcoming)

Initial indications of the likely regulatory priorities can be derived in particular from the underlying Fitness Check, the feedback received from the completed public consultation, and the Commission’s ongoing impact assessment. This article provides an overview of the background and potential content of the DFA and identifies the action items that may arise for affected companies.

I. Background to the Digital Fairness Act

The starting point for the planned Digital Fairness Act is the question of whether existing European consumer protection law still adequately accounts for the particularities of digital business models. A key basis for this is the Fitness Check published by the Commission in October 2024. The examination focused in particular on the Unfair Commercial Practices Directive (UCPD), the Consumer Rights Directive (CRD) and the Unfair Contract Terms Directive (UCTD). The Commission concluded that the existing requirements, due to their principle-based and technology-neutral design, are fundamentally applicable to digital scenarios as well. At the same time, however, gaps have emerged with regard to newer business models and problematic digital practices, as well as deficits in the consistent enforcement of existing rules (we reported in Data Protection Update No. 211).

Following this review, a public consultation including a Call for Evidence was launched on 17 July 2025. The original deadline of 9 October 2025 was extended to 24 October 2025. A total of 4,324 valid responses were received, which the Commission has evaluated. The Commission’s impact assessment is currently still ongoing. The responses received highlighted in particular the differing interests of the stakeholders concerned. From a consumer protection perspective, there is a need for further requirements regarding, for example, manipulative purchasing incentives, non-transparent pricing and the protection of vulnerable consumer groups. The European umbrella organisation BEUC and the Federation of German Consumer Organisations (VZBV) have accordingly advocated an ambitious design of the DFA.

By contrast, the games industry, among others, warns against additional regulation. Providers of free-to-play games such as Supercell and InnoGames see the risk that further requirements could undermine the economic viability of advertising-funded business models without creating corresponding added value for consumers. Among other things, it is criticised that the additional display of real-money prices for virtual items would not necessarily lead to greater transparency but could rather create artificial benchmarks. Furthermore, an existing enforcement deficit is pointed out: what matters is not so much the creation of further regulations but rather their consistent enforcement vis-à-vis all market participants, especially providers from third countries.

II. Expected Regulatory Content

The specific requirements that the Digital Fairness Act will contain cannot yet be conclusively assessed. However, indications of the potential design can be derived from the Commission’s Work Programme and the deficits identified in the Fitness Check. The focus is accordingly on four main thematic areas: manipulative design elements, lack of transparency in personalised offers, product design aimed at maximising usage time or spending, and influencer marketing. In addition, it is emerging that the Commission intends to review certain information obligations for companies and, where appropriate, simplify or reduce them.

Particularly concrete is the discussion around so-called dark patterns. These are design elements that can induce or push consumers into decisions they would not have made without the specific design. Examples include pre-selected paid add-on services, artificially created time pressure through countdown displays, or cancellation processes that are significantly more complex than the preceding contract conclusion. Such practices are already captured under existing law, namely through Art. 25 DSA as well as through Sections 3(2) and 4a of the German Unfair Competition Act (UWG), with the requirements of Art. 25 DSA feeding into the UCPD as a standard of professional diligence. The Higher Regional Court of Bamberg, in its final judgment of 5 February 2025 (Case No. 3 UKl 11/24 e), concerning the promotion of ticket insurance during the ordering process, held that the combination of “framing”, “nagging” and a misleadingly labelled rejection button violated Art. 25(1) DSA and Sections 3(2) and 4a(1) sentence 2 no. 3 UWG, whereas the isolated colour highlighting of the offer was not sufficient for this purpose. The DFA will need to provide, above all, concretisation and delineation from the DSA. It could provide more specific criteria and thus greater legal certainty.

The implications would be cross-sectoral and would in principle affect all digital offerings involving consumer contact, from online shops to booking platforms to subscription services.

A further regulatory focus is likely to be the transparency of data-driven personalisation. Where prices, product recommendations or the presentation of offers are adjusted based on individual user behaviour, the DFA could oblige companies to more clearly disclose these practices. Such requirements would particularly affect providers that use algorithmic systems for pricing or personalisation. This applies, for example, to e-commerce, the travel and mobility sector, and comparison and intermediary portals.

The discussion about product design deliberately aimed at maximising usage time or increasing spending has also gained importance. The focus is particularly on digital mechanisms that influence user behaviour or increase willingness to spend. A particularly illustrative example is the use of virtual currencies in computer games. Consumer advocates criticise that the conversion of real money into virtual currencies such as coins or gems can obscure the actual price of content. Multi-tiered currency systems and package sizes not aligned with the price of individual content items can further amplify this effect. In addition to game and app providers, social networks and streaming services could also be affected by corresponding regulations, insofar as they use comparable voucher, tipping or payment systems. A particular focus is on the protection of minors, who account for a significant portion of the users of such offerings.

Further possible regulatory areas concern influencer marketing and the transparency of corresponding advertising measures. In addition, requirements can be expected to ensure simple and easily accessible cancellation of digital contracts. At the same time, the DFA could aim to harmonise existing information obligations and reduce them in certain areas in order to relieve companies of unnecessary or redundant requirements.

The potential scope of the DFA is thus broadly defined. What matters is not membership in a particular sector but rather the specific design of the digital interaction with consumers. In addition to e-commerce and platform operators, those potentially affected therefore include, among others, software-as-a-service providers, financial and insurance companies with digital distribution channels, and companies using data-driven online marketing.

A further point concerns enforcement. In 2026, the Commission is reviewing the CPC Regulation. Under discussion are, in particular, centralised investigation and enforcement powers at EU level, which could enable more consistent prosecution of cross-border infringements. For companies, this means that substantive new rules and strengthened enforcement structures need to be considered together.

III. Recommendations for Action

Even without a draft in hand, sensible preparations can already be made. An initial step would be to take stock of one’s own digital consumer interfaces. Companies should assess at which points selection, consent and cancellation processes are designed in a way that could later be classified as pressuring or misleading. Particular attention should be paid to order flows, cookie banners and the question of whether a subscription can be terminated just as easily as it can be concluded.

In addition, companies should identify and document where in their offerings personalisation based on personal data occurs, whether in pricing, recommendations or placements. The purpose and criteria of this personalisation should be documented and reviewed as to whether they can be presented to consumers in a comprehensible manner. This regularly requires cooperation between legal, IT and product departments.

Companies with gaming, app or community offerings should additionally assess at an early stage the extent to which their monetisation and engagement mechanisms need to be evaluated from the perspective of addictive design, paying particular attention to the protection of younger users.

Finally, it is advisable to follow the further legislative process and to make use of existing opportunities for participation. Since an enhancement of enforcement instruments, particularly the CPC network and collective enforcement mechanisms, is to be expected, early and structured engagement not only provides legal certainty but can also create a competitive advantage.

IV. Conclusion

The Digital Fairness Act is still at the beginning of the legislative process. The consultation has been completed, the Commission’s impact assessment is ongoing, and the proposal is expected for the fourth quarter of 2026. The general direction is thus foreseeable. For companies, the DFA does not represent a complete overhaul of consumer protection law but rather a tangible concretisation of existing obligations in areas where, until now, general clauses and the standards of Art. 25 DSA applied.

Those who review their digital processes, interfaces and data-driven offerings at an early stage can use the time remaining until the expected proposal to identify adjustment needs and implement them without time pressure.

This article was created in collaboration with our student employee Emily Bernklau.

Digitalisation

In the future, text form (Textform) is to become the default – for example, for membership applications, minutes, member loans, and register filings. In addition, virtual and hybrid meetings of the management board and supervisory board will be permitted, as will a digitally conducted founding assembly; the Fourth Bureaucracy Relief Act (Viertes Bürokratieentlastungsgesetz) of 2024 had already paved the way for this.

Increasing Attractiveness

Measures to increase attractiveness include differentiated rules for investing members, the possibility of suspending a management board position during maternity protection, parental leave, care obligations, or illness, and a standard deadline of 20 working days for entry in the cooperative register. Whether this deadline will actually accelerate formations depends, however, on whether the accompanying steps – notarial pre-examination and standardised formation opinions – also proceed more quickly in practice.

Prevention of Abuse

Noteworthy is the expansion of abuse prevention: the draft clarifies that a pure capital investment does not constitute a permissible promotional purpose (Förderzweck), and prohibits the shelf formation of cooperatives – both reactions to dubious capital investment cooperatives. Furthermore, the rights of the auditing association (Prüfungsverband) are expanded, up to and including an obligation to inform BaFin in cases of endangerment. This strengthens preventive control without unduly burdening legitimate cooperatives.

Changes Compared to the Ministerial Draft

The government draft goes beyond the ministerial draft in several key respects: the obligation to make additional contributions (Nachschusspflicht) is changed from a mandatory to an optional provision of the articles of association; a new Section 69 GenG-E systematically reorganises the registration of the member list; and the data protection level for inspection of the member list is significantly raised.

At the same time, details have been adjusted – for example, the threshold for binding the management board to instructions has been lowered from 1,500 members in the original ministerial draft to 150 members, and a statutory ceiling of 50 percent has been introduced for investing members. These adjustments are convincing, as the originally proposed, significantly higher thresholds could have structurally endangered cooperative self-governance and member democracy.

Conclusion

A critical point is that the new regulation reaches a regulatory density in certain areas – such as the administrative offence provisions and data exchange between supervisory authorities – that is rather foreign to the traditionally lean cooperative law. On balance, however, the draft is convincing as a measured and practice-oriented further development that makes the cooperative legal form fit for the future without abandoning its fundamental principles.

1. Stricter Requirements for Member Expulsions

Key point

General-clause-type grounds for expulsion in the articles of association may be invalid.

The Bad Salzungen Local Court (AG Bad Salzungen) declared an expulsion resolution void because the (widely used) articles-of-association provision – conduct that “is incompatible with the interests of the cooperative” – was too indefinite. In addition, the court criticized that the expulsion resolution’s reasoning was not sufficiently substantiated.

Recommendation

• Review your articles of association for general-clause-type expulsion provisions – these are commonly found in model articles of cooperative associations.
• Formulate grounds for expulsion as concretely and specifically as possible.
• In expulsion resolutions, the allegations must be described specifically enough that the affected member can adequately defend themselves.

2. Consumer Right of Withdrawal upon Joining a Cooperative – Open Questions

Key point

The Federal Court of Justice (BGH) has referred questions to the European Court of Justice (ECJ) concerning the scope of the right of withdrawal for distance contracts.

The question concerns whether, upon withdrawal from membership in a cooperative that is already in liquidation, the member’s capital contribution must be repaid in full – or whether the principles of the defective company (“fehlerhafte Gesellschaft”) apply, which grant only a settlement claim as of the date of withdrawal.

Recommendation

• When advertising long-term investment models (e.g., retirement provision), ensure proper withdrawal notices in accordance with the Financial Services Distance Marketing Directive.
• Monitor the ECJ’s decision – a consumer-friendly interpretation could create significant financial risks for cooperatives in liquidation.

3. Election Rules: Electoral Districts with Their Own Signature Quorums Permissible

Key point

The Munich Higher Regional Court (OLG München) confirmed that, for representative elections, establishing electoral districts each with its own signature quorum is permissible.

The statutory maximum quorum of 150 signatures (Section 43a(4) sentence 6 of the German Cooperatives Act (GenG)) applies per electoral district, not cooperative-wide.

Recommendation

• Cooperatives with large memberships may introduce election rules with electoral districts and separate quorums.
• However, due to the cooperative-law duty of loyalty, members must be given the opportunity – for example, through notices posted at branch offices – to gather supporters for election proposals.
• Where there is a legitimate interest, there is a right to a copy of the portions of the membership list concerning the members entitled to vote in the relevant electoral district.

4. Tax Risks from Atypical Membership Forms

Key point

The introduction of “solidary members” without voting rights led to the loss of corporate income tax exemption.

The Berlin-Brandenburg Fiscal Court (FG Berlin-Brandenburg) ruled that the Cooperatives Act recognizes only two forms of membership: ordinary members with full rights, and investing members under Section 8(2) GenG. A membership form entitled to promotional benefits but without voting rights is impermissible.

Recommendation

• Refrain from creating membership categories outside the statutory framework.
• For housing cooperatives, rental income from investing members exceeding 10% of total income can jeopardize the tax exemption under Section 5(1) No. 10 of the Corporate Income Tax Act (KStG).
• The Federal Fiscal Court (BFH) has allowed an appeal on points of law – a definitive ruling by the highest court is still pending.

5. Hidden Profit Distribution for Private Expenses

Key point

Expenses for members’ private living expenses (travel, entertainment, leisure activities) constitute hidden profit distributions.

The promotion of members must functionally result from the cooperative’s joint business operations. For example, at an IT services cooperative, trips to Mallorca and visits to animal parks bear no relation to the company’s business purpose.

Recommendation

• Critically review whether expenses have a functional connection to the business operations and the promotional purpose.
• Social and cultural promotion is only permissible if it takes place through a joint business operation (e.g., school cooperatives, sports cooperatives).
• The cooperative legal form offers no protection from general tax law principles.

6. State Supervision of Auditing Associations: Limits on Intervention Powers

Key point

State supervision under Section 64 GenG is purely legal supervision (“Rechtsaufsicht”) and may not issue technical/substantive directives regarding audit practice.

The Mannheim Higher Administrative Court (VGH Mannheim) clarified that detailed orders regarding future audit activity exceed the limits of legal supervision. However, the determination of legal violations, as the mildest supervisory measure, is permissible.

Recommendation for Auditing Associations

• Compliance with internal audit guidelines is monitored.
• Reviewing the promotional purpose is the main objective of every mandatory cooperative audit – formal findings alone are not sufficient.
• In cases of serious breaches of duty, the right to convene an extraordinary general meeting can become an obligation.

Conclusion for Practice

The 2025 case law makes clear: the cooperative legal form requires careful attention to the specific requirements of cooperative law. The promotional purpose and members’ rights are not mere formalities, but form the standard of review for the drafting of the articles of association, management, and tax treatment.

Do you have questions about the design of your articles of association, membership forms, or regulatory requirements under cooperative law? Dr. Thomas Kreuz, LL.M., advises cooperatives, their governing bodies, and auditing associations on all matters of cooperative law – please feel free to contact us.

I. Transparency Obligations under Art. 50 AI Act

From 2 August 2026, the transparency obligations of Art. 50 of the AI Act will apply. Unlike the other provisions of the AI Act, this provision is not based on the risk classification of the system, but instead generally covers AI systems that interact with humans or generate content for them. Both providers and deployers of such systems are subject to obligations.

Providers must design AI systems intended for direct interaction with natural persons in such a way that users are informed that they are interacting with an AI (para. 1). If a system generates synthetic audio, image, video, or text content, it must also ensure that the outputs are marked in a machine-readable format and are recognizable as artificially generated or manipulated (para. 2). Deployers, on the other hand, are subject to a disclosure obligation where they distribute deepfakes or publish AI-generated texts in order to inform the public about matters of public interest (para. 4). Pursuant to para. 5, the disclosure must be made clearly and distinctly, at the latest at the time of the first interaction or perception.

The Code of Practice on Transparency of AI-Generated Content of the European Commission serves as an implementation aid. For providers, it generally provides for a multi-layered labelling approach consisting of digitally signed metadata and an imperceptible watermark, supplemented by a detection solution that must be made available free of charge to authorities, media, and research institutions. For deployers, it contains requirements regarding the design and placement of the label; an EU icon is available for free use, which distinguishes between fully AI-generated content and content that has merely been AI-modified. The code is not legally binding and, even where fully complied with, does not constitute conclusive proof of conformity, but it is likely to be used as a benchmark in supervisory practice.

Finally, it should be noted that the postponement of the AI Act's application deadlines regulated under the Digital Omnibus does not, in substance, affect the transparency obligations under Art. 50 AI Act (we reported on this in Datenschutzupdate No. 256; the regulation of 8 July 2026 can be found here; it entered into force on 27 July 2026). These obligations continue to apply unchanged from 2 August 2026. Only for providers of generative AI systems that have already placed their systems on the market before that date is a transitional period provided for implementing the technical labelling measures under para. 2, running until 2 December 2026. Companies should therefore not assume that the pressure to implement has generally eased as a result of the Omnibus.

II. Entry into Force of the e-Evidence Regulation

On 18 August 2026, the core provisions of Regulation (EU) 2023/1543 (the “e-Evidence Regulation”) will become applicable. For the first time, the regulation allows law enforcement authorities to request electronic evidence directly from service providers in other Member States, without having to take the previously customary route via European Investigation Orders or other mutual legal assistance requests.

The regulation is built around two core instruments. Using a European Production Order (EPOC), judicial authorities can require the transmission of electronic data. The deadline is generally ten days, or just eight hours in emergency cases. The European Preservation Order (EPOC-PR), on the other hand, requires the provisional preservation of data for an initial period of 60 days in order to prevent its deletion or alteration pending a later production order.

The substantive requirements depend on the category of data concerned: while subscriber data can generally be requested in the case of any suspected criminal offense, access to traffic and content data requires an offense punishable in the issuing state by a custodial sentence of at least three years, or certain internet-related offenses.

The scope of addressees is broad. The concept of “service provider” under Art. 3 No. 3 of the e-Evidence Regulation follows a functional approach and covers, in addition to traditional telecommunications companies, messenger and email services, domain name and IP service providers, as well as other information society services. The latter already include platforms with a merely integrated communication function, such as online marketplaces with messaging systems or gaming offerings, as well as cloud and hosting services where data storage or processing forms an essential part of the service. Even ostensibly free-of-charge services fall within the scope, since data-driven business models satisfy the requirement of remuneration.

III. Reporting Obligations under Art. 14 CRA

The Cyber Resilience Act (“CRA”) establishes, for the first time, binding cybersecurity requirements for products with digital elements. The regulation will not become fully applicable until 11 December 2027 (as we reported in Data Protection Update No. 243). However, the reporting obligations under Art. 14 CRA already apply from 11 September 2026 and are therefore the first set of obligations that manufacturers must comply with in practice.

The CRA is addressed to all economic operators that make products with digital elements available on the Union market. The focus of the regulation is on manufacturers. These include not only traditional hardware producers, but also software providers and companies that market products under their own brand. According to the European Commission’s FAQ, both standalone software and firmware, as well as numerous hardware products, may be covered, while pure websites and standalone SaaS offerings generally do not fall under the CRA, unless they are part of a remote data processing solution that forms part of a product with digital elements. The reporting obligations under Art. 14 CRA apply exclusively to manufacturers.

In terms of content, Art. 14 CRA requires the reporting of two types of events: actively exploited vulnerabilities in a product with digital elements, and serious security incidents affecting its security. Reporting takes place in stages, via a single reporting platform, to the competent CSIRT and to ENISA. First, an early warning must be submitted within 24 hours of becoming aware of the event; within 72 hours, this is followed by a vulnerability or incident notification containing further details on the nature, impact, and remedial measures taken. A final report must be submitted within 14 days of the notification in the case of vulnerabilities, and within one month of the 72-hour notification in the case of security incidents. In addition, affected users must be informed of the incident and any necessary corrective measures.

For practical implementation, in addition to the CRA FAQ, which is maintained as a continuously updated document, the implementing provisions on the technical design of the reporting procedure should in particular be consulted.

IV. Obligation to Provide Access under Art. 3(1) Data Act

The Data Act has already applied since 12 September 2025. However, pursuant to Art. 50(3) of the Data Act, the obligation to provide data access by design under Art. 3(1) of the Data Act only applies to connected products and related services placed on the market after 12 September 2026. Existing products remain unaffected in this respect. By contrast, the user’s right of access against the data holder under Art. 4(1) of the Data Act could already be asserted from September 2025.

Art. 3(1) of the Data Act requires that connected products and related services be designed, manufactured, and provided in such a way that the datagenerated through their use is, by default, easily, securely, and free of charge accessible to the user, and in a comprehensive, structured, commonly used, and machine-readable format. Where relevant and technically feasible, access must be possible directly from the product or service. The manufacturer is the addressee of this obligation. Since this requirement must already be taken into account during product development, it affects product architecture, interfaces, and data formats, and can generally not be retrofitted without significant effort. It is supplemented by the pre-contractual information obligations under Art. 3(2) and (3) of the Data Act, which require, among other things, information on the type, scope, and format of the data generated, as well as on the ownership of trade secrets.

V. Recommendations for Companies

1. Clarify Whether You Are Affected

The new obligations are tied to roles that do not always correspond to a company’s previous self-classification. A company that merely has a chatbot developed for it and deploys it under its own name may qualify as a provider under the AI Act. A platform with a mere messaging function may be a service provider (e-Evidence). Pure software providers are also manufacturers (CRA). Companies should therefore review their product and service portfolio and determine, for each offering, which obligations apply. In corporate group structures, it must additionally be clarified which company is subject to the obligation and who implements it operationally.

2. Initiate Technical and Organizational Implementation in Good Time

Many of the requirements cannot be caught up on short notice. Labelling solutions for AI-generated content, data access interfaces in connected products, or processes for vulnerability detection must be developed, tested, and integrated into existing systems. Likewise, templates and standard wording for notices and reports should be prepared in advance, and contracts and product information should be adapted. Where deadlines are short – for example, eight hours for production orders in emergency cases, or 24 hours for the early warning in the case of actively exploited vulnerabilities – an established process is more important than a detailed procedural description.

3. Assign Responsibilities and Document Implementation

The obligations are spread across product development, IT security, legal, marketing, and communications. Companies should determine which function is responsible for which requirement, and who is reachable and authorized to make decisions at short notice in the event of an order or an incident. For the e-Evidence Regulation, the designation of an addressee is in any case a statutory requirement. Measures taken and the underlying considerations should be documented in a traceable manner, so that they can be demonstrated to authorities and contractual partners. Since the Commission’s guidelines, codes of conduct, and FAQs are continuously being supplemented, and further changes are foreseeable under the Digital Omnibus, a regular review of the implementation status is recommended.

VI. Conclusion and Outlook

August and September 2026 will bring companies with digital products and services a number of directly applicable obligations. Despite differing regulatory objectives, the implementation requirements overlap: they concern product design, technical interfaces and labelling solutions, internal reporting and response processes, as well as accompanying documentation. Companies that have so far dealt with these issues separately should consider whether effort can be reduced by taking a joint approach.

At the same time, the legal situation remains in flux. Key concepts have so far been clarified neither by the courts nor conclusively specified through regulatory guidance, and further changes are on the horizon under the Digital Omnibus, the final shape of which cannot currently be foreseen. In practice, this means that compliance frameworks should be designed to be adaptable and reviewed at regular intervals.

This article was created in collaboration with our student employee Emily Bernklau.

In the underlying proceedings, Diagramm Halbach marketed patient wristbands made of thermoplastic resin that had been manufactured by Zebra Technologies. The patient wristbands were supplied blank and could be individually printed with patient data (name, date of birth, barcode). The wristbands did not bear a CE marking under the MDR. Zebra’s promotional materials, however, emphasised that the wristbands enabled staff to check the “five rights” at the patient’s bedside (the right patient, the right medication, the right dose, the right time and the right route of administration) and that using the wristbands could improve patient safety, in particular in connection with the administration of medication, tests and procedures, blood transfusions and sample collection. The material also contained data on the statistical frequency of identification errors and their consequences.

Zentrale, the German trade association for combating unfair competition, brought claims for injunctive relief, arguing that the wristbands – at least in combination with other products – served the monitoring, diagnosis and treatment of diseases and injuries and therefore fell within the scope of the MDR. Following a reference for a preliminary ruling from the Regional Court Bochum, the CJEU has now held that the patient wristbands at issue cannot be classified as a medical device.

I. Only Use-Related Manufacturer Information Is Relevant

The CJEU first clarifies that, while the relevant intended purpose under Article 2(12) MDR must be determined by reference to the data supplied by the manufacturer on the label, in the instructions for use, in promotional and sales material and in the clinical evaluation, not all of that data is necessarily material to that determination. According to the wording of the provision, only data that actually relates to the use of the product concerned is decisive. Contextual information that is merely useful and is intended to promote the sale of particular products, such as general statistics on treatment errors or generic references to benefits for patient safety, is therefore not material to determining the intended purpose. With regard to the patient wristbands, the CJEU explains that promotional material describing the wristbands solely in terms of their use for patient identification does not, in itself, provide any indication of a medical use.

II. Objective Limitation of the Intended Purpose

The CJEU further emphasises that the MDR does not define a medical device solely on the basis of how it is presented by its manufacturer. Unlike medicinal products under Article 1(2)(a) of Directive 2001/83/EC, the classification of a product as a medical device must also take into account whether that product is objectively capable of performing the specific medical functions listed in Article 2(1) MDR. The CJEU also justifies this approach on teleological grounds: some manufacturers might affix a CE marking under medical device law purely for marketing reasons. The objective functional test therefore acts as a corrective in both directions. It prevents manufacturers from circumventing the MDR by deliberately omitting any reference to a medical purpose, while also preventing excessive regulation of products whose actual function is not medical in nature. With regard to the patient wristbands at issue, the CJEU finds that they are objectively not capable, by themselves, of providing a medical service, even though they are used in a medical context. The patient wristbands were supplied unprinted and served a purely administrative purpose. The identification objective could equally be achieved by wearing a nameplate or another means of identification. This shows that the method of identification, as such, has no direct effect on the administration of medication, tests and procedures, blood transfusions or sample collection. All of the medical benefits depend on other factors – not on whether the patient is wearing a wristband.

III. Confirmation of the Snitem Case-Law

Finally, the CJEU reaffirms the distinction between administrative and medical products in its judgment in Case C‑329/16, Snitem and Philips France. The software at issue in that case did not perform solely administrative functions such as patient identification, but processed the data which had been fed into it and provided physicians with information to support their decisions. By contrast, a product that merely archives, collects and transmits data, such as pure data storage software or software indicating generic drug names, is not a medical device, even where it is used in a medical context. The distinction therefore continues to turn on whether a product merely archives, collects and transmits data or, beyond that, performs a specifically medical function.

IV. Conclusion and Outlook

The CJEU’s judgment is not surprising: it stands to reason that an unprinted wristband cannot objectively perform a medical function. Further, the classification is correct on the merits, as it consistently reflects the two-tier approach by the manufacturer’s information and objective functional capability adopted by the EU legislature. Nevertheless, the judgment is of considerable practical significance for manufacturers. First, the CJEU provides clarity that, even in a medical context, it remains permissible to promote products using contextual information, such as references to patient safety or error-rate statistics. It is also notable that the referring court found that some manufacturers of comparable patient wristbands had apparently affixed a CE marking under medical device law solely for marketing purposes, without the underlying products actually serving a medical purpose. Such conduct is not without legal risk. A manufacturer that adorns a product with a CE marking under medical device law without being able to demonstrate an actual clinical benefit and the required performance runs the risk of engaging in misleading conduct relevant under competition law and regulatory supervision. The same applies where a product has been certified as a Class IIa or IIb device by a Notified Body.

Second, by confirming the Snitem case-law, the judgment also opens up a welcomed perspective for the AI industry. For so-called medical scribes and other documentation tools that merely archive, collect and transmit data (for example, by transcribing doctor-patient conversations or automating medical documentation), the judgment confirms that such tools do not fall within the scope of the MDR, provided that they do not offer clinical decision support. However, as soon as software processes patient-related data and derives recommendations or guidance for the treating physician from it, it crosses the threshold into becoming a medical device.

This article was prepared in collaboration with our research assistants Carla Alpüstün and Sophia Heun.

The Bolar exemption has always sat at the intersection of patent law and pharmaceutical regulation. It allows companies to complete the regulatory steps required for market entry before patent expiry, so that products can be launched immediately afterwards. In the EU, the concept was codified in Article 10(6) of Directive 2001/83/EC, introduced by Directive 2004/27/EC in March 2004. Its application, however, has never been fully uniform, and Member States filled key gaps in different ways.

Under the agreed new framework, the Bolar exemption now expressly covers activities necessary for marketing authorisation, health technology assessment, pricing and reimbursement, and the submission of procurement tender applications. It also expressly extends to third-party suppliers and service providers. This redefines where regulatory preparation ends and infringing conduct begins.

I. The previous framework and its limits

Under the existing regime, the Bolar exemption covers studies and trials required for obtaining a marketing authorisation. That core scenario has never been the real difficulty. The challenges arose at the margins.

Member States diverged on several minor yet essential points when implementing the Directive. Some allowed a broader range of preparatory acts, including activities linked to pricing, reimbursement or non-EU approvals. Others took a narrower approach and limited the exemption more strictly to regulatory submissions for generics and biosimilars.

These differences shaped practical behaviour. They influenced where clinical trials were conducted, how supply chains were structured and also the timing when patent holders tried to obtain interim relief. Regulatory steps such as pricing applications or tender participation were, in some jurisdictions, treated as indicators of imminent infringement.

The distinction between the Bolar exemption and the research exemption was also partially blurred. The research exemption protects work aimed at generating new technical knowledge. The Bolar exemption serves a different function: It permits the use of patented inventions to meet regulatory requirements. In practice, the two may overlap, while they are not interchangeable. Where an activity primarily served regulatory purposes, reliance on the research exemption alone tended to prove not sufficient.

II. The new Article 85: a functional approach

Article 85 of the new directive adopts a functional approach. The goal is to harmonize the Bolar exemption across the EU and clarify its scope. It identifies the regulatory processes that justify the use of patented inventions and extends the exemption to the acts needed to complete them.

The provision expressly covers activities carried out for the purposes of obtaining a marketing authorisation, conducting health technology assessment, securing pricing and reimbursement approval, and submitting procurement tender applications. This reflects the reality of market entry. Regulatory approval, pricing decisions and procurement are closely connected. The revised framework treats them as such.

The exemption also extends to a broad range of acts, including manufacture, supply, storage, import, use and purchase, and related acts, where these are carried out exclusively for the permitted purposes. It expressly includes third-party suppliers and service providers. This aligns the legal framework with established industry practice.

All these activities need to be “necessary” and “exclusively” directed at the permitted purpose. This requirement introduces a functional test with room for interpretation. The limits will therefore be determined by how national courts interpret these terms in concrete cases. The central question will no longer be whether preparatory acts exist, but whether those acts are tied to a regulatory objective.

The directive further clarifies that intellectual property rights, as such, are not a valid ground for refusing, suspending or revoking decisions adopted in the relevant regulatory processes. This does not prevent patent enforcement. It does, however, reduce the relevance of regulatory conduct as a proxy for infringement and limits the role of regulatory procedures as leverage in patent disputes.

In a nutshell, the following activities will not constitute a patent or SPC infringement under the new rules:

• Carrying out health technology assessment.
• Obtaining approvals for pricing and reimbursement.
• Conducting studies, trials and other activities needed to obtain a marketing authorization for a generic or biosimilar, a hybrid or a bio-hybrid product.
• Fulfilling practical requirements linked to any of the above activities.
• Participating in procurement tenders for the sale of a medicinal product after the patent or SPC has expired.
• Any supporting activities for the abovementioned purposes, including the sale, offer, manufacture, use, purchase and import of the medicinal product or processes.
• Third-party suppliers and service providers who perform any of these activities benefit from the same protection.

Even though this sounds relatively clear and unambiguous, it makes sense to take a closer look at some aspects:

1. The outer limit: no placing on the market

The expansion of the exemption is paired with a clear limit. It does not extend to the placing of medicinal products on the market.

In straightforward cases, that boundary is clear. In practice, it will not always be. Large-scale manufacturing, stockpiling or binding commercial commitments may indicate that a company has moved beyond regulatory preparation. The assessment will turn on purpose and context. That is where the legal uncertainty now lies.

2. Procurement procedures and early competition

The inclusion of procurement tenders is one of the most consequential changes. Companies may now submit procurement tender applications before patent expiry, provided that this does not entail sale, an offer for sale or placing on the market during the protection period.

This brings competition forward in a decisive way. In many healthcare systems, tenders effectively determine market access, pricing and volumes well before the first unit is supplied. The practical consequence is that competitive positioning may be established before patent expiry, with the actual supply becoming a downstream step.

At the same time, the boundary is sensitive. The distinction between a permitted tender submission and a prohibited offer for sale is likely to become one of the central fault lines in future litigation. Tender structures that create binding supply obligations, or that exert economic or legal pressure to supply before expiry, may fall outside the exemption. The assessment will depend on the specific design of the procedure, the legal nature of the commitments and the economic reality of the arrangement.

3. Third parties and supply chains

Article 85 now expressly includes third-party suppliers and service providers. This addresses a long-standing uncertainty and reflects how pharmaceutical supply chains operate in practice.

The issue had been contentious in the past. The Astellas/Polpharma litigation illustrated the divergence within Europe. The Düsseldorf Higher Regional Court accepted that third-party conduct could fall within the exemption under certain conditions, while the Polish Supreme Court took a more restrictive view. The Court of Justice (CJEU - Case C-661/13: Request for a preliminary ruling from the Higher Regional Court of Düsseldorf) did not resolve the issue, as the case was settled before a ruling was delivered.

The new provision provides greater clarity: Contract manufacturers, API suppliers and research organisations may rely on the exemption where their activities serve regulatory purposes. That allows supply chains to be structured more flexibly across jurisdictions.

The focus will now shift to purpose and attribution. Where activities serve both regulatory and commercial aims, the scope of the exemption may lead to uncertainty.

4. Enforcement under the new framework

The reform changes the evidentiary landscape for patent enforcement before expiry. Regulatory acts such as pricing applications, reimbursement procedures, health technology assessment submissions or tender participation will generally carry less weight as indicators of imminent infringement where they fall within the Bolar exemption.

To initiate legal actions, patent holders will need to identify additional risks that go beyond these acts. Relevant indicators may include large-scale manufacturing, the creation of commercial stock or binding commitments anticipating supply before patent or SPC expiry. A regulatory dossier alone will no longer suffice.

This raises the threshold for interim relief and increases the importance of internal evidence. Production data, supply arrangements and internal planning documents will become central in assessing whether conduct remains within the permitted scope. However, this type of intelligence and documentation is notoriously difficult to obtain.

The interaction with the Unified Patent Court (UPC) adds a further layer. Logically, Article 27(d) UPCA refers to the Bolar exemption in Directive 2001/83/EC and therefore captures subsequent amendments. It is obvious that the UPC will apply the law as it currently stands. The revised provision will therefore serve as a benchmark in future UPC proceedings in which the Bolar exemption is invoked as a defence, and it is expected that the UPC will play a decisive role in shaping the interpretation of the new law, including its limits. Divergences between the UPC and national courts cannot be excluded, given that the exemption is set out in a directive and its precise contours depend on national implementation and interpretation.

5. Data exclusivity and parallel protection

The broader Bolar exemption now also allows generics to conduct studies and prepare regulatory submissions during patent protection, while it does not affect the EU data and market exclusivity regime. Under the revised framework, the standard period remains eight years of regulatory data protection followed by one year of market protection, with possible additional extensions under specific conditions (the revised 8+1(+1)(+1) system). Early regulatory preparation under the Bolar exemption therefore does not enable earlier market entry where those exclusivity periods apply.

III. Remaining questions

The revised framework is clearer than the previous regime, and it continues to evolve.

The territorial reach of the exemption remains open. It is not settled whether activities carried out in the EU for the purpose of obtaining marketing authorisations in third countries fall within its scope. The new Directive neither expressly includes nor excludes an extension of the Bolar exemption to trials and studies conducted in the EU for non-EU regulatory applications. The limited reference to Regulation (EU) 2021/2282 for HTA-related activities may indicate a more restrictive, EU-focused interpretation. This approach risks entrenching existing divergences among Member States. Under the current legal framework, such differences already exist: some Member States, such as Germany, extend the scope of the exemption to cover activities supporting applications outside the EU, while others, such as France, do not. It remains to be seen how Member States will implement the directive and change their existing national regimes.

Finally, the concepts of necessity and exclusivity, as already discussed above, will require further development. The grey area will lie where regulatory preparation and commercial planning overlap. This margin of interpretation allows for a certain extension of activities, provided that they can be justified as being linked to a regulatory objective.

IV. Practical consequences

The reform shifts the timing and structure of market entry.

For generic and biosimilar companies, the key change is the ability to align regulatory authorisation, health technology assessment, pricing and reimbursement procedures and public procurement tenders at an earlier stage. These processes can now be prepared in parallel and, in many cases, brought close to completion before patent expiry, enabling a coordinated day-one entry strategy. This requires an integrated organisation of regulatory, market access and supply functions. Industry participants should therefore anticipate earlier and more coordinated market entry dynamics, increasing both competitive pressure on originators and the need for integrated regulatory and commercial planning on the generic side.

All preparatory activities must be structured and documented to satisfy the exclusive-purpose requirement of the Bolar exemption. It is also advisable to review existing contracts with suppliers and service providers to take full advantage of the new legal certainty. Particular care is required in procurement contexts: tender participation must remain strictly limited to regulatory or administrative preparation and must not extend into pre-expiry commercial conduct or commitments that could be construed as market entry.

For suppliers, inclusion within the exemption provides legal certainty, provided that activities are strictly confined to permitted preparatory purposes. This requires clear contractual purpose limitation and documentation linking performance to regulatory, health technology assessment, pricing or procurement-related activities. Where services pursue mixed regulatory and commercial objectives, the application of the exemption becomes uncertain.

For originators, harmonisation provides greater legal certainty, even though the expanded scope of application may lead to earlier generic competition. Enforcement shifts away from regulatory filings as indicators of imminent market entry towards factual market preparation. This includes manufacturing scale-up, stockpiling, supply chain activation and early contractual structuring. Monitoring must therefore extend earlier in the value chain, with enforcement becoming increasingly fact-intensive and dependent on logistical and economic evidence.

Innovators should align their strategies with the new legal framework with a view to securing sufficiently long market exclusivity through patent protection, supplementary protection certificates and regulatory data and market protection. They must expect earlier generic and biosimilar market entry with corresponding earlier revenue erosion and should respond by strengthening patent portfolio strategies, reinforcing layered exclusivity positions and ensuring preparedness for rapid substitution once protection expires.

Conclusion

The revised Bolar exemption brings the legal framework closer to how pharmaceutical markets operate in practice. It enables earlier preparation, closer integration of regulatory and commercial planning and more predictable market entry.

At the same time, it shifts competition into the pre-expiry phase and sharpens the boundary between lawful preparation and infringement. Future disputes will turn on purpose, context and evidence. That is where the decisive questions will be resolved.

The revised Bolar exemption has not yet entered into force. Following formal adoption of the EU Pharmaceutical Package by the European Parliament and the Council, the relevant provisions of the new Directive will require transposition by the Member States. EU-wide application of the revised regime is therefore expected around 2028.

This article was created in collaboration with our research assistant Philipp Wiese.

While the provision has so far primarily set out abstract requirements, the European Commission is now specifying its practical implementation. Together with a new “Code of Practice on Transparency of AI-Generated Content,” the Commission published, on 10 June 2026, official EU icons for the first time, which can be used to label AI-generated or AI-manipulated content. The Commission makes the icons, together with further information on the practical implementation of the transparency obligations, publicly available on its official website.

I. Voluntary Code of Practice Instead of Binding Requirements

The Code of Practice, however, is expressly not binding law. The Code is designed to be voluntary and is intended to provide providers and deployers of generative AI systems with practical guidance on implementing the transparency obligations under Article 50 AI Act. The actual statutory labelling obligations continue to derive directly from the AI Act itself and apply from 2 August 2026.

Nevertheless, the new guidelines are likely to be of considerable practical significance. This is because, for the first time, the Commission is specifying here how it envisages the technical and visual implementation of the transparency obligations. This concerns, in particular:

• the design of labels,
• their visibility and placement,
• their permanent recognisability when shared or downloaded,
• as well as requirements regarding accessibility and machine-readable notices.

From 2 August 2026, Article 50 AI Act requires, in particular, clear labelling of:

• deepfakes,
• AI-generated or AI-manipulated image, audio, and video content,
• as well as certain AI-generated texts on matters of public interest.

In addition, users must be informed when they are communicating with interactive AI systems such as chatbots or virtual assistants.

II. The New EU Icons for Labelling AI-Generated Content

The newly published EU icons are intended to help make such content “clearly perceivable and distinguishable” to users as artificially generated or manipulated. In particular, the following are envisaged:

• a basic icon for general AI involvement,
• a label for fully AI-generated content,
• as well as a symbol for partially AI-manipulated content.

III. Voluntary Signing of the Code of Practice

Alongside the publication of the new transparency guidelines, the European Commission’s AI Office has explicitly invited providers and deployers of generative AI systems to voluntarily sign the “Code of Practice on Transparency of AI-Generated Content.”

By signing, companies express that they intend to take the standards contained in the Code into account going forward as practical guidance for implementing the transparency obligations under Article 50 AI Act. According to the Commission, this is intended not only to contribute to greater legal and planning certainty within the European Union, but also to noticeably reduce the subsequent compliance burden. The Commission’s announced supervisory practice deserves particular attention in this regard.

According to the Commission, signing the Code is intended to enable greater predictability, more legal certainty within the European Union, and a reduced administrative compliance burden. Future enforcement measures are intended to be primarily guided, with respect to signatories, by compliance with the Code. Companies that sign the Code of Practice could thereby benefit from a union-wide simplified and more harmonised compliance practice, regardless of the Member State in which they operate or which market surveillance authority they fall under.

According to the Commission, the signatories of the Code are to be publicly announced as early as July 2026, and thus even before the official date on which the transparency obligations under Article 50 AI Act take effect on 2 August 2026. For signing, the European Commission provides an official “Signatory Form.” Providers and deployers of generative AI systems can voluntarily support the Code by submitting the signed form to the AI Office and thereby join the transparency standard.

IV. Outlook

Although the European Union’s new Code of Practice remains voluntary, it is likely to significantly shape the practical implementation of the transparency obligations under Article 50 AI Act going forward. Signing can offer advantages in terms of legal and planning certainty, but at the same time may also raise expectations regarding a company’s own compliance. How strongly the Code will influence regulatory practice and market standards in the future remains to be seen.

I. Identifying Abusive Cease-and-Desist Notices

As a general rule, extensive cease-and-desist activity alone is not sufficient to establish an abuse of rights, provided that numerous competition-law infringements are genuinely at issue at the same time. Where many competitors are infringing competition-law provisions, a company must have the ability to pursue these infringements by way of multiple cease-and-desist notices.

A finding of abuse of rights requires additional circumstances indicating that the cease-and-desist notices do not primarily serve the fairness of competition, but instead serve extraneous motives that constitute the actual driving force behind them. After all, the pursuit of competition-law infringements is, in principle, also in the interest of other market participants and of the public at large.

That said, even a single cease-and-desist notice can amount to an abuse of rights where there are sufficient indications that it predominantly pursues objectives other than the protection of competition. Such abuse is particularly likely where the party issuing the notice can barely be said to have any material economic interest in pursuing the competition-law infringement, yet nevertheless instructs counsel to issue a large number of cease-and-desist notices. This applies with particular force where, owing to limited financial capacity, that party could hardly bear the cost risk associated with the notices itself. An abusive enforcement of rights is further indicated where the scope and intensity of the cease-and-desist activity bear no reasonable relationship to the issuing party’s own actual commercial activity.

The law of unfair competition is specifically not intended to give companies the opportunity to act as general “guardians of competition,” independent of their own economic interests.

II. Why Deepfakes Could Provide a Basis for (Abusive) Mass Cease-and-Desist Campaigns

A significant risk of standardized cease-and-desist activity could develop in the future, particularly in relation to AI-generated content. This is because, similar to what has already been observed in e-commerce in relation to imprint, price-disclosure and information obligations, infringements of the labeling obligations imposed by the AI Act typically involve facts that can often be identified online without any great effort. Whether or not publicly accessible content has been labeled as AI-generated can regularly be established simply through a visual inspection of social media posts, websites, or advertising content.

A particular source of conflict is that the scope of the term “deepfake” does not yet appear to be conclusively settled. While the term is frequently understood to refer to deceptively realistic image or video content, a broader understanding of the concept is increasingly emerging. For example, the Wettbewerbszentrale (German Centre for Protection against Unfair Competition), in its guidance issued in February 2026, likewise emphasized that the labeling obligations are unlikely to be limited to fully photorealistic content alone. Rather, the obligations could already capture depictions that merely contain individual realistic elements or that are capable of creating an authentic impression among parts of the public.

It is precisely this lack of clarity that is likely to considerably increase the potential for cease-and-desist notices. The more broadly the term “deepfake” is construed, the greater the number of content items potentially subject to a labeling obligation. Those affected could therefore include not only professional media companies or major platform operators, but in particular also influencers, agencies, online retailers, small businesses, and content creators who use AI-generated content in advertising or public-facing communications.

At the same time, this creates structures typical of those already familiar from abusive mass cease-and-desist campaigns in digital commerce: easily identifiable online infringements, standardized review mechanisms, and a large number of potential respondents.

The situation would be even further-reaching if the labeling obligations became relevant not only for content published in the future, but also for deepfakes already uploaded in the past. Such an interpretation does not appear far-fetched. For content that remains publicly accessible, it could be argued that the infringement lies not solely in the original upload, but continues in the ongoing provision of an unlabeled deepfake in its current form. Should such an understanding prevail, the potential for cease-and-desist notices would expand considerably, since not only new publications but potentially also extensive existing content libraries could subsequently be reviewed and challenged.

III. Response Options and Defense Strategies Against Abusive Cease-and-Desist Notices

Where there are indications that a cease-and-desist notice is abusive, the recipient should not hastily comply with the claims asserted. Rather, it is advisable first to have the notice carefully reviewed as to whether it is justified at all. This is because an abusive cease-and-desist notice generally gives rise neither to a claim for reimbursement of the costs of the notice nor to any further-reaching claims arising from the cease-and-desist relationship. Nor, as a rule, do obligations to provide information or to respond arise in response to a factually unjustified notice.

A party wrongly subjected to a cease-and-desist notice is, moreover, not confined to a purely defensive response, but may itself take active steps against the abusive enforcement of rights. In particular, a counter cease-and-desist notice (Gegenabmahnung) may be considered. By means of such a counter notice, the recipient can, in turn, call upon the purported claimant to cease and desist, or can announce the filing of a negative declaratory action. Such a counter notice can be especially useful where it is to be expected that the party issuing the original notice will abandon its claims once the facts have been supplemented or the legal position clarified. This may be the case, for example, where the original notice was based on inaccurate facts, where material factual or legal aspects were not previously taken into account, or where the issuing party could not have recognized the recipient’s lack of responsibility for the alleged infringement.

A counter cease-and-desist notice can also be significant from a procedural perspective. If a negative declaratory action is filed immediately, without first giving the opposing party the opportunity to withdraw its claims, there is a risk of being ordered to bear the costs under Section 93 ZPO (German Code of Civil Procedure) if the opposing party immediately acknowledges the claim.

In addition, Section 13(5) UWG (German Unfair Competition Act) now expressly provides that a party wrongly subjected to a cease-and-desist notice may claim reimbursement of the expenses necessarily incurred in defending itself. While this does not automatically cover the full costs of a counter cease-and-desist notice, there are today considerably better options for defending oneself, including on economic terms, against unjustified cease-and-desist notices.

If an abusive cease-and-desist notice has already led to the conclusion of a cease-and-desist agreement (Unterlassungsvertrag), termination of the agreement for good cause under Section 314 BGB (German Civil Code) may also be considered. In individual cases, rescission on grounds of fraudulent misrepresentation under Section 123(1) BGB may also be possible. If the party that issued the notice demands payment of a contractual penalty despite the abuse of rights, this demand can generally be countered with the defense of abuse of rights. In addition, the recipient of the notice may, depending on the circumstances, also have its own claims for damages.

IV. Conclusion

With the AI Act’s new labeling obligations, deepfakes could become a significant competition-law risk. In particular, the ease with which potential infringements can be identified, the as yet unclear scope of the term “deepfake,” and the large number of potentially affected content items create risks of abuse. Should previously published content also come to be covered in the future, a considerable expansion of potential cease-and-desist activity looms. Companies, influencers, and content creators are therefore well advised to review AI-generated content and existing content libraries at an early stage for possible labeling obligations.

I. What Are Deepfakes?

The fundamental question is first what is to be understood by a “deepfake” within the meaning of the AI Act. The AI Act defines deepfakes as image, audio, or video content generated or manipulated by artificial intelligence that resembles existing persons, objects, places, or other situations and is thereby capable of creating the impression – particularly among technically unsophisticated persons – that the content is authentic or real. This captures, in particular, content that appears deceptively genuine and is therefore capable of concealing its artificial origin. At first glance, the definition seems comparatively clear: deepfakes are AI-generated content intended to appear real.

Upon closer examination, however, it quickly becomes apparent that the distinction between merely artificially generated content and content that actually triggers labelling obligations as a deepfake raises considerable uncertainties. In particular, it remains somewhat unclear how strictly the requirements of “similarity” to real persons and situations are to be understood. Additional uncertainty arises from the fact that it is already becoming apparent that the European Commission may interpret the concept of deepfakes rather broadly. This suggests that not only near-photorealistic content may be captured, but possibly also depictions that merely contain certain realistic elements or that could evoke an authentic impression in individual viewers. The boundary between clearly artificial fantasy depictions and labelling-obligatory deepfakes is thus increasingly blurred.

Furthermore, additional problems may arise in the practical classification of deepfakes. Whether a depiction qualifies as a deepfake is unlikely to be assessable in isolation based on image content alone. Rather, the specific context of use could play a decisive role. What could be particularly relevant is the purpose for which a depiction is used and what expectations are created among the relevant audience.

This becomes particularly apparent in the case of artistic or stylised depictions. For example, an AI-generated image of an oil painting with a portrait of a woman might, at first glance, not convey a realistic impression in the sense of an actual photograph. Compared to a photographic depiction, many viewers would recognise that it is an artificially generated or at least artistically altered representation. However, if such an image is used by a provider of oil paintings or art prints for advertising purposes, the perspective shifts. For technically and artistically unsophisticated viewers, the impression could well arise in this context that it is a depiction of an actually existing painting or a real work of art. The artificial generation of the depiction would then, from the perspective of the relevant public, potentially recede into the background. It is precisely this shift in perspective that illustrates the considerable legal uncertainty in interpreting the concept of deepfakes.

II. Who Can Be Subject to the New Obligations?

The determination of the nature and extent of transparency obligations will depend primarily on the distinction between the provider and the deployer (operator) of an AI system. Under the AI Act, a distinction must be drawn between providers of an AI system and deployers. A provider is assumed where the undertaking was actively involved in the development of an AI system or integrates an AI system into an already existing programme. By contrast, a deployer within the meaning of the AI Act is anyone who uses an AI system for their own purposes without the AI being further developed or offered as a separate product. As deployers, not only established companies are to be classified, but also sole traders, influencers, or small businesses can qualify as deployers with corresponding obligations. In a purely private context, however, no deployer status is assumed.

With regard to labelling obligations, it is primarily deployers who are affected: pursuant to Art. 50(4) AI Act (Art. 50 Abs. 4 KI-VO), they are obliged to disclose, in relation to deepfakes created by AI systems, that the content was artificially generated or manipulated.

III. Risk of Cease-and-Desist Actions: What Are the Consequences of Non-Compliance with Labelling Obligations?

While the AI Act itself already provides for severe sanctions for infringements of labelling obligations – under Art. 99(4)(g) AI Act (Art. 99 Abs. 4 lit. g KI-VO), fines of up to EUR 15 million or up to 3 % of total worldwide annual turnover may be imposed – it is particularly the competition-law risk that is likely to be of considerable practical relevance for deployers.

Of central importance here is the competition-law classification of the labelling obligations under Art. 50 AI Act. There is much to suggest that these provisions qualify as market conduct rules within the meaning of § 3a UWG (German Act Against Unfair Competition). Under § 3a UWG, anyone who contravenes a statutory provision that is intended, at least also, to regulate market conduct in the interest of market participants acts unfairly, provided the contravention is capable of appreciably impairing the interests of consumers, other market participants, or competitors. What matters, therefore, is not only whether a norm has a regulatory character, but also whether it simultaneously serves a competition-related protective function. This is precisely what is likely to be the case with the labelling obligations under Art. 50 AI Act.

The provisions evidently pursue the objective of ensuring transparency in the market and protecting consumers from being deceived about the origin or authenticity of content. Users should be able to recognise whether they are interacting with AI-generated or manipulated content or whether it is authentic human communication or genuine image, audio, or video content. Art. 50 AI Act thus does not merely aim at the abstract regulation of AI systems, but specifically at steering the market conduct of undertakings in competition. The labelling obligations directly influence the manner in which undertakings may present their products, services, and communication measures on the market.

In addition, the rules also serve the protection of fair competitive conditions. Undertakings that properly label AI-generated content could be at a competitive disadvantage vis-à-vis market participants who deliberately forgo labelling in order to make content appear more authentic, credible, or emotionally impactful. Particularly in the areas of advertising, social media communication, and audiovisual content, the failure to disclose AI-generated content can confer significant competitive advantages.

Against this backdrop, it is reasonable to regard Art. 50 AI Act as a provision that not only protects individual interests but also aims to ensure a level playing field. If Art. 50 AI Act is accordingly classified as a market conduct rule, this would have significant practical consequences. Infringements of the labelling obligations could then simultaneously constitute unfair commercial practices under § 3a UWG and thus be enforced under private law. Competition-law claims can be asserted not only by supervisory authorities and consumer protection associations, but in particular also by trade associations and competitors. It is especially the latter that carries considerable escalation potential, since infringements of labelling obligations are comparatively easy to identify and thus attractive targets for competition-law enforcement measures. Conceivable measures include, in particular, injunctive relief, cease-and-desist letters (Abmahnungen), and applications for interim injunctions.

The Wettbewerbszentrale (Centre for Protection Against Unfair Competition) stated in its guidance published in February 2026 that infringements of the AI Act’s labelling obligations can simultaneously constitute unfair commercial practices within the meaning of the UWG. At the same time, it draws attention to the specific risk that competitors and associations will assert injunctive relief claims where the use of unlabelled or insufficiently labelled AI content impairs fair competition. Against this background, there is a considerable likelihood that, in particular, unlabelled deepfakes will increasingly become the subject of competition-law cease-and-desist actions and court proceedings in the future.

On average, 18 Member States participate in each project. Ukraine participates in four of the five projects, and Norway may also participate. The proposal is not yet final: the Council must now deliberate on the formal establishment of the EDPCIs. Once adopted, the projects become eligible for EU funding through EDIP and potentially further support under the future European Competitiveness Fund.

1. What has been proposed?

The five projects are:

DronE and Counter Drone – European Resolve (DECODER)

• Focus: Development, scaling and deployment of interoperable European drone and counter-drone capabilities, including a European network of drone technology hubs. Involves 26 EU Member States, Norway and Ukraine.
• Estimated financial size: EUR 3.5–5 billion by 2033

Integrated Maritime and Seabed Defence (IMSD)

• Focus: Maritime domain awareness, naval combat, maritime interdiction, underwater and seabed warfare, and protection of ports, offshore installations, cables and pipelines.
• Estimated financial size: EUR 43–72 billion by 2045

SPACE

• Focus: Space-based early warning, SATCOM, ISR/SIGINT, space domain awareness, PNT/NAVWAR, responsive space systems and potentially multi-mission constellations.
• Estimated financial size: up to EUR 24 billion by 2034

EU Federated Integrated Air and Missile Defence including Early Warning (EU-FIAMD)

• Focus: Federated air and missile defence, early warning, sensors, effectors, C2, testing, certification and training environments. Involves 16 participating countries.
• Estimated financial size: EUR 55–80 billion by 2040

Eastern Flank Watch (EFW)

• Focus: Multi-domain security of the EU’s Eastern border, including ground combat, drone defence, C4ISTAR, counter-mobility, military mobility and air and missile defence. Involves 13 EU Member States, Norway and Ukraine.
• Estimated financial size: EUR 60–100 billion by 2036

The five projects were selected from nine proposals submitted by Member States by 29 May 2026. They aim to strengthen the European Defence Technological and Industrial Base ("EDTIB"), support collaborative development and procurement, and improve interoperability across Member States. The projects are described as fully aligned with EU and NATO capability priorities.

2. Why this matters for industry

The EDPCI initiative is designed to shape European defence capability development and procurement over the next decade. For industry, early positioning in the relevant value chains may be decisive.

The opportunities are particularly relevant for:

• Prime contractors and system integrators that can coordinate multinational capability projects, align national requirements and manage complex procurement structures across participating countries.
• SMEs, mid-caps and scale-ups with technologies in sensors, autonomy, AI, secure communications, cyber resilience, electronic warfare, space systems, drone platforms, counter-UAS, underwater systems and manufacturing technologies. The Commission's BraveTechEU initiative under EDIP specifically targets start-ups and SMEs.
• Space and New Space companies providing satellite communications, Earth observation, ISR, space domain awareness, responsive launch, PNT resilience or ground-segment services. The SPACE EDPCI alone envisages investment of up to EUR 24 billion by 2034.
• Dual-use technology providers that can adapt civilian products for defence use, especially in drones, maritime surveillance, AI-enabled decision support, robotics and critical infrastructure protection.
• Investors and strategic partners looking at European defence and SpaceTech targets, as EDPCI-related funding may increase demand visibility and accelerate consolidation in selected segments.

3. Key legal aspects for companies

3.1 Funding eligibility and European control

EDIP funding is subject to strict eligibility rules. Recipients must generally be established in the EU or an associated country and have their executive management structures there. Relevant infrastructure, facilities and resources must also be located in the EU or an associated country, subject to limited exceptions.

Companies controlled by non-associated third countries may still be eligible if adequate guarantees are provided, including safeguards on infrastructure, IP, know-how and classified information.

For companies with US, UK, Swiss or other non-EU parent structures, this requires a careful assessment of whether the eligibility thresholds can be met and what guarantees will be required.

3.2 Supply chain origin and “design authority”

For procurement and EDPCI activities supported by Union funding, the cost of components originating outside the EU and associated countries must generally not exceed 35 % of the component cost of the end product. In addition, no component may be sourced from third countries that contravene EU or Member State security and defence interests.

A further key concept is design authority: recipients or contractors must be able to decide on the definition, adaptation and evolution of the design without restrictions by non-associated third countries, including the authority to substitute or remove restricted components. This is particularly relevant for companies whose products incorporate US-origin ITAR- or EAR-controlled technology.

3.3 Procurement structures and consortium governance

Common procurement actions may involve contracting authorities of Member States, associated countries, international organisations, SEAPs or the European Defence Agency. Participating countries must appoint a procurement agent by unanimity, and the procurement agreement must address tender assessment and award decision-making.

For companies, early contractual structuring is essential: teaming agreements, consortium agreements, subcontracting structures, workshare, IP, export-control responsibility, security obligations, pricing and termination rights should be clarified before tenders or funding applications are launched.

3.4 IP, know-how and classified information

The EDIP rules expressly address IP and sensitive information. Guarantees may be required to ensure that IP and know-how needed for the action are not restricted by third-country control, and that access by non-associated third countries or entities to classified or sensitive information is prevented.

Companies should therefore review ownership structures, licence agreements, ITAR/EAR exposure, technical assistance arrangements, cloud hosting, employee access rights and security-clearance requirements well before joining an EDPCI supply chain.

3.5 Export control, sanctions and intra-EU transfers

Defence and dual-use technologies in the proposed projects will often be subject to EU, German and foreign export-control rules, particularly for space-based ISR, secure communications, counter-drone systems, electronic warfare, missile-defence components and AI-enabled targeting support. EDIP also contemplates general transfer licences for transfers of related products to other Member States.

3.6 State aid, competition and public funding compliance

Member States may provide support schemes to EDPCIs, but this remains without prejudice to Articles 107 and 108 TFEU. Companies should treat EDPCI participation as a public-funding and State-aid-sensitive environment, particularly where national, EU and regional funding instruments are combined.

Competition law also remains relevant. Consortium discussions should be structured carefully to avoid unlawful information exchange, market allocation or bid coordination beyond what is necessary for the project.

3.7 Permitting, facilities and industrial ramp-up

The EDPCI framework supports industrial ramp-up and production capacity. Planning, construction and operation of related production facilities may, under certain conditions, be considered an imperative reason of overriding public interest under selected EU environmental rules. This may assist permitting strategies but is not a blanket exemption from environmental, planning or safety requirements.

4. Ukraine and Norway participation

Ukraine participates in four of the five EDPCIs, supported by the EDIP Ukraine Support Instrument (USI) with EUR 260 million for collaborative projects. Norway's participation opens the framework to a key NATO ally with significant defence-industrial capacity.

5. Practical next steps for companies

Companies active in defence, aerospace and SpaceTech should now assess where their products, technologies or services fit into the five proposed EDPCIs. In particular, companies should:
a. map their capabilities against the five projects and likely national capability priorities;
b. identify potential prime contractors, Member State sponsors, procurement agents and consortium partners;
c. review ownership, control, security-clearance and third-country dependency issues against EDIP eligibility requirements;
d. audit supply chains against the 35% non-EU/non-associated component threshold;
e. review IP, design-authority and licensing restrictions, particularly for ITAR/EAR-exposed technology;
f. prepare compliant teaming, subcontracting and consortium documentation;
g. assess export-control, sanctions, FDI, cybersecurity, AI, data and public-procurement implications;
h. confirm Germany's participation status in each relevant EDPCI; and
i. monitor the Council deliberation process and upcoming EDIP funding procedures (first call closing October 2026, second call closing February 2027).

6. Summary

The Commission's proposal is a clear signal that Europe intends to move from fragmented national procurement towards larger, collaborative industrial programmes with a combined investment ambition of around EUR 190 billion. For companies in the defence, aerospace and SpaceTech sectors, the window for strategic positioning is opening now.

The AI Regulation pursues a risk-based approach: the higher the risk that an AI system poses to safety and fundamental rights, the stricter the legal requirements. AI systems with an “unacceptable risk,” such as certain forms of social scoring, are completely prohibited. High-risk systems, for example in the area of recruiting or critical infrastructure, remain permissible but are subject to extensive documentation, transparency, and compliance obligations. For AI with low risk, only limited transparency requirements apply.

Particular significance also attaches to so-called General Purpose AI models, especially generative AI. Providers of such systems will in future have to fulfil additional obligations, for instance regarding transparency, risk management, and the disclosure of training data. Violations of the AI Regulation can be sanctioned with substantial fines of up to 35 million euros or 7 % of global annual turnover.

In addition to the extensive requirements for high-risk AI, the AI Regulation also contains various transparency requirements for AI applications that are already in use in many companies today. The focus is in particular on systems that communicate with people or generate content whose artificial origin is not readily apparent to users.

AI in Direct Contact with People: Chatbots and Digital Assistants

As soon as persons interact with an AI system, it must be apparent to them that no human communication is taking place. This primarily concerns chatbots, virtual assistants, or automated support systems. The notice of AI use must be clearly formulated, easily understandable, and visible at the latest at the beginning of the communication.

Even though the primary legal responsibility generally lies with the provider of the system, companies should ensure when introducing such applications that these transparency requirements have been technically implemented correctly.

AI-Generated Media Content: Requirements for Deepfakes

Special disclosure obligations also apply to artificially generated or manipulated image, audio, and video content. Where content is created that can appear (deceptively) similar to real persons or real situations, it must be made clear that AI was used.

Particularly with modern training formats, simulations, or marketing campaigns, this rule is gaining increasing practical significance. Companies should therefore ensure that appropriate notices are integrated in a clearly visible manner. Where external agencies or service providers are engaged, a contractual arrangement for the proper labelling of such content is additionally recommended.

AI-Generated Texts and Public Communication

Texts can also fall under the transparency obligations of the AI Regulation. Where content is automatically generated with the help of AI and relates to topics of public interest, it must in principle be made known that AI was involved in the creation.

Potentially affected are, for example, press releases, public statements, or publications in a professional context. No labelling is required where actual human control and editorial responsibility are demonstrably exercised. Companies must therefore decide whether to openly label AI-generated content or to establish and document internal review and approval processes.

Analysis of Persons by AI Systems

Additional information obligations exist for AI systems that recognise emotions or evaluate or categorise persons on the basis of biometric characteristics. Persons affected by such applications must be informed transparently about their use in advance.

This can be practically relevant, for example, in systems that analyse attention, fatigue, or emotional reactions.

Need for Action by Companies

The transparency requirements of Art. 50 of the AI Regulation apply from 2 August 2026. Companies should therefore obtain an overview of the AI applications in use at an early stage and examine whether individual systems fall under the new information obligations.

In addition to technical adjustments, internal compliance structures, employee training, and the revision of existing contracts with AI providers may in particular become necessary. The implementation of the AI Regulation will thus represent not only a legal but also an organisational and technical task for companies.

As the German legislator has not yet transposed the European directive into German law, the question arises for employers as to what legal consequences result this has and if there is already a need for action at this stage.

Current Legal Situation

The Pay Transparency Directive is – like any EU directive – addressed in principle to the Member States and requires transposition into national law. For private employers, the expiry of the transposition deadline therefore does not automatically mean that all provisions of the Directive apply directly. However, this does not mean that employers can disregard the requirements of the Directive until national transposition takes place. The situation may be different for public employers, insofar as individual provisions are sufficiently precise and unconditional in their formulation. Nevertheless, the lack of transposition does not create a legal vacuum.

The principle of equal pay for men and women for equal work or work of equal value under Article 157 TFEU already applies directly today. Furthermore, the courts are obliged to interpret existing national law – in particular the Pay Transparency Act (Entgelttransparenzgesetz) – in conformity with EU law. The objectives of the Directive can therefore already influence labor court proceedings at this stage.

Even though there is currently no unrestricted direct binding of private employers to all requirements of the Directive, employment law literature already recommends a review of existing remuneration systems. With the subsequent transposition into national law and further clarification through case law, the practical significance of the Directive is likely to continue to increase.

Recommended Actions for Employers

1. Review remuneration systems at an early stage

Even though the national transposition legislation is still pending, companies should already review their existing remuneration systems now. Particular attention should be paid to whether pay decisions are based on objective, gender-neutral, and transparent criteria. An early review facilitates the subsequent implementation of statutory requirements and can at the same time help to identify and eliminate existing discrimination risks at an early stage. At the same time, potential discrimination risks can be reduced.

2. Strengthen transparency and documentation processes

The Pay Transparency Directive places a significantly stronger focus on transparent pay decisions. Companies should therefore already ensure that the relevant criteria for determining the remuneration amount and the salary development are documented. Transparent documentation not only facilitates the subsequent implementation of the Directive but can also provide an important basis for demonstrating non-discriminatory pay decisions in the event of information requests or labor court proceedings.

3. Prepare internal processes for future information entitlements

The Directive provides for extended information and disclosure rights. Companies should therefore examine at an early stage whether existing HR and remuneration processes are suitable for handling such requests efficiently and in a legally compliant manner. This includes in particular a review of responsibilities, internal procedures, and the availability of relevant remuneration data.

4. Monitor case law and legislation closely

Further developments remain dynamic. In addition to the still-pending transposition legislation, labor court case law in particular will continue to clarify the practical application of pay transparency. The Federal Labor Court, in its judgment of 19 February 2026 (8 AZR 83/25), further defined the information entitlement under the Pay Transparency Act and emphasized that it is establishment-related. Even though the decision still concerns the current legislation, it illustrates the growing importance of transparent remuneration structures.

5. Do not postpone preparatory measures until the transposition legislation

Even though no national transposition legislation is currently in place, it is advisable to initiate necessary preparatory measures now. While the specific content of future transposition legislation remains to be seen, it is likely to be largely guided by the EU law requirements. Companies that review their remuneration structures and internal processes at an early stage can respond more quickly to the new statutory requirements and significantly reduce the subsequent implementation effort.

Conclusion

The failure to transpose the EU Pay Transparency Directive by the deadline does not mean that all Directive requirements directly apply to private employers. Nevertheless, companies should not underestimate the development. The equal pay principle under Article 157 TFEU, which already applies directly, as well as the interpretation of national law in conformity with EU law, already lend practical relevance to the objectives of the Directive today. Even without the national transposition legislation, it is therefore advisable to review existing remuneration systems and internal HR processes for their compatibility with the future transparency requirements now and to prepare necessary adjustments at an early stage.

The election of employee representatives to the supervisory board under the German Co-Determination Act (MitbestG) is an organizationally complex procedure in which various election committees cooperate in a hierarchical relationship. Pursuant to Section 3(1) of the Third Election Regulation under the Co-Determination Act (3. WOMitbestG), the central election committee (Hauptwahlvorstand) bears overarching responsibility for the proper conduct of the election. A key obligation in this context is to review submitted nomination proposals without delay and to notify the representative of the proposing party (Vorschlagsvertreter) in writing, stating the reasons, in the event of invalidity or objection (Section 34(2) sentence 2 of the 3. WOMitbestG). In a recent decision, the Federal Labour Court (BAG) has now clarified the specific organizational requirements arising from this obligation for the central election committee and when a breach of these duties renders the entire supervisory board election voidable.

Facts of the Case

In a security services group with just over 20,000 employees, the central election committee was constituted for the election of employee representatives to the supervisory board, to be conducted by delegates pursuant to the 3. WOMitbestG. The basis of the operational organization was a collective bargaining agreement concluded with a trade union under Section 3 of the Works Constitution Act (BetrVG), on the basis of which, among other things, regional works councils had been formed.

However, no local election committee was constituted for the North Region operation, which employed more than 1,000 workers. Nevertheless, the chairwoman of the North Region works council submitted, on her own initiative, a voter list for this operation to the central election committee, despite the fact that it had not been prepared by a local election committee. In the same email, she stated that the local election committee would not meet until a later date. The central election committee accepted the voter list without further investigation and issued the announcement regarding the submission of nomination proposals with a deadline of 20 June 2022, 4:30 p.m.

On 17 June 2022 – a Friday following the Corpus Christi public holiday – a nomination proposal supported by 110 supporting signatures (Stützunterschriften) was submitted, which listed, among others, the chairwoman of the North Region works council as a candidate. During the period from 17 June to 20 June 2022, the majority of the members of the central election committee were absent. A review of the nomination proposal did not take place until 22 June 2022, i. e., after the expiry of the submission deadline.

In a further meeting on 6 July 2022, the voter list for the North Region operation was retroactively declared invalid, and the nomination proposal was not admitted to the election in its entirety – the central election committee did not consider the mere deletion of individual candidates to be sufficient. At the same time, the employees of the North Region operation were excluded from the election.

Several eligible employees challenged the election held on 29 September 2022. They objected in particular to an impermissible shortening of the deadline, the failure to conduct an early review of the voter list, and the belated examination of the nomination proposal. The employer side considered the challenge inadmissible and relied, among other things, on an alleged conflict of interest of the applicants’ legal representative and on alleged collusive cooperation between individual applicants and the chairwoman of the regional works council. The lower courts nonetheless granted the application; the employer side filed an appeal on a point of law.

Decision

The BAG dismissed the appeal on a point of law as unfounded and confirmed the voidability of the election. First, the BAG held that the admissibility of the challenge application is not negated by the fact that individual challenging employees had subsequently left their employment. The decisive factor is eligibility to vote at the time of the election; the need for legal protection (Rechtsschutzbedürfnis) only ceases when all challengers have left employment.

Furthermore, the objection that the applicants’ legal representative had previously advised the central election committee and was therefore subject to a professional bar on acting did not render the application invalid. A potential violation of Section 43a(4) of the Federal Lawyers’ Act (BRAO) affects neither the procedural mandate (Prozessvollmacht) nor the procedural acts performed by the lawyer. Equally, alleged collusive cooperation by individual applicants does not preclude the challenge, since the application was already based on independent grounds for challenge over which the applicants in question had no influence. Finally, it was irrelevant that a member of the central election committee had simultaneously stood as a candidate for a supervisory board seat.

On the merits, the BAG first rejected the claim of an impermissible shortening of the six-week submission deadline for nomination proposals. The central election committee is permitted to restrict the submission possibility on the last day of the deadline to the end of regular working hours, provided this point in time does not precede the end of working hours of the majority of employees.

However, the central election committee had violated essential provisions of the election procedure in two respects. First, it had breached its general duty to ensure proper conduct under Section 3(1) of the 3. WOMitbestG by accepting the voter list submitted by the works council chairwoman without further verification as properly prepared, although it could and should have recognized that the list had not been drawn up by a local election committee. According to the BAG, the central election committee should have contacted the members of the local election committee known to it by name and urged the proper preparation of a voter list. While the central election committee is not, in principle, required to step into the functions of local election committees, it must not simply accept errors by local election committees that are apparent to it without at least attempting to remedy them.

Second, the central election committee had violated its duty to review under Section 34(2) sentence 2 of the 3. WOMitbestG. The obligation to review submitted nomination proposals without delay constitutes an essential provision governing the election procedure. It serves to provide the representative of the proposing party with the opportunity to submit a new, valid nomination proposal within the submission deadline. Particularly in the final phase of the submission period, the central election committee must take organizational precautions to be able to convene at short notice and review incoming nomination proposals. The central election committee had failed to do so in this case, as the majority of its members were absent in the final days of the deadline and a review did not take place until after the deadline had expired.

The central election committee had correctly declared the nomination proposal invalid in its entirety rather than merely striking the ineligible candidate – because the nomination proposal is supported in its specific composition by the will of the signatories, such that subsequent amendments without the consent of all signatories are not possible. However, the late review deprived the submitting party of the opportunity to timely submit a new nomination proposal without the ineligible candidate.

The procedural errors were also causal, since it cannot be excluded that, had proper procedures been followed, a valid nomination proposal would have been submitted and the election result would have been different. The established violations gave rise to the voidability of the elections of all employee representatives on the supervisory board, including those of the senior executives and trade union representatives, since although there were three separate polls, these took place within a single unified election conducted by the same electoral body, and cross-group consensus-building among the delegates cannot be excluded.

Practical Recommendations

The BAG’s decision vividly illustrates the many procedural pitfalls inherent in the multi-tiered election process under the Co-Determination Act. Even organizational omissions that may appear minor in relation to the overall effort of a supervisory board election can provide grounds for the successful challenge of all ballots. For employers and all other parties involved in the procedure, several concrete recommendations for action arise:

• First, when planning the start of the deadline for the submission of nomination proposals, the central election committee should ensure that the deadline does not expire during a period in which a short-notice meeting to review incoming nomination proposals cannot be organizationally guaranteed. If the deadline expires on a Monday following a public holiday, for example, particular precaution is required – or a later start of the deadline should be chosen.
• Second, the central election committee must not rely on the assumption that voter lists transmitted to it have been properly prepared. Where there are indications that a voter list does not originate from a duly constituted local election committee, the central election committee must investigate and, if necessary, urge correction before issuing the announcement regarding the submission of nomination proposals.
• Furthermore, it is advisable to put in place clear organizational arrangements for the entire duration of the submission period, and in particular its final phase, so that the central election committee can convene at short notice at any time and review submitted nomination proposals without delay. The mere absence of members of the central election committee does not excuse a belated review. Given the numerous formal requirements of the election procedure, legal advice should be sought at an early stage in cases of uncertainty, in order to minimize the risk of a subsequent election challenge as far as possible.

Facts

The Lower Saxony Higher Labour Court (Landesarbeitsgericht Niedersachsen) has dismissed the appeals of two managers who had claimed damages and compensation for pain and suffering from their employer on the basis of alleged violations of the Whistleblower Protection Act (Hinweisgeberschutzgesetz – HinSchG). According to consistent press reports, the claimants are employed by the respondent, a major Lower Saxony car manufacturer – reportedly Volkswagen – as members of the Senior Management Circle (Oberer Managementkreis – OMK). They assert that no action was taken in response to various internal reports of compliance violations; instead, they allege that they suffered reprisals, in particular disadvantages in promotion decisions. They take the view that the respondent violated the HinSchG and owes them damages and compensation for pain and suffering. According to press reports, the claims amounted to approximately four million euros per claimant, derived from lost income following an expected promotion through to retirement, lost occupational pension entitlements, and compensation for pain and suffering.

The Braunschweig Labour Court (Arbeitsgericht Braunschweig) had dismissed the claims on the grounds that no damage attributable to a reprisal had been demonstrated and that, moreover, the internal notification required by law was lacking.

Decision

The LAG Lower Saxony dismissed the appeals by decisions announced on 29 May 2026. A claim under the HinSchG did not exist: the claimants’ internal notifications did not fall within the scope of the HinSchG, as they had been made before the Act entered into force. Furthermore, the claimants had not addressed the internal reporting channels but had merely informed their superiors in fulfilment of their contractual duties. Reprisals had not been sufficiently demonstrated, and the claimants had failed to establish a causal link to any damage. The requirements for a claim for damages or compensation for pain and suffering under general civil law provisions were likewise not met. The appeal division granted leave to appeal (Revision) to the Federal Labour Court (Bundesarbeitsgericht).

Practical Note

To date, only the court’s press release is available; the full text of the decision and its reasoning have not yet been published. The judgment is, moreover, not yet final, as leave to appeal to the Federal Labour Court has been expressly granted.

The combination of the broad concept of “reprisal” and the reversal of the burden of proof under section 36 HinSchG has given rise to employer concerns that, in future, virtually any adverse personnel measure taken after a report could be classified as a reprisal and trigger damages claims. HR professionals are therefore consistently advised to document the objective reasons for employment law measures with particular care.

At the same time, it is apparent that much remains unresolved under the still relatively new HinSchG. The present decision is part of a line of lower court case law that restricts the scope of the HinSchG: for example, the Hamm Labour Court (Arbeitsgericht Hamm) held that allegations raised in a mere personnel meeting with the employer are not covered by the protections of sections 35 to 37 HinSchG, because no report had been made through an internal or external reporting channel. Equally, the reversal of the burden of proof does not apply automatically merely because a measure is taken after a report has been made (cf. Arbeitsgericht Hamm, judgment of 16 February 2024, Case No.: 2 Ca 1229/23).

Reliable conclusions, particularly regarding the temporal scope of the HinSchG and the requirements for a protected report, will therefore only be possible once the full reasoning is available or a definitive ruling by the highest court has been issued. For more far-reaching clarifications, a different case that falls more clearly within the scope of the HinSchG will in all probability be required.

In its judgment of 11 February 2026 (Case No. 3 Ca 6587/25), the Düsseldorf Labor Court held that the employer’s directive requiring the claimant to perform his work on the employer’s premises from Monday to Thursday was invalid, as the employer had failed to demonstrate sufficiently that the attendance requirement complied with the standard of equitable discretion (billiges Ermessen).

A. Facts

The parties were in dispute over the validity of an employer directive under which the claimant was permitted to work remotely only on Fridays and was otherwise required to be present at the workplace.

The claimant has been employed by the defendant in the IT department since 1 April 2014 and had, until summer 2025, worked at least 50% of his working hours remotely, particularly on Mondays and Fridays. In August 2025, the claimant’s next-level supervisor informed him by e-mail that “RA” (remote access) had been revoked until a release migration was “in the bag,” citing what the supervisor considered serious deficiencies in the department. The defendant pointed to significant organisational shortcomings, deficient project management in connection with an SAP release migration, communication and coordination problems, and what it perceived as leadership weaknesses on the part of the claimant. The claimant, by contrast, argued that there had been no reason to revoke his remote work privileges, that he had held a permanent authorisation, and that his remote work had in any event been agreed with his direct supervisor. He further relied on health and family circumstances, in particular rehabilitation and physiotherapy appointments as well as the distance between his residence and the workplace. The claimant initially sought permission to work 50% of his working hours remotely; in the alternative, he requested permission to work remotely on Mondays and Fridays for the duration of his rehabilitation programme, and additionally sought a declaratory judgment that the attendance directive was invalid

B. Reasoning of the Düsseldorf Labor Court

The Düsseldorf Labor Court dismissed the claim for 50 % remote work as unfounded, holding that no such entitlement arose either from the employment contract or from the internal communication on “external working.”

In the court’s view, the communication on external working did not constitute a general undertaking (Gesamtzusage) because it contained neither an intention to be legally bound nor a sufficiently definite promise of performance. The court found it decisive that “external working” was described in the communication as a “privilege,” required the written approval of the supervisor, and merely set out framework conditions and upper limits. The court also rejected the existence of an established workplace practice (betriebliche Übung), reasoning that the claimant had essentially only described his previous de facto remote work arrangements, from which no declaration of intent by the employer to grant a lasting entitlement could be inferred. The court likewise declined to find that the employer’s right of direction (Direktionsrecht) had crystallised in the claimant’s favour, as a long-standing practice alone was insufficient and additional circumstances giving rise to a legitimate expectation of the continuation of particular working conditions were required.

The court did not consider the principle of equal treatment under employment law to provide a basis for the claim, as the claimant had not sufficiently demonstrated any arbitrary differentiation vis-à-vis comparable employees.

The court held the alternative claim for remote work on Mondays and Fridays for the duration of the rehabilitation programme to be inadmissible, as the time period, conditions, and end of the sought permission had not been sufficiently specified by the claimant.

The declaratory claim against the specific directive to work on the employer’s premises from Monday to Thursday was, however, successful. While the court acknowledged in principle that the employer may determine the place of work pursuant to Section 106 of the Industrial Code (GewO) and that this right of direction is subject to judicial review only as to compliance with equitable discretion, the employer bore the burden of presentation and proof that its directive satisfied the standard of equitable discretion. In the court’s view, the defendant had failed to explain in a comprehensible manner why the claimant’s presence at the workplace would be capable of remedying the alleged organisational deficiencies, communication problems, or performance shortfalls. In particular, the court was not persuaded that the claimant’s physical presence could improve communication when key contacts continued to work remotely and communication channels therefore remained unchanged. The court therefore characterised the measure as the withdrawal of a privilege or a form of sanction rather than a comprehensibly justified organisational measure.

In the absence of a sufficient nexus between the attendance requirement and the operational objective pursued, the directive was defective in the exercise of discretion and therefore invalid.

C. Practical Note

The decision demonstrates that remote work policies do not automatically give rise to an individual entitlement to remote work where the policy merely sets out framework conditions, upper limits, and approval requirements.

Employers should therefore clearly articulate whether a remote work policy merely establishes an approval-dependent framework or is intended to create an enforceable entitlement. When revoking or restricting remote work arrangements that have already been practised, it is insufficient to make a general reference to organisational deficiencies, communication problems, or the need for oversight. Rather, employers should document specifically why the ordered physical presence is suitable and necessary to achieve the stated operational objectives.

For employees, it is significant that a general claim to a specific scope of remote work may be harder to enforce than a targeted declaratory claim that a specific attendance directive is defective in the exercise of discretion.

The Supreme Court held that the US President may dismiss FTC commissioners at will – regardless of whether cause exists (US Supreme Court Decision of June 29, 2026, No. 25-332 (Trump v. Slaughter)).

Key Legal Issues

The central question of the case was whether the statutory protection of Federal Trade Commission (FTC) commissioners against removal without cause is compatible with the constitutional principle of separation of powers.

By a 6-3 majority, the US Supreme Court held on June 29, 2026:

• The statutory restriction on the President’s removal authority violates the separation of powers enshrined in the Constitution.
• The FTC in its current form clearly exercises executive power – it enforces approximately 80 federal statutes, issues binding regulations, conducts investigations, and brings civil actions on behalf of the United States. The Constitution therefore requires oversight by the President as head of the executive branch.
• The 91-year-old precedent Humphrey's Executor is expressly overruled insofar as it afforded members of an agency exercising executive power protection from removal by the President.

The Court justified the President’s authority to remove FTC commissioners by reference to the constitutional chain of accountability: “Subordinates who exercise the President's power are subject to removal by him. Then, and only then, can they remain accountable to the President, and the President to the people."

Impact of the Decision on FTC Independence

The decision not only places the removal of FTC commissioners at the President’s discretion but also strips the FTC of its institutional independence. The three justices who dissented from the majority opinion expressly warned that the agency’s independence safeguards can now be circumvented and rendered ineffective:

• Bipartisan Composition: “Bipartisan-appointment requirements can easily be evaded simply by firing all Commissioners of the opposite party. Just look at the FTC today."
• Fixed Terms of Office: “Lengthy fixed terms, aimed at ensuring stability, continuity, and the development of expertise within an agency, can also be cut short at the President's will."
• Multi-Member Structure: “With the most extreme exercises of at-will removal, the multimember structure itself could be eliminated, by executive fiat, with sufficient arbitrary firings to winnow a commission down to a sole remaining chair."

Following the dismissal of both Democratic commissioners, only two Republican commissioners currently remain in office. The fifth seat had already been vacant before the dismissal of the two Democratic commissioners and has not yet been filled.

Warning of Concentration of Power in the Presidency

Even one of the six justices who joined the majority opinion warns of the consequences. He points out that Congress has conferred upon independent agencies not only executive but also extensive legislative and judicial powers. The FTC issues regulations with the force of law (legislative), conducts administrative proceedings with binding effect (judicial), and enforces its decisions, which can include fines in the billions of dollars (executive). Following this ruling, the President can effectively exert influence over all three branches of government in this sphere.

He therefore calls for: “From here, the only sure path is to finish the journey we start today and restore legislative and judicial powers to where they belong: in Congress and the courts."

Implications for the Transfer of Personal Data to the United States

The ruling also has direct implications for data protection in the EU. The currently valid EU-US Data Privacy Framework of 2023, together with the European Commission’s adequacy decision, serves as the legal basis for the transfer of personal data from the EU to the United States. The FTC plays a key role in this context: it acts as an independent supervisory authority that monitors and enforces compliance with data protection obligations by US companies. The European Commission’s adequacy decision (Implementing Decision (EU) 2023/1795) explicitly and repeatedly refers to the FTC as an independent agency. Recital 60 expressly states: “The FTC is an independent agency [...].”

Under Art. 16(2) TFEU and Art. 8(3) of the EU Charter of Fundamental Rights, data protection supervision must be carried out by an independent body. The Supreme Court’s ruling eliminates the FTC’s independence, thereby removing the legal foundation of the EU-US Data Privacy Framework.

In practice, the European Commission’s adequacy decision remains in effect until it is revoked by the European Commission or invalidated by the CJEU. In the long term, however, it is expected that the EU-US Data Privacy Framework will cease to serve as a basis for the transfer of personal data to the United States.

Practical Guidance for EU Companies

1. Review data transfers to the United States: Companies that rely on the EU-US Data Privacy Framework as the legal basis for transferring personal data to the United States should promptly evaluate their transfer mechanisms. A judicial invalidation of the EU-US Data Privacy Framework is now significantly more likely.
2. Strengthen alternative transfer mechanisms: Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs) are once again gaining importance. However, their viability is also in question if independent supervision and review are no longer guaranteed in the United States, meaning an equivalent level of data protection can no longer be ensured.
3. Factor in regulatory instability: The decision has the potential to fundamentally alter the FTC’s practices in consumer protection and competition. Companies with US operations – particularly in e-commerce, the platform economy, and digital services – should anticipate increased regulatory volatility.
4. Monitor further developments: The ruling does not automatically halt transatlantic data transfers that rely on the EU-US Data Privacy Framework. However, the European Commission and European data protection authorities will need to respond to the ruling. Companies should keep a close eye on future developments and, in particular, establish a regular evaluation process in the area of data protection in order to identify and implement necessary adjustments in a timely manner.

Background

The leadership of the CDU, CSU, and SPD agreed on a comprehensive reform package ("Program for Recovery and Employment") during a coalition committee meeting. The package is designed to modernize Germany, reinvigorate the economy, and future-proof the welfare state. In addition to income tax relief effective January 1, 2027, the package includes further changes relevant to employment law practice.

Overview of the Planned Measures

Fixed-Term Employment Without Objective Justification

Going forward, fixed-term employment contracts without objective justification will be permitted for a maximum duration of up to 48 months, with up to six renewals. This represents a doubling of the current limits. The new rules are intended to apply to employees hired on or before December 31, 2030.

Severance for High Earners

Effective January 1, 2027, a new provision is to be introduced for high earners with annual income exceeding 1.75 times the statutory pension insurance contribution ceiling (Beitragsbemessungsgrenze), enabling the termination of the employment relationship with a severance option.

For reference: The statutory pension insurance contribution ceiling for 2026 stands at a gross annual income of EUR 101,400. The 1.75 multiple corresponds to a gross annual income of EUR 177,450.

In addition, severance payments are to receive preferential tax treatment if the employee promptly takes up new employment. The faster new employment is commenced, the greater the tax advantage.

Sick Notes

Telephone-based sick notes will be abolished, and penalties under Section 278 of the German Criminal Code (StGB) for the fraudulent issuance of certificates of incapacity for work will be increased. Going forward, a certificate of incapacity for work must be submitted from the first day of illness.

Mini-Jobs

The flat-rate tax on mini-jobs is to be raised from two to five percent.

Higher Supplements

The upper limits for tax-privileged Sunday and public holiday supplements under Section 3b(2) sentence 1 of the German Income Tax Act (EStG) will be increased for hourly wages of up to EUR 75, effective January 1, 2027. Tax-exempt supplements within the scope of a collective bargaining agreement will be fully exempted from social security contributions.

Practical Guidance and Outlook

The proposed changes are still reform plans and must go through the legislative process.

For employers, the reform package opens up considerable room for structuring arrangements, though the specific legislative implementation remains to be seen.

The extended fixed-term employment without objective justification would provide employers with significant advantages in workforce planning and flexibility. The proposed simplified severance-based separation mechanism for high earners could streamline termination and settlement processes. The stricter requirements for sick notes would help prevent fraudulent conduct by employees to the detriment of employers.

A new Working Hours Act is not yet included in the twelve-page outcome paper and, according to Chancellor Merz, is not expected to be discussed until "over the course of the summer." The CDU/CSU and SPD had agreed in the coalition agreement to introduce a weekly rather than a daily maximum working time. A ministerial draft on this matter was published on June 18, 2026. One initial decision has already been made: the extended Sunday opening hours for bakeries, confectioneries, and libraries agreed upon in the coalition agreement will enter into force on January 1, 2027.

The following article contextualises the key changes and sets out the steps that companies should now take.

I. Background to the AI Omnibus

The AI Act entered into force on 1 August 2024 and its provisions apply in a staggered manner: while the rules on prohibited practices (Article 5 of the AI Act) and the provisions on AI literacy have been in effect since 2 February 2025, and the obligations for general-purpose AI models have been applicable since 2 August 2025, the central requirements for high-risk AI systems under Chapter III of the Regulation were intended to take effect on a staggered basis – for standalone systems listed in Annex III from 2 August 2026, and for systems embedded in products as safety components listed in Annex I from 2 August 2027. These high-risk obligations constitute the actual core of the AI Act’s regulatory regime and are also associated with the highest implementation effort for the affected providers and deployers.

In the course of implementing the already applicable parts of the Regulation, however, it became apparent that essential prerequisites for the legally certain application of these obligations were not yet in place. In particular, the harmonised standards, common specifications and guidelines on which providers are expected to rely in demonstrating conformity have been delayed in their development. Likewise, the establishment of the competent national authorities as well as the governance and conformity assessment structures has not been completed in many places. Providers of high-risk AI systems would therefore have been required to base their conformity assessments on foundations that were not yet available, which would have entailed considerable and objectively unjustifiable compliance costs.

Against this background, on 19 November 2025, the European Commission presented the so-called Digital Omnibus package. This comprises two draft regulations aimed at simplifying and streamlining the Union’s digital legal framework, particularly in the areas of AI, data protection and digital services.
Following the adoption of the Council’s position on 13 March 2026 and a provisional trilogue agreement on 7 May 2026, the European Parliament approved the compromise at first reading on 16 June 2026, before the Council formally adopted the text on 29 June 2026, thereby concluding the legislative procedure.

II. Key Changes Introduced by the Omnibus

The Omnibus leaves the fundamental structure of the AI Act unchanged – in particular the risk-based approach, the category of prohibited practices and the provisions for general-purpose AI models. Rather, the changes concern the timeline for the high-risk obligations, supplement the catalogue of prohibited practices and clarify individual terms and obligations with the aim of reducing compliance costs. The key new provisions of practical relevance for businesses can be summarised as follows.

1. Postponement of the Date of Application of the High-Risk Obligations

The centrepiece of the Omnibus is the postponement of the date on which the obligations for high-risk AI systems take effect. Under the original staggered timeline of the AI Act, these would have become applicable for standalone systems listed in Annex III from 2 August 2026, and for systems embedded in products listed in Annex I from 2 August 2027. The new provision differentiates between the two categories of high-risk systems:

For AI systems classified as high-risk under Article 6(2) in conjunction with Annex III of the AI Act – i. e. standalone systems in certain sensitive application areas such as employment, education or access to essential services – the date of application is now 2 December 2027.

For AI systems classified as a safety component of a product or as such a product under Article 6(1) in conjunction with Annex I of the AI Act, the date of application is postponed to 2 August 2028.

The staggered dates follow the logic originally established in the AI Act and are intended to afford the affected economic operators the time necessary to adapt until the relevant standards, common specifications and guidelines are actually available. In a flanking measure, the Commission is required to provide guidelines on compliance with the high-risk requirements by 1 August 2027 at the latest.

2. New Prohibited Practices: AI-Generated Abuse Material (Article 5 of the AI Act)

While the Omnibus provides temporal relief for the high-risk obligations, it simultaneously expands the catalogue of prohibited practices in Article 5 of the AI Act by two new offences.

First, the use of AI systems whose purpose is to generate or manipulate non-consensually created intimate material of identifiable real persons is prohibited. Second, AI systems used to generate or manipulate depictions of child sexual abuse are prohibited, including fully or partially AI-generated content.

The prohibition is directed both at providers who make such systems available on the Union market and at deployers who use such systems for the stated purposes. On the provider side, the prohibition covers not only systems with a corresponding intended purpose, but also those where the generation of such content is a reasonably foreseeable and reproducible outcome without substantial technical modification, and where adequate technical safeguards to reliably prevent such generation are lacking. Providers of generally usable image and video generators must therefore already assess at the design and deployment stage whether such misuse is foreseeable. Unlike the high-risk obligations, these new prohibitions are not subject to the postponed deadline but apply from 2 December 2026.

3. Clarification of the Term “Safety Component”

Of considerable practical significance is the revised definition of the term “safety component” (Article 3(14) of the AI Act), which is decisive for classification as a high-risk AI system under Article 6(1) of the AI Act. In future, an AI system will only fulfil a safety function where its intended purpose, as determined by the provider, is to avert or mitigate risks to the health and safety of persons or property. Expressly excluded are AI systems that serve exclusively user assistance, performance optimisation, service efficiency, automation, user convenience or non-safety-related aspects of quality control. The mere integration of an AI system into a product subject to Union harmonisation legislation does not in itself establish a safety function. This clarification narrows the scope of high-risk classification and provides providers with greater legal certainty in independently assessing their systems.

4. Softening of the AI Literacy Obligation (Article 4 of the AI Act)

The obligation previously enshrined in Article 4 of the AI Act to ensure a sufficient level of AI literacy among personnel is converted into an obligation to promote AI literacy. Providers and deployers are accordingly required to take measures to promote the AI literacy of their personnel and other persons acting on their behalf. The Commission and Member States are to support these efforts through training, information resources and the exchange of best practices. The requirement thus remains in substance, but loses its strictly mandatory and sanction-backed character in favour of a more facilitative approach.

5. Transparency and Labelling Obligations (Article 50 of the AI Act)

The transparency and labelling obligations under Article 50 of the AI Act remain substantively unchanged and continue to apply from 2 August 2026. However, for providers of generative AI systems that placed their systems on the market before 2 August 2026, the Omnibus provides for a transitional period within which the technical measures for labelling artificially generated content under Article 50(2) of the AI Act are to be implemented; the relevant cut-off date is set at 2 December 2026.

Companies that deploy or provide generative AI should note that the essential body of obligations under Article 50 of the AI Act is therefore expressly not covered by the general postponement of deadlines.

6. Further Facilitations and Clarifications

Beyond the above key points, the Omnibus contains a number of further adjustments. Definitions are introduced for SMEs and for “small mid-cap companies,” coupled with the extension, where appropriate, of existing facilitations for smaller operators to this group of undertakings. In the area of data protection, the legal basis for the processing of special categories of personal data for the purpose of detecting and correcting biases is extended beyond providers of high-risk AI systems to their deployers and to providers and deployers of other AI systems and models, subject to the same limitations, conditions and safeguards as before. Furthermore, the deadline for the establishment of national AI regulatory sandboxes is extended to 2 August 2027, and the competence of the AI Office for the supervision of AI systems based on general-purpose AI models of the same provider is further elaborated, including the establishment of exceptions in favour of the still competent national authorities.

III. Recommendations for Companies

Despite the granted postponement, companies should undertake or continue the central preparatory measure – a comprehensive inventory of deployed AI systems – without delay. Only on this basis can it be determined for each system whether it falls within the scope of the AI Act, to which risk category it is to be assigned, and which of the now staggered application dates is relevant. A careful examination of classification in light of the clarified definition of “safety component” is advisable, as systems that serve exclusively user assistance, performance optimisation or comparable functions may now fall outside the high-risk category under the revised definition.

Where the assessment concludes that a system continues to be classified as high-risk, the remaining time until the respective date of application should be used to establish the necessary conformity, risk and quality management processes and to evaluate the Commission’s forthcoming guidelines. Subsequent modifications to systems already placed on the market must also be managed deliberately, since any significant design change triggers the full set of high-risk obligations and a documented change management process must accordingly be maintained.

Irrespective of the postponement of the high-risk obligations, the immediate need for action with respect to the non-deferred obligations remains. Providers and deployers of generative AI systems should prioritise the implementation of the transparency and labelling obligations under Article 50 of the AI Act with a view to 2 August 2026 and the deadline of 2 December 2026 applicable to existing systems, and adapt their communication, marketing and publication workflows accordingly. Likewise, the new prohibitions under Article 5 of the AI Act should be taken as an occasion to review the deployment and provision of generative systems for potential risks and to put in place appropriate safeguards, as these prohibitions apply from 2 December 2026.

IV. Conclusion and Outlook

With the Council’s adoption of the Digital Omnibus on AI, it is now established that the timeline for the central high-risk obligations under the AI Act is significantly pushed back, without the fundamental risk-based structure of the Regulation being altered. For companies, this means a gain in time and legal certainty, but not a removal of the need for action – not least because the transparency obligations under Article 50 of the AI Act and the new prohibitions under Article 5 of the AI Act already take effect in the short term.

With the publication in the Official Journal and the entry into force of the amending regulation, the phase of further concretisation through standards, specifications and guidelines also begins, the timely availability of which will determine the practical feasibility of the obligations. Companies are therefore well advised to use the time gained consistently for preparation and to closely monitor further legal developments.

This article was created in collaboration with our student employee Emily Bernklau.

In this decision, the BGH established important guidelines for the first time regarding the termination of a restructuring case following notification of insolvency maturity. The decision concerns the question under which conditions a restructuring court may refrain from terminating the restructuring case despite subsequent notification of inability to pay or over-indebtedness.

The decision deserves particular attention, as the BGH, from the perspective of restructuring practice, has clearly defined the requirements for the debtor’s submissions and at the same time strengthens the court’s discretion in its review.

I. Facts of the Case: Occurrence of Inability to Pay After Notification of the Restructuring Project

The decision was based on the following facts: The debtor – a pure holding company in the legal form of a GmbH (limited liability company), holding interests in two companies over whose assets insolvency proceedings had been opened shortly before – had notified the Local Court (Amtsgericht) – Restructuring Court – Düsseldorf of a restructuring project and submitted a draft restructuring plan. The draft plan provided for the formation of two creditor groups, each of which comprised only one creditor: a bank as “creditor for claims arising from third-party security” and a service provider as “ordinary simple restructuring creditor.” The plan distribution rate for both groups was to be 1%. This was to be financed by a plan contribution of EUR 42,000.00 from a Polish company, which had not yet been secured.

After notification of the restructuring project, the bank called in its claim, whereupon the debtor notified the court of its inability to pay. The Local Court terminated the restructuring case. On immediate appeal, the Regional Court (Landgericht) dismissed the appeal and admitted the appeal on points of law (Rechtsbeschwerde) to the BGH.

II. Default Rule Pursuant to § 33(1) No. 1 StaRUG: Termination of the Restructuring Case

The starting point is the following statutory principle: If the restructuring court becomes aware that the debtor is unable to pay or over-indebted, the restructuring case is, in principle, to be terminated pursuant to § 33(1) No. 1 StaRUG. The StaRUG proceedings are specifically designed to address imminent inability to pay and are not intended to readily replace conventional insolvency proceedings. However, the StaRUG provides for exceptions to this principle in § 33(2).

III. Exception: No Termination, Discretionary Decision of the Court

Pursuant to § 33(2) No. 1, second half-sentence StaRUG, the restructuring court may refrain from termination in particular where the opening of insolvency proceedings, in view of the stage of restructuring already reached, is manifestly not in the interest of the creditors as a whole.

The restructuring court may also refrain from termination pursuant to § 33(2) No. 1, third half-sentence, where the insolvency maturity is based on the acceleration of a claim which, according to the notified restructuring concept, is to be subject to modification by the plan, provided that the achievement of the restructuring objective is more likely than not.

In its most recent decision, the BGH now clarifies that the restructuring court has discretion in making its decision. The continuation of the restructuring case is thus not an automatic consequence of a better creditor satisfaction claimed by the debtor in a StaRUG scenario. Rather, the court may and must assess the factual uncertainties of the restructuring. This applies in particular to alleged differences in distribution rates between insolvency and restructuring scenarios. If the projected distribution rates are subject to significant uncertainties, the restructuring court may take these uncertainties into account in its decision.

IV. The Debtor Bears the Burden of Presentation and Proof

In the BGH’s view, the debtor (consequently) bears the burden of presentation and proof for the circumstances that would justify refraining from termination.

If the debtor relies on the exception to the statutory default rule, the debtor must substantiate why the continuation of the StaRUG proceedings is justified despite the occurrence of insolvency maturity. What is required are reliable and comprehensible information regarding the status of the restructuring, the expected distribution rates, the financing and liquidity planning, as well as the feasibility of the restructuring concept. Mere assumptions, optimistic plan calculations, or general references to an alleged added value of the StaRUG proceedings will regularly not satisfy the requirements.

The debtor’s burden of presentation becomes particularly evident in restructuring concepts whose success depends on third-party contributions. In its decision, the BGH holds that the achievement of the restructuring objective is not more likely than not if the success of the restructuring depends on a voluntary payment by a third party that has not been sufficiently secured. In practice, this particularly concerns investor contributions, shareholder subsidies, or other financing commitments that are not legally and economically reliably secured. Non-binding letters of intent or mere expressions of support will therefore regularly not suffice to justify the continuation of the restructuring case.

V. The Debtor’s Legal Interest in an Appeal Despite Termination of the Restructuring Case

In addition, the decision contains an important procedural clarification. The debtor’s legal interest in an appeal against the termination of the restructuring case does not lapse merely because the notification of the restructuring case loses its effect upon termination or because more than six months have passed since receipt of the notification. The BGH thereby ensures that termination decisions of the restructuring court remain subject to effective review by way of appeal.

VI. Implications for Practice

The BGH’s decision makes clear that the requirements for the preparation and management of StaRUG proceedings should not be underestimated. Debtors should already be in a position at the time of notifying the restructuring court of the project to react immediately to any insolvency maturity that may subsequently occur and to make substantiated submissions regarding the conditions for refraining from terminating the restructuring case. This includes in particular the availability of a reliable comparative calculation of the next-best alternative scenario, comprehensible distribution rate projections, appropriate group formation, a documented status of negotiations with the affected creditors, as well as binding and fully funded commitments from any third-party contributors.

Overall, the BGH confirms the exceptional nature of the continuation of a restructuring case despite the occurrence of mandatory grounds for insolvency. The StaRUG remains a preventive restructuring instrument and not a substitute for insolvency proceedings once insolvency maturity has occurred. At the same time, room remains for cases in which continuation is exceptionally in the interest of the creditors as a whole, even where insolvency maturity occurs subsequently. From the debtor’s perspective, the decisive factor for utilising the exception is careful and early preparation in order to be able to make substantiated submissions regarding the prospects of success of the restructuring even after the occurrence of insolvency maturity.

The Federal Cartel Office critically commented on the key changes to the currently applicable version of the GWB in its statement of 19 June 2026 (available here: Federal Cartel Office – Homepage – Statement on the Draft Bill for the 12th GWB Amendment).

The GWB Draft has not yet been adopted as a draft bill. Changes during the further legislative process remain possible. In particular, it is possible that the legislator will (partially) adopt the Federal Cartel Office’s proposals.

Below we present the most practically relevant proposed changes of the GWB Draft:

I. Fewer Notification Obligations Due to Massively Increased Thresholds, but…

What is new?

The most significant change in practice concerns the merger control requirements. A prerequisite for notifying a concentration to the Federal Cartel Office is that the parties to the concentration exceed certain turnover thresholds in the last business year before the concentration. Under the proposal in Section 35(1) of the GWB Draft, these thresholds are now to be raised significantly. The increase in thresholds is intended to result in significantly fewer concentrations having to be notified (according to BMWE estimates, by approximately 13–14 %). This is primarily intended to relieve the Federal Cartel Office by ensuring that only concentrations of particular overall economic significance are reviewed:

• Worldwide Turnover Threshold (combined aggregate worldwide turnover of all the undertakings concerned): Raise from EUR 500 million to EUR 750 million (+ 50 %)
• 1st Domestic Turnover Threshold (domestic turnover of one undertaking concerned): Raise from EUR 50 million to EUR 75 million (+ 50 %)
• 2nd Domestic Turnover Threshold (domestic turnover of another undertaking concerned): Raise from EUR 17.5 million to EUR 20 million (+ 14 %)

Comment of the Federal Cartel Office

The Federal Cartel Office – surprisingly – disapproves these proposals. It warns that the renewed increase of the thresholds could cause protection gaps, particularly in smaller and regional markets. In light of the changes made to 1st domestic turnover threshold (doubling of the threshold) and the 2nd domestic turnover threshold (more than tripling of the threshold) that were introduced in 2021, the Federal Cartel Office sees no need for a further adjustment.

The BMWE itself acknowledges that the threshold increase is likely to enable one anti-competitive merger per year. Against this backdrop, the Federal Cartel Office notes that even a single concentration that can no longer be reviewed could lead to price increases in the markets that significantly exceed the savings calculated by the BMWE.

Practical Significance

Companies that are planning concentrations currently subject to notification should examine whether their project would still be captured by merger control under the GWB Draft – particularly if their turnover only marginally exceeds the current thresholds. In non-urgent cases where a complex German merger control procedure is expected, it may be worthwhile to wait for the adoption of the new rules.

For competitors, suppliers, and customers, the higher thresholds simultaneously mean a potentially reduced level of protection, particularly in regional markets. Given the Federal Cartel Office’s statement – which obviously sees itself able to manage the current workload in merger control proceedings – the proposed thresholds are likely to be discussed more closely during the further legislative process.

II. … In Return, Expansion of the Scope of the Transaction Value Threshold

What is new?

The transaction value threshold introduced in 2017 in Section 35(1a) GWB is now being integrated into the system of “normal” turnover thresholds (Section 35(1) No. 2 lit. b) GWB Draft), clarifying that both thresholds are of equal rank. The worldwide turnover threshold and the 1st domestic turnover threshold also apply to transaction value threshold cases. A notification obligation exists instead of exceeding the 2nd domestic turnover threshold also when a transaction value – simply put: a purchase price – of more than EUR 400 million is given.

In the future, cases shall also be captured where the target company is not yet active in Germany but is expected to become active in Germany. The legislature thus reacts to the issue of so-called “killer acquisitions,” i. e., strategic acquisitions of innovative start-ups by market-dominant companies. The BMWE cites, for example, the past mergers Microsoft/OpenAI and Microsoft/Inflection, which were not subject to German merger control due to the lack of domestic activity of the target companies.

Also new is a preliminary notice procedure (the so-called “Phase 0”): Concentrations that are notifiable solely due to the transaction value threshold must initially only be “briefly” noticed to the Federal Cartel Office. The Federal Cartel Office then decides within two weeks whether a full notification is required. Otherwise, the concentration is deemed cleared.

Comment of the Federal Cartel Office

The Federal Cartel Office fundamentally welcomes this approach but considers the regulation not far-reaching enough and suggests abandoning the concept of “significant domestic activity” in favor of the established criterion of domestic effects. It also proposes making the new notice procedure voluntary, so that the parties to the concentration do not have to take the “detour” via the notice procedure in obviously notifiable cases.

Practical Significance

Under the new version, a notification obligation must be particularly critically examined for all concentrations with a purchase price of more than EUR 400 million and exceeding the worldwide and 1st domestic turnover thresholds. This now applies regardless of whether the target company has so far generated even minimal revenue in Germany or was represented on the German market in any form.

The newly adopted criterion of “expected activity in Germany” is also completely undefined. If future activity in Germany appears even remotely possible, it should already be assumed as a precautionary measure that this requirement is met.

Should the regulation be implemented, it remains to be hoped that the Federal Cartel Office will revise its guidelines on the transaction value threshold (current version available here: Federal Cartel Office – Homepage – Guidelines on Transaction Value Thresholds) and include concretizing examples.

However, the new notice procedure is welcome, as it formalizes the previously practiced informal preliminary coordination with the Federal Cartel Office in doubtful cases and thus ensures legal certainty regarding a non-required notification. The only question is how “brief” the notification can actually be if they undertakings also need to include a presentation of the strategic and economic reasons for the concentration (which has not been required so far in merger control proceedings before the Federal Cartel Office).

III. More Legal Certainty for Vertical Agreements

What is new?

The right of companies to a formal decision by the Federal Cartel Office that there are no grounds for action (Section 32c GWB) is extended to vertical agreements by deleting the words “between competitors.” In the future, manufacturer-dealer relationships or other vertical agreements, such as selective distribution systems or data pools, may also be submitted to the Federal Cartel Office for assessment when there is significant legal and economic interest.

Comment of the Federal Cartel Office

The Federal Cartel Office fears significant resource burdens due to the expansion, as particularly large brand manufacturers are likely to submit their distribution models to the authority. It argues there is no need given the exemption possibilities under the Vertical Block Exemption Regulation (EU Regulation 2022/720) and the detailed guidelines of the European Commission.

Practical Significance

Companies with complex or innovative distribution structures should nonetheless gain a valuable opportunity to obtain regulatory certainty through the revised regulation.

IV. Procurement Screening: New Weapon Against Bid-Rigging

What is new?

The new regulation enables the Federal Cartel Office for the first time to conduct suspicion-independent, systematic analysis of bidder data from public procurement procedures (Sections 32h, 114(4) and (5) GWB Draft). For this purpose, public contracting authorities will in the future be required to transmit the data of all bidders involved in the procedure – including of unsuccessful companies – to the Public Procurement Data Service. The Federal Cartel Office also has access to this data.

Comment of the Federal Cartel Office

The Federal Cartel Office expressly welcomes this new measure – already established in other member states – and points to the enormous damage caused by bid-rigging. Particularly in light of the special fund of over 500 billion euros for infrastructure and climate neutrality, this instrument takes on particular significance. The new regulation also has a deterrent effect.

Practical Significance

The expanded analytical capacities of the Federal Cartel Office increase transparency in procurement and the prevention of bid-rigging cartels. A robust compliance organization helps to identify and avoid potential risks early on.

V. Energy Sector Abuse Supervision Extended

What is new?

The special abuse supervision under Section 29 GWB (a special provision for energy markets), which enables the Federal Cartel Office to take numerous incisive measures against dominant energy suppliers, is being extended by five years until the end of 2032 (Section 187(1) GWB Draft).

Comment of the Federal Cartel Office

The Federal Cartel Office welcomes the extension but would have preferred a permanent removal of the time limit, as no improvement in market structure is expected in the foreseeable future in areas such as district heating supply or electricity generation.

Practical Significance

Energy suppliers and municipal utilities should note that the stricter price control continues and the political discussion about further tightening – particularly regarding district heating – is likely to intensify.

VI. Procedural Simplifications and Miscellaneous

The GWB Draft contains a comprehensive bundle of procedural simplifications: From 2028, merger control notifications must be submitted exclusively digitally (Section 39(1) sentence 3 GWB Draft). Appeals on points of law against decisions of the Higher Regional Courts will no longer require leave, making lengthy non-admission appeal proceedings before the Federal Court of Justice unnecessary (Section 77 GWB Draft). Additionally, service procedures are being simplified and the Federal Cartel Office’s publication obligations are being expanded (Sections 43(4), 61(3) GWB Draft).

For the first time, the term of office of the President of the Federal Cartel Office is being limited to eight years, without the possibility of reappointment (Section 51a GWB Draft) (for context: the current President of the Federal Cartel Office, Andreas Mundt, has already been in office for more than 17 years). Germany thus follows the European standard, as it was previously the only EU country without such a time limit.

The previously until end of 2027 time-limited regulation in Section 30(2b) GWB, which exempted certain agreements of newspaper and magazine publishers from the cartel prohibition, has now been made permanent (Section 187(6) GWB Draft).

The fees for conducting administrative and merger control proceedings are being significantly increased (Section 62(2) GWB Draft). The average fees for Phase I merger control proceedings are expected to rise from EUR 7,500 to EUR 10,000.

In the event of a successful appeal by an intervening party against a merger control clearance, divestiture is no longer envisaged; instead, a new main investigation procedure will be conducted (Sections 40(6), 41(1) GWB Draft).

In the area of petrol station prices, petrol station operators are now required, in addition to the previously required transmission of prices for diesel, Super E5, and Super E10, to also transmit prices for Super Plus to the Market Transparency Unit for Fuels (which in turn are forwarded to fuel price apps) (Section 47k GWB Draft).

VII. Conclusion

The presented GWB Draft brings a breath of fresh air to German competition law: Fewer notification obligations through higher turnover thresholds, but more “bite” when it comes to bid-rigging and “killer acquisitions.” The Federal Cartel Office has taken a differentiated position in its statement; in particular, it views the renewed threshold increase critically.

For companies, this means: Compliance structures and M&A strategies should already be put to the test now. The draft is currently undergoing the legislative process; changes remain possible. We will continue to monitor further developments and keep you informed.

1. Facts

The case originated from a dispute before the Lower Saxony Regional Labour Court (Landesarbeitsgericht Niedersachsen). An employer brought damages claims against a former employee who allegedly sold company property online without authorization. The data submitted as evidence by the employer may have been collected in violation of data protection requirements.

The referring court asked the CJEU whether the GDPR (Datenschutz-Grundverordnung – DSGVO, i. e. the General Data Protection Regulation) precludes the judicial use of such data, which legal basis applies for data processing in court proceedings, and whether Art. 17(3)(e) GDPR can serve as an independent legal basis.

2. Key Findings of the CJEU

The CJEU clarifies that the GDPR does not establish an automatic prohibition on the use of personal data as evidence that was previously collected or otherwise processed in violation of the GDPR.

The data protection-questionable collection of personal data by a party or third party does not, as such, prevent a national court from using the evidence. As a legal basis for the processing of personal data by courts, Art. 6(1)(c) GDPR, Art. 6(3) GDPR in conjunction with a national legal basis may apply, insofar as the court is obligated under national law to investigate the facts and evaluate evidence.

For German civil and labour court proceedings, Art. 92 GG (Grundgesetz – Basic Law), §§ 138, 286, 355 et seq. ZPO (Zivilprozessordnung – Code of Civil Procedure) and the labour court procedural rules are relevant. These provisions require the parties to present substantiated factual submissions and the court to comprehensively evaluate the case material.

At the same time, the CJEU emphasizes that Art. 17(3)(e) GDPR does not constitute an independent legal basis for data processing. The provision merely limits the right to erasure insofar as the processing is necessary for the establishment, exercise, or defence of legal claims. The lawfulness of processing must still be assessed under Art. 6 GDPR and, where applicable, further provisions.

3. No Carte Blanche for Unlawful Data Collection

The decision benefits the party bearing the burden of proof but is not a carte blanche for unlawful data collection. Data protection violations in the original collection or securing of personal data can still have significant consequences, including:

• Damages claims under Art. 82 GDPR,
• Supervisory authority measures and fines under Art. 58, 83 GDPR,
• Erasure claims under Art. 17 GDPR,
• Reputational damage,
• and in individual cases, national prohibitions on the use of evidence in cases of particularly serious fundamental rights violations.

For companies: A data protection violation does not necessarily destroy the procedural value of evidence. However, every data protection violation remains an independent compliance and liability risk.

4. Significance for Internal Investigations

The decision is particularly relevant for internal investigations, such as in cases of suspected fraud, embezzlement, disclosure of trade secrets, corruption, antitrust violations, data protection violations, or other breaches of duty.

In practice, internal investigations frequently involve the processing of employee personal data, particularly from:

• work email accounts,
• chat and collaboration tools,
• log files and access data,
• cloud storage,
• CRM and ERP systems,
• access control data,
• other device and usage data.

Access to and evaluation of personal data must always be based on a suitable legal basis, in particular Art. 6(1)(f) GDPR (legitimate interests), Art. 6(1)(c) GDPR (legal obligations), § 26(1) sentence 1 BDSG (Bundesdatenschutzgesetz – Federal Data Protection Act) for employment purposes, and § 26(1) sentence 2 BDSG for investigations to uncover criminal offences.

For special categories of personal data (e.g., health data, trade union membership, religious affiliation), Art. 9 GDPR, § 26(3) BDSG and, where applicable, § 22 BDSG must also be observed. Where data relates to criminal offences or convictions, Art. 10 GDPR applies.

5. Access to Employee Email Accounts

Private use of company communication tools should be clearly regulated. This creates legal certainty and facilitates lawful access in case of need.

From an employer’s perspective, the safest approach is usually to expressly prohibit private use of work email accounts and IT systems. The prohibition should be set out in the employment contract, an IT policy, or a works agreement and enforced in practice. If private use is tolerated over a longer period despite a prohibition, this can impair the permissibility of later access, as the legal requirements are significantly higher.

While it is increasingly argued that employers are not subject to telecommunications secrecy under § 3 TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – Telecommunications Digital Services Data Protection Act) even where private use is permitted or tolerated, a definitive ruling from the highest courts is still pending. Companies should therefore either prohibit private use or at least clearly regulate it and additionally implement technical and organizational safeguards.

An IT or email policy should comply with the information obligations under Art. 13, 14 GDPR and should in particular regulate:

• whether private use is permitted, prohibited, or only exceptionally allowed,
• whether private content must be specially marked or stored in private folders,
• under what conditions work mailboxes may be accessed,
• which departments decide on access,
• how private or obviously irrelevant content is filtered out,
• what logging and documentation obligations apply,
• how long data is retained.

6. Requirements for Internal Investigations

Internal investigations must be incident-related, purpose-bound, and proportionate. The principles of Art. 5(1) GDPR are decisive: lawfulness, transparency, purpose limitation, data minimization, accuracy, storage limitation, and integrity and confidentiality.

Where there is suspicion of criminal offences in the employment relationship, § 26(1) sentence 2 BDSG requires documented factual indications to substantiate the suspicion. The processing of personal data must be necessary for detection, and the legitimate interests of the affected employee must not outweigh. The nature and extent of data processing must be proportionate to the occasion.

Before accessing (private) communication data, it should be examined whether less intrusive means are available, such as the evaluation of contractual documents, invoices, system logs, metadata, or interviews with other parties involved. Email mailboxes should only be evaluated when this is necessary for (further) investigation.

7. Works Council and Collective Agreements

Where a works council exists, co-determination rights under § 87(1) No. 6 BetrVG (Betriebsverfassungsgesetz – Works Constitution Act) must be observed insofar as technical systems are used that are capable of monitoring employee behaviour or performance. This includes log file evaluations, monitoring tools, DLP systems, SIEM systems, and collaboration tools.

A works agreement can also serve as an important data protection legal basis for the processing of personal data. Under § 26(4) BDSG, personal employee data may be processed on the basis of collective agreements; however, these must meet the requirements of Art. 88(2) GDPR and provide appropriate safeguards for the rights and freedoms of employees.

8. Documentation and Safeguards

Internal investigations should always be conducted on the basis of a documented approval process. Before the measure begins, the following should be documented:

• the specific investigation reason,
• the legal basis under Art. 6 GDPR and, where applicable, § 26 BDSG,
• the investigation purpose,
• the affected data sources,
• the less intrusive measures considered,
• the circle of authorized persons,
• the search criteria and evaluation method,
• the handling of private or irrelevant content,
• retention and deletion periods,
• the involvement of Legal, Compliance, HR, IT, and the Data Protection Officer.

Organizationally, the need-to-know principle, the four-eyes principle, access restrictions, logging, measures to maintain confidentiality, and data security under Art. 32 GDPR should be observed and implemented. For extensive or systematic monitoring measures, a Data Protection Impact Assessment under Art. 35 GDPR is regularly required. The processing must be recorded in the record of processing activities under Art. 30 GDPR.

9. Procedural Consequences

If an investigation result is to be used later in court proceedings, companies should prepare the data in a litigation-ready manner already during the investigation. Unnecessary personal data, private content, and data of uninvolved third parties should be filtered out, redacted, or pseudonymized.

The CJEU decision strengthens the possibility of using personal data as evidence in court proceedings. At the same time, it confirms that every processing of personal data requires a legal basis and that the principle of data minimization under Art. 5(1)(c) GDPR must be observed when disclosing data to opposing parties or third parties.

10. Recommendations for Action

Companies should not wait until a crisis to take action in the context of internal investigations but should proactively and transparently provide policies in advance. The following is recommended in particular:

a. Introduction and/or regular updating of an internal IT and email policy.
b. Clear regulation of private use of work communication tools.
c. Transparent access reservations for compliance and investigation cases.
d. Works agreement for co-determination-required technical systems.
e. Regulate and document investigation and approval processes.
f. Involvement of the Data Protection Officer, Legal, Compliance, HR, and IT.
g. Logging of the respective measures and the balancing of interests.
h. Clear deletion and retention concepts.
i. Data protection-compliant preparation of evidence for court proceedings.

11. Conclusion

The CJEU clarifies: The GDPR does not establish an automatic prohibition on the use of evidence for personal data that may have been obtained in violation of the GDPR.

Nevertheless, the data protection permissibility of internal investigations must continue to be reviewed. Employers should therefore establish the legal foundations for access to employee data at an early stage. Decisive factors are clear regulations and concepts, as well as, in the case of an investigation, the documentation of grounds for suspicion and the measures taken to safeguard the rights of affected employees.

At the same time, particularly in the real estate sector, the volume of maturing liabilities is increasing significantly. In Germany alone, commercial real estate financings totaling approximately EUR 82 billion will mature in 2026. A large portion of these loans originated during the low-interest-rate period of 2015–2020. Refinancing is now only possible on significantly less favorable terms. The risk of covenant breaches and loan terminations is growing. Simultaneously, available capital is being allocated more selectively, in part due to increased regulatory requirements for credit institutions. In summary: a wave of refinancing is hitting a market environment that has become considerably more challenging.

For management boards, the question therefore arises as to what courses of action are available when necessary follow-on financings are difficult or even impossible to obtain.

I. Options Review in the Case of Difficult Follow-On Financing

Option 1: Buying Time Through Amend & Extend Arrangements

The significance of amend & extend arrangements has increased against the backdrop of the elevated interest rate environment and the “Wall of Maturity.” On the one hand, the terms of existing loans are adjusted or supplemented (“Amend”), for example through “lighter” covenants (financial ratios) and restricted termination rights. On the other hand, the maturities of financial liabilities are extended (“Extend”). This is particularly useful for overcoming a temporally manageable liquidity shortfall. By deferring the immediately upcoming maturity of a loan, time is gained for restructuring measures. An amend and extend arrangement therefore regularly constitutes a bridging instrument before more extensive restructuring measures are implemented or an improved market environment later enables refinancing. Unless the StaRUG (German Corporate Stabilization and Restructuring Act) or the SchVG (German Bond Act) are utilized, consensus between the debtor and all financiers involved in the restructuring is required.

Option 2: Restructuring of Liabilities Under StaRUG Proceedings

From the onset of imminent illiquidity (Section 18 InsO), restructuring by means of the StaRUG is a proven course of action in practice. The centerpiece of the reorganization of liabilities in this case is a detailed restructuring plan, together with a comparative calculation regarding the next-best alternative scenario. In particular, the plan may provide for new maturity dates, interest arrangements, debt haircuts, or the exchange of claims for equity interests. A key advantage of restructuring under StaRUG proceedings is that the restructuring plan does not need to include all creditors and shareholders. Rather, the company itself selects the plan-affected parties based on objective criteria and allocates them into groups accordingly. Plan adoption requires a majority of 75 % of voting rights, measured by the value of claims or equity interests, in all groups. The lack of consent by one or more groups may, under certain conditions, be judicially overridden by means of a “cross-class cram-down.”

Once the required majorities are achieved, the restructuring plan is binding on all plan-affected parties, regardless of whether they participated in the vote or how they may have voted.

Option 3: Restructuring of Bonds Under the German Bond Act (SchVG)

In cases where only bonds are affected, restructuring under the German Bond Act (Schuldverschreibungsgesetz – SchVG) is possible. The SchVG enables amendments to the bond terms, such as the reduction of interest rates, changes to the maturity of the principal claim, or the replacement of security interests. The prerequisite is a resolution by the bondholders, which is adopted at an initial bondholders’ meeting or in a vote without a meeting pursuant to Section 18 SchVG. The meeting has a quorum if at least 50 % of the outstanding bonds of an issue are represented (Section 15(3) sentence 1 SchVG). However, for amendments to the material content of the bond terms, a qualified majority of at least 75 % of the participating voting rights is required. If the quorum requirement is not met, a second bondholders’ meeting may be convened. For the resolutions of interest here, which require a qualified majority (see above), a quorum of 25 % of the outstanding bonds is then required for the meeting to have a quorum.

A key difference from StaRUG proceedings is that a separate SchVG procedure is required for each affected bond issue, in which the respective required majorities must be achieved.

Option 4: Plan-Based Reorganization Under Debtor-in-Possession Management

Once mandatory insolvency grounds exist (inability to pay debts as they fall due pursuant to Section 17 InsO, and in the case of entities with limited liability, also over-indebtedness pursuant to Section 19 InsO), the members of the representative body are obligated to file for insolvency (Section 15a(1) InsO). With sufficient preparation, reorganization is generally possible under debtor-in-possession management pursuant to Sections 270 et seq. InsO, whereby the management board or managing directors retain their powers of disposition and ability to act. Instead of an insolvency administrator, only a custodian (Sachwalter) is appointed as a supervisory person, who monitors compliance with creditors’ rights in particular. The key prerequisite is careful debtor-in-possession planning, demonstrating that the company is fully funded for six months during the proceedings. In addition, a preliminary concept for reorganization must be presented. Preservation of the insolvent legal entity – i. e., the stock corporation (AG) or limited liability company (GmbH) – is possible through an insolvency plan reorganization. Provided that inability to pay has not yet occurred and the intended reorganization is not without prospect of success, there is the possibility of protective shield proceedings (Section 270d InsO) during the opening phase, which grants the debtor a fundamentally binding right to propose the person of the custodian.

Due to insolvency money (Insolvenzgeld) and the possibility of intervening in contracts that are binding outside of insolvency through election rights and special termination rights, insolvency reorganization may, after careful deliberation, be the best course of action in individual cases. It is available on a voluntary basis from the onset of imminent illiquidity (time horizon: 24 months) as an alternative to a purely financial restructuring under the StaRUG.

II. Conclusion

The “Wall of Maturity” is hitting the German economy with full force and will continue to occupy it for a considerable period of time. In fulfillment of their general duties to avert crises pursuant to Section 1 StaRUG, management boards should therefore examine in a timely manner which legal and commercial courses of action are available to them in the event of problematic refinancings. Time pressure, complexity, and liability risks can at times overwhelm even experienced management boards. The early and consistent involvement of experts as well as a thorough options analysis are therefore recommended.

While the goal was generally applauded, the 2025 draft EUSA was, and still is, confronted with significant criticism from stakeholders. The criticism focuses on competence, procedure, scope, proportionality, third-country access and the allocation of functions between Member States, EUSPA, ESA and the Commission.

Against this background, the Danish Presidency of the Council of the European Union published a “Compromise Text” in December 2025, and the Cypriot Presidency followed up in March 2026 with a revised “Compromise Text 2” (together, the “Compromise Texts”). The latter was reportedly informally aligned with the EU Commission and some Member States. On the side of the European Parliament, the ITRE Committee (3 March 2026, “ITRE Report”), the IMCO Committee (25 March 2026), and the ENVI Committee (March 2026) also issued proposals for significant amendments. In addition, the Renew Europe group published a comprehensive set of amendments on 14 April 2026 (“Renew Amendments”), proposing a fundamental restructuring of the governance architecture while involving ESA more as a cooperation partner than the 2025 draft EUSA envisaged. Further papers not yet officially published and views from other political groups of the European Parliament are also being discussed.

In order to determine the status of this somewhat confusing situation, the Presidency of the Council of the European Union published a “Progress Report” dated 8 May 2026 (the “Council Progress Report”), with the aim of clarifying the status of positions.

The 2025 draft EUSA and the state of play in a nutshell:

The Big Picture – Primary Goals of the 2025 draft EUSA (EUSA Goals)

• ensure that space activities are carried out in a safe, resilient and sustainable way (“Activity Goal”)

• strengthen the competitiveness of the EU space industry (“Strategic Goal”) by reducing legal fragmentation and providing a regulatory level playing field within the internal market

Main Characteristics of the 2025 draft EUSA

• directly binding regulation with harmonised safety, resilience, and sustainability requirements; no general implementation leeway for the Member States within the scope of the 2025 draft EUSA

• responsibility at Member State level, while responsibility for registration and the grant of an e-certificate lies at EU level

• internal level playing field through harmonised authorisation following a one-stop-shop objective across the EU

• provision of stringent and, in part, micro-level prescriptive requirements, together with even more detailed technical annexes and further delegated acts still to come

• (limited) light-touch regimes and capacity-building measures to counter the expected economic burdens arising from the 2025 draft EUSA

Strategic Goal of the EUSA – Achieving Competitiveness

• ensure a level playing field for the internal market, aiming to avoid regulatory fragmentation and forum shopping

• free movement within the EU, aiming to achieve a one-stop-shop principle as regards authorisation

• increased legal certainty for technological development and financing

• facilitation of innovation by providing legal certainty and applying the one-stop-shop principle

• application also to non-EU stakeholders aiming to provide services for the internal market

Stakeholder Reactions – Areas of Published Concerns and Criticism

• Overall EU competence, regarding both the EU’s overall competence to harmonise space regulation and the extensive use of competence grants for further regulation through insufficiently checked delegated acts

• Achievement of strategic goals, in particular regarding the free movement / one-stop-shop goal, including various potential obstacles, and the ultimate goal of enhancing competitiveness

• Procedural concerns because of uncertainties, the complexity and length of the procedures, the risk of duplicative elements, the requirement for numerous parallel authorisations, and the overall administrative burden

• Scope, proposing, inter alia, to leave resilience outside the scope (advocating the application of existing NIS2 and CER regimes to cover all space operations), questioning the need to include binding environmental sustainability provisions instead of using regulatory sandboxes, and regarding the inclusion of stringent light-pollution limitations

• Application to non-EU stakeholders, in particular regarding various loopholes or overreaching effects, a number of uncertainties regarding the application to non-EU stakeholders, and the risk of a cut-off from critical supply chains

• National security derogation, seen as a danger to the overall application of the EUSA because of the gaps and loopholes created by the existing wording

• Technical drafting deficiencies, regarding the actual wording, the structure, the ambiguity of material definitions, and the partly duplicative character of the text

• The practical application of the principle of proportionality is also heavily criticised, mainly because of the lack of robust risk-calibrated regulation, while others reject size-based proportionality.

Making it Better – Main Recommendations from Stakeholders

The overarching themes of the recommendations voiced are:

• simplification is necessary, and procedural timelines should be limited
• scale down requirements in proportion to risk rather than according to numbers or other formal KPIs
• review and restrict the scope of binding requirements, in particular for sustainability on Earth, and also by taking advantage of existing regimes (NIS2 – resilience)
• take advantage of already existing technical standards and solutions followed by the space industry and avoid creating artificial new standards that are not aligned
• provide more concrete facilitation and cost-covering grants to counter the burden imposed on stakeholders and Member States
• work with objectives and goal setting rather than binding prescribed solutions
• generally, review the technique, definitions, and structure to avoid duplications, loopholes, and logical errors and to make the draft a better, more technically robust document
• provide regulatory sandboxes to foster innovation where appropriate
• work with non-EU states as partners to achieve mutual recognition and avoid additional challenges for supply chains that would counter the strategic goals
• in particular, regard ESA as a more knowledgeable partner in certain areas and not as an entity to be regulated.

Reaction of the Compromise and Other Texts to Stakeholder Concerns

The various papers and alternative proposals address the main concerns in diverse and very different ways:

• simplification proposals range from minor tweaks and significant changes to the definition section to concentrating almost all responsibilities at EU level, away from Member States
• scope adjustments propose mainly deleting the resilience part from the EUSA and shifting it to existing NIS2 legislation
• proportionality remains heavily contested, with solutions ranging from wider easements and lighter regimes to the deletion of all purely size-based easements
• non-EU application is still under discussion, ranging from an even tighter regime to significant exemptions and lighter procedures to protect supply chains and existing cooperation arrangements.

In sum, while there has been some movement towards alignment, for instance by shifting parts of the resilience requirements to general NIS2 legislation, most other aspects flagged as problematic by stakeholders are still being discussed in very diverse ways. What is clear is that the discussion, which during most of 2025 and at the beginning of 2026 was primarily technical and legal, now shows clear signs of increasingly becoming a debate on compromise lines between the political groups of the European Parliament.

The Council Progress Report confirms the same picture from the Council side.

In detail:

I. The 2025 draft EUSA

Published on 25 June 2025, the draft EUSA aims to create a single market for space by harmonising authorisation requirements across Member States, establishing a central registration system (URSO), and applying a registration regime to third-country operators serving the EU internal market.

1. Starting Point

In general, according to the draft EUSA, authorisation remains at Member State level (12-month timeline), with Member States choosing between national technical bodies, EUSPA, or international organisations for assessment. Once authorised by the Member States, an operator would receive an e-certificate from EUSPA valid for the entire EU. Third-country operators may benefit from equivalence decisions (Art. 16) or bilateral agreements (Art. 111). If not, they must follow a registration procedure submitted to the EC and assessed by EUSPA. Derogations from EUSA compliance for third-country launch operators are also possible.

If the EUSA were to achieve its goals, it would deliver genuine free movement of space activities across the EU, promote sustainable investment through a clearer risk framework for insurers and investors, provide legal certainty for emerging ISOS technologies, and support competitiveness through capacity-building measures. Whether it can actually deliver on these goals in its current form is the central question.

2. Achievable Goals

Based on the feedback and the direction of the 2025 draft EUSA, several aspects indicate how the EUSA could contribute positively to the broader space ecosystem:

Free movement of space activities: The adoption of an EUSA would be beneficial for Union space operators if it established a true single authorisation and central registration procedure that eliminated the burden on operators currently required to seek authorisation and licensing from different jurisdictions for a single mission. This multiplicity of authorisations creates operational, administrative, and economic burdens. In this respect, less administrative duplication would be better.

Promotion of sustainable investment: The EUSA promotes safe, resilient, and sustainable space operations that would positively affect sustainable investment and growth in the space sector. As the LEO environment becomes increasingly congested, and therefore riskier to operate in, it is becoming difficult, for instance, to quantify risks for space insurers and investors. Safe, resilient, and sustainable space activities ensured through the draft EUSA would help create an EU space market that may be more attractive to investors.

Promotion of cutting-edge technologies: At the moment, ISOS activities are still at an early stage, and only a few examples of such activities have been authorised so far. However, as the technology matures, one of the main obstacles to its development has been identified as the lack of clear governance. Although ISOS missions have been authorised by the US and the UK, there are still very few national space laws that address ISOS within their jurisdiction. By addressing the authorisation and technical requirements for conducting these activities, the EUSA would help provide clarity, safety, and security for ISOS operations and therefore support the development of ISOS technologies within the EU market.

Capacity-building measures supporting the development of cybersecurity solutions for the space sector, the EU space label, and ISOS technologies would help support growth and innovation in the EU space sector.

II. Stakeholder Reactions

1. EU Space Operators’ Comments on the EUSA

Based on the open consultation (closed 7 November 2025), stakeholder concerns include:

• the EU’s overall competence to harmonise space and the wide delegation of powers via implementing acts

• procedural complexity (lengthy timelines, duplicative elements, unclear multi-country allocation)

• fundamental questions about the EUSA’s scope (resilience/NIS2 overlap, binding sustainability provisions, light pollution)

• the application to non-EU stakeholders, national security derogation loopholes and technical drafting deficiencies

• the contested principle of proportionality (risk-based versus size-based regulation)

• many stakeholders question whether the 2025 draft EUSA can actually achieve a level playing field in the internal market or whether it will achieve its strategic goals of strengthening competitiveness.

The Council Progress Report confirms that these concerns had become core Council negotiating points. Although delegations considered the Presidency compromise text to be moving in the right direction by reducing complexity and simplifying the text, Member States continued to identify open issues on scope and dual-use exemptions, governance allocation, duplication with national procedures and third-country equivalence. The key areas of criticism may be described as follows:

1. Language and scope: Key definitions (space services, space activities, operation, control, primary provider of space-based data) lack clarity. Subsidiaries and activities such as GSSaaS, hosted payloads, and orbital transfer vehicles create scope uncertainty. The EUSA is further criticised for failing to address supply-chain resilience as a sovereignty issue.

2. Governance and authorisation: The governance structure is viewed as overly complex, with unclear roles between national authorities, EUSPA, and ESA. The authorisation process is considered too lengthy (12 months), and the conditions for constellation blanket authorisations are viewed as overly strict. Supervisory inspection powers are considered excessive.

3. Proportionality and lighter regimes: Important EU operators oppose derogations for third-country operators and call for equal treatment irrespective of origin. Controversially, many also oppose size-based exemptions for small companies, arguing that regulatory relief should depend on the mission’s risk profile rather than the operator’s size. Somewhat surprisingly, this argument is not made with respect to exemptions for research and education missions.

4. Technical requirements and safety: Requirements are criticised as overly prescriptive and not technology-neutral. Orbit selection and light pollution provisions (magnitude 7 threshold) are deemed unrealistic. The mega/giga constellation distinction lacks scientific basis, and collision risk is not correlated with the number of satellites in a constellation.

5. Resilience and sustainability: Operators point to duplication with NIS2, CER, and the Cyber Resilience Act and argue that adding another resilience layer under the EUSA is unnecessarily burdensome. On sustainability, operators are concerned about duplicating existing ESA standards (LCA methodologies, PEFR4Space) and warn that EF calculation costs will fall heavily on industry. In addition, the direct supply chain requirements are seen as unrealistic in certain cases.

6. Further notable points raised by stakeholders include:

• the need for post-implementation reassessment with additional R&D support

• proposals to reduce the authorisation timeline to two weeks

• the call for EEA/ESA countries not to be treated as third countries

• risk-based and phased compliance requirements, and

• separation of launch, spacecraft, and data services regulation into distinct frameworks.

2. Third-country Space Operators’ Comments on the EUSA

Third-country space operators generally welcome harmonisation but heavily criticise the 2025 draft EUSA’s extraterritorial reach, complexity, and barriers to market access. Key concerns are:

• The extraterritorial effect and scope of application to non-EU stakeholders are heavily criticised. The broad interpretation of “operation” and “control” risks extending EU jurisdiction in ways that conflict with national frameworks (e.g., ITAR). Inspection powers applied to third-country entities are considered infeasible, and the supervisory structure between Member States, EUSPA, and the Commission needs clearer delineation.

• The registration procedure is seen as duplicative and discriminatory without equivalence decisions or international agreements. Technical requirements are viewed as overly prescriptive (especially light pollution thresholds), and the economic impact of EF calculation is highlighted. Long transition periods and future implementing acts create mission planning uncertainty.

• Additionally, third-country operators flag that ISOS obligations should clarify that a servicer does not become the operator of the client spacecraft, that the EUSA fails to distinguish between crewed and uncrewed systems, and that a non-prescriptive framework similar to the U.S. approach would be preferable.

III. Proposals for New Versions of the EUSA

The Council Progress Report proposes to account for this criticism in certain areas.

The ITRE Report (rapporteur Donazzan, ECR; 3 March 2026) simplifies within the existing architecture. The Compromise Texts (Danish December 2025, Cypriot March 2026) introduce EU-wide certification while preserving Member State authorisation. The Renew Amendments (Grudler, Løkkegaard, Stürgkh, Hojsík, Friis; 14 April 2026) propose a fundamental restructuring.

The following is a thematic comparison:

Governance and authorisation: The ITRE Report accelerates timelines (5 working days for completeness, 3 months for assessment, 6 months for decision) and simplifies supervision. The Compromise Text replaces national authorisation with EU-wide EUSA certification granted by the Member State of establishment but valid EU-wide. The Renew Amendments go furthest: EUSPA becomes the sole authorisation-issuing authority with a 3-month timeline, including liability, insurance, and professional competence examination, while ESA becomes the sole qualified technical body under a binding arrangement obligation.

Scope and complexity: All three proposals significantly reduce complexity. The ITRE Report and Compromise Text delete the Union Space Labelling system, mega/giga constellation classifications, supply chain engagement, and numerous definitions. The Compromise Texts additionally expand exemptions (e.g., beyond graveyard orbit). Although the Renew Amendments keep the Labelling system, mega constellations, and supply chain engagement, they achieve simplification by deleting sub-definitions that do not have independent legal weight (e.g., mission control centre).

Resilience and NIS2: The ITRE Report materially deletes resilience pillar elements. The Compromise Texts largely remove the pillar, relying on the expanded NIS2 scope. The Renew Amendments complete this trajectory: the pillar is fully removed, the lex specialis character is abandoned, and NIS2 is amended to explicitly include all space operators. Only complementary requirements for mission-critical functions (telecommand integrity, ground-segment security) are retained.

Technical requirements: The Compromise Texts simplify safety rules and evolve brightness requirements into broader minimisation obligations. The Renew Amendments replace the fixed magnitude 7 threshold with a best-efforts obligation, delete the giga-constellation category, and introduce a two-route compliance architecture: either compliance with the requirements in the EUSA or compliance with harmonised standards (presumption of conformity), supported by an alternative safety case.

Proportionality and easements: The proposals diverge sharply in this area. The ITRE Report expands lighter regimes to a broader range of larger companies. The Compromise Texts exempt SMEs, small mid-caps, and research institutions, particularly for IOD/IOV. The Renew Amendments take the opposite approach: the size-based simplified risk management category is deleted; requirements apply uniformly based on mission risk, not operator size.

Equivalence and third-country access: The ITRE Report refines the equivalence mechanism (partial/full, 5-year validity, 3-year review). The Renew Amendments delete the mechanism entirely (Art. 105): all operators face the same URSA registration and technical assessment; recognition of third-country rules requires international agreements with reciprocal market access.

Economic burden: The ITRE Report introduces targeted financial and procedural support measures. The Compromise Texts remove supply chain engagement requirements, EF obligations, and certification-related administrative steps. The Renew Amendments achieve burden reduction primarily through structural simplification – one authority, one procedure, one technical body – rather than through exemptions.

Capacity building: The ITRE Report and the Compromise Text extend capacity-building measures to SMEs, small mid-caps, and research and education institutions to provide technological, technical, and management support, guidance materials, methodologies, and best practices to achieve compliance.

The Council Progress Report records that delegations saw simplification progress but treated four clusters as open: scope and dual-use exemptions, governance and responsibility allocation, duplication risks, and third-country access/equivalence. The Council Progress Report therefore confirms that the Council had not reached a settled position but was carrying the file forward for further examination.

The revision proposals in the Council Progress Report address many concerns. Room for further refinement, and therefore for compromise, remains. Solutions could include:

• Shortened authorisation process: The process should be tailored to operational complexity; less complex operations could be handled in significantly less than six months.

• Foster innovation: Move from very prescriptive rules to outcome-based requirements to allow industry to find its own technical solutions to achieve the relevant goals.

• Align with international standards: A proposed two-route compliance model (harmonised standards or alternative safety case) points in the right direction. Delegated acts should involve industry at the development stage.

• Incentive-based approach where appropriate: Certain requirements should initially remain non-binding, with sandbox regimes and public procurement incentives (EU Space Label) encouraging voluntary compliance before mandatory application. This is a solution proposed by HEUKING from the very beginning and throughout the discussions.

• Risk-based proportionality: Requirements should be calibrated both to the mission’s risk profile (low/standard/high risk) and to operators’ size.

• Administrative cost coverage: It remains unclear whether compliance costs for Member States and EUSPA will be covered by existing budgets. Dedicated funding is needed.

• Direct funding support: Capacity-building should include direct funding for SMEs, research institutions, and medium-sized companies to implement technical requirements.

IV. Conclusion

The 2025 draft EUSA, if properly calibrated, could harmonise fragmented national frameworks and promote safety, resilience, and sustainability as core principles. It can be assumed that all amendment proposals are united in this aim. The proposals, however, differ significantly on how to reach those goals and what priorities to set.

The ITRE Report and the Compromise Texts introduce important simplifications. The Renew Amendments go even a step further with a genuinely centralised governance model centred on EUSPA, a clearer reduction of NIS2 duplication, and the rejection of size-based easements in favour of risk-based regulation.

Nevertheless, it remains unclear how in particular the Renew approach would foster innovation or growth in the space sector. Centralisation may increase coherence, but it also risks cementing the role of established actors and favouring established space-faring nations. Limiting exemptions for SMEs and research and educational institutions could therefore weaken precisely the actors that often drive experimentation, spin-offs, and broader sectoral development. A risk-based approach is important, but it should not be applied in a way that removes all size-sensitive relief where that relief is necessary to preserve market entry and genuine competition.

Accordingly, the Council Progress Report reinforces that the decisive test for the EUSA should be whether the final text delivers genuine simplification rather than merely reallocating tasks between Member States, EUSPA, ESA and the Commission. A one-stop-shop will only strengthen competitiveness if operators face shorter, predictable procedures and if overlapping national and Union layers are avoided. As long as the EUSA does not also centralise national security, dual-use matters and liability regimes at EU level (which would be against the cornerstones of the EU), any talk about a one-stop-shop will remain relative and any such claim is overstated.

Second, proportionality should not be treated as a binary choice between mission-risk criteria and size-sensitive relief. The final architecture should combine risk-calibrated technical obligations with targeted relief and funding for SMEs, research institutions and mid-sized operators where compliance costs would otherwise deter market entry.

Third, the external dimension should remain integral to the competitiveness analysis. The EU can pursue high safety, resilience and sustainability standards, but it should do so through alignment with existing technical standards, meaningful use of ESA expertise and workable routes for mutual recognition or international agreements, so that supply chains and established cooperation models are not unnecessarily disrupted.

About the Co-Author

Dr. Merve Erdem Burger

Co-founder of Swiss Space Law Forum, independent space law consultant

Dr. Merve Erdem Burger currently runs her independent space law & policy consultancy in Switzerland and Türkiye, and provides specialized training in space law for academic institutions and government agencies. Before establishing her consultancy, she completed her post-doctoral research at the Chair of Public International Law, Faculty of Law, University of Neuchâtel, Switzerland, where she also taught International Space Law in the Master of Law program.

What Is Coming: An Overview of the New Criminal Offences

The Directive harmonises European criminal anti-corruption law. The catalogue of offences comprises:

• Bribery in the public sector (Art. 3): Granting an advantage to a public official in exchange for an act in breach of, or in accordance with, their duties
• Bribery in the private sector (Art. 4): Granting an advantage to employees of private-sector entities in exchange for a breach of duty
• Misappropriation (Art. 5): Misuse of entrusted assets by public officials (and optionally by private individuals)
• Trading in influence (Art. 6): Granting an advantage in exchange for the exercise of improper influence over public officials – new for Germany
• Unlawful exercise of public office (Art. 7): Serious breaches of the law in the exercise of public office – already covered under German law
• Ancillary offences (Arts. 8–11): Obstruction of justice, enrichment through corruption offences, concealment of proceeds of crime, incitement/aiding and abetting/attempt

Art. 6 is of particular relevance for Germany: anyone who grants an advantage to a third party in exchange for that party exercising improper influence over a public official commits an offence – irrespective of whether the influence is actually exercised. The German legislature will need to create a new criminal offence here, since section 108f of the Criminal Code (StGB) only covers holders of elected mandates. For companies, the distinction from legitimate lobbying activities remains unclear for the time being.

Sanctions and Prevention

The Directive requires effective, proportionate, and dissuasive sanctions. For natural persons, maximum penalties must reach at least three, four, or five years’ imprisonment depending on the offence. In the case of bribery in the public sector involving a breach of duty, Art. 12 requires a maximum penalty of at least five years.

Legal persons face increased scrutiny. They may be held liable where persons in a leadership position commit corruption offences for the benefit of the entity, or where inadequate supervision or controls made the offence possible. The existing German system of corporate fines under sections 30 and 130 of the Administrative Offences Act (OWiG) is already compliant with EU law.

For core offences (bribery, misappropriation), the fine framework must provide for maximum amounts of at least five percent of total worldwide turnover or EUR 40 million, whichever is higher. For trading in influence, obstruction of justice, and enrichment, the threshold is at least three percent of worldwide turnover or EUR 24 million, whichever is higher. The planned amendment of section 30 OWiG to implement the EU Environmental Crime Directive will already meet these requirements.

Compliance as a Shield: Mitigating Circumstances for Companies

The Directive does not rely solely on repression but also on prevention. Art. 16 expressly identifies effective internal controls, ethics awareness programs, and compliance programs as mitigating circumstances for legal persons. Similarly, a prompt voluntary report to the authorities and the adoption of remedial measures may have a mitigating effect.

Recital 29, however, makes clear: mere “paper tigers” without practical implementation are disregarded. Only those who can demonstrate in a critical situation that their program is genuinely implemented in practice will benefit from the mitigating effect.

In addition, Art. 20 obliges Member States to implement preventive measures and highlights specific risk areas: conflicts of interest, party financing, and “revolving door” situations involving transitions between the public and private sectors. Art. 25 strengthens the protection of whistleblowers.

Practical Guidance

Companies should not wait for the transposition deadline. Those who already have a functioning anti-corruption program in place should review it against the new requirements. Those who do not yet have one should use the time until national transposition to establish one.

The practical benefit of an anti-corruption program lies in its resilience in a critical situation. Documentation is key: only those who can demonstrate that controls, training sessions, and audits have actually taken place will benefit from the mitigating effect. The Directive provides a good opportunity to subject one’s own program to a structured review.

This includes, in particular, the following steps:

• Update the anti-corruption policy: Establish clear rules on gifts, hospitality, donations, sponsoring, conflicts of interest, and the use of consultants. Subject payments to intermediaries to particular scrutiny.
• Sharpen the risk assessment: Identify corruption risks by business area, region, transaction type, and business partner. Document findings and derive appropriate measures.
• Strengthen third-party due diligence: Conduct risk-based reviews of intermediaries, sales consultants, joint venture partners, and public affairs service providers. Combine contractual clauses, approvals, and monitoring.
• Target training effectively: Train sales, procurement, public affairs, management, and international operations using concise case studies. Include trading in influence and contacts with public officials.
• Test the whistleblower system: Review reporting channels, responsibilities, response deadlines, and documentation. Reports must be demonstrably processed.
• Secure compliance records: Document controls, audits, approvals, and remedial measures in a manner that allows them to be promptly presented in the event of an investigation.

This article was written in collaboration with our research assistant Saskia Reimann.

I. Key Content of the CRA

The CRA applies to all economic operators that make products with digital elements available on the Union market. It covers manufacturers, importers, and distributors in particular, with the primary focus of regulation on manufacturers. The term “manufacturer” encompasses not only traditional hardware producers, but also software providers and companies marketing products under their own brand. They are responsible for compliance with the comprehensive cybersecurity requirements of the CRA throughout the entire product lifecycle (as reported in Data Protection Update No. 243).

At the core of the Regulation are requirements for the secure development and design of products, the performance of cybersecurity risk assessments, and the establishment of effective vulnerability management. Manufacturers must, in particular, document and remediate security vulnerabilities and provide security updates during a defined support period. These obligations are supplemented by conformity assessment, documentation, and reporting duties, particularly in respect of actively exploited vulnerabilities and serious security incidents. Importers and distributors, by contrast, are primarily subject to verification, monitoring, and cooperation obligations to ensure that only CRA-compliant products are made available on the Union market.

II. Clarifications by the European Commission

Since the CRA entered into force, the European Commission has begun to clarify key interpretive questions through supplementary documents and legal acts.

The CRA FAQ represent the most comprehensive practical interpretive guidance issued by the Commission to date. Although they are not legally binding, they are intended to be continuously updated as a “living document” and are therefore likely to acquire considerable practical significance for market surveillance authorities and businesses alike. The FAQ clarify, in particular, the material scope of the CRA and confirm that standalone software, firmware, and a wide range of hardware products may all be covered. At the same time, the Commission makes clear that pure websites and standalone SaaS offerings generally do not fall within the scope of the CRA, provided they do not constitute a remote data processing solution forming part of a product with digital elements. Further important clarifications concern the concept of a substantial modification, the requirements for cybersecurity risk assessments, and vulnerability handling. Of particular practical relevance is the statement that manufacturers are not obliged to remediate every vulnerability by means of a patch; rather, risk-based alternative mitigation measures may also be considered. The FAQ also elaborate on the obligations relating to the integration of third-party components and open-source elements. For businesses, however, the question remains open as to what specific requirements will be imposed in future regarding documentation of the risk assessment and the exercise of the requisite due diligence obligations.

Even greater practical impact is likely to result from Implementing Regulation (EU) 2025/2392. The CRA refers, in relation to “important” and “critical” products with digital elements, to Annexes III and IV without further defining the product categories listed therein. The Implementing Regulation now provides, for the first time, detailed technical descriptions of these categories, thereby specifying when more stringent conformity assessment procedures apply. Of particular significance is the “core function” criterion highlighted by the Commission. According to this criterion, the mere integration of a critical or important component does not automatically result in the overall product being classified as an important or critical product. Rather, what remains decisive is the primary function of the overall product. While this resolves numerous demarcation issues, it simultaneously creates new challenges for multifunctional products and complex software solutions. Manufacturers will increasingly need to document why they consider a particular function to be the defining core function. It remains open, in particular, how market surveillance authorities will classify borderline cases, such as AI-powered platforms or integrated security solutions.

The Delegated Regulation (EU) 2026/881 concerns the reporting obligations under Articles 14 and 16 CRA. It establishes the conditions under which a competent CSIRT (Computer Security Incident Response Team; national cybersecurity emergency teams of the EU Member States) may temporarily postpone the dissemination of reports on actively exploited vulnerabilities or serious security incidents. The rationale is the concern that premature disclosure of particularly sensitive information could itself create additional cybersecurity risks. Postponement may be considered, in particular, where a patch or other effective risk mitigation measure is expected to be deployed in the short term, where the reported information could be directly used to develop an exploit, or where a coordinated vulnerability disclosure process is still ongoing. For manufacturers, the Regulation thus provides greater legal certainty in handling sensitive vulnerability reports. At the same time, new practical questions arise regarding coordination with the competent CSIRTs and the delineation of cases in which a legitimate confidentiality interest genuinely prevails.

Finally, the Commission is currently working on the guidelines provided for under Article 26 CRA (as reported in Data Protection Update No. 243). According to the drafts published to date, these guidelines are intended in particular to assist small and medium-sized enterprises with the practical implementation of the Regulation and to provide further clarification on key interpretive questions, such as risk assessment, substantial modifications to products, support periods, and vulnerability handling. Particularly in the area of “substantial modifications,” there is currently considerable legal uncertainty, as this concept determines whether products already placed on the market are once again subject to the CRA requirements. The guidelines could therefore become one of the most important instruments for the practical application of the CRA. At the same time, it remains to be seen whether the Commission merely clarifies existing ambiguities or effectively formulates new requirements. Businesses should therefore closely monitor further developments and continuously adapt their compliance measures.

III. BSI Technical Guidelines

The German Federal Office for Information Security (BSI) is also supporting the implementation of the CRA through its Technical Guideline series TR-03183. The guidelines are intended to provide manufacturers with concrete technical and organisational assistance for the practical implementation of the CRA requirements, partly bridging the gap until harmonised European standards become available.

The parts of the guideline series published to date address, in particular, the requirements for secure development processes, Software Bill of Materials (SBOM), vulnerability management, and reporting and disclosure processes. Specifically, TR-03183-3 elaborates on the requirements for handling vulnerability reports and for Coordinated Vulnerability Disclosure (CVD) procedures. It sets out, inter alia, requirements for establishing appropriate security contact points, for publishing a “security.txt” file, and for the organisational design of reporting and communication processes for security researchers and authorities.

With the Technical Guideline TR-03183-H, published on 30 May 2026, the BSI has for the first time issued implementation guidance for conformity assessment under the Module H (“Full Quality Assurance”) procedure. Module H is one of the conformity assessment procedures envisaged under the CRA and focuses not on the individual product but on the manufacturer’s processes. In particular, it examines whether the manufacturer has an appropriate quality and security management system in place that ensures ongoing compliance with the CRA requirements during development, production, and vulnerability handling.

TR-03183-H describes an approach in which an existing information security management system (ISMS) pursuant to ISO/IEC 27001 is supplemented with CRA-specific requirements. The focus is on continuous risk assessment, secure development processes, security testing, change management, and structured vulnerability management throughout the entire product lifecycle.

Although the BSI guidelines do not constitute harmonised standards and do not give rise to a direct presumption of conformity, they are already acquiring considerable practical significance. They provide manufacturers with a concrete framework for the design of CRA-compliant processes and are also likely to indicate the requirements that notified bodies and market surveillance authorities will apply when assessing CRA compliance in the future.

IV. Conclusion and Outlook

With the European Commission’s FAQ, the legal acts adopted to date, and the BSI’s technical guidelines, initial important clarifications of the CRA are now available. Nevertheless, the Regulation remains in a transitional and clarification phase. In particular, the still outstanding harmonised European standards will be of central importance for practical implementation and the demonstration of conformity.

Initial standardisation results are already expected for the third quarter of 2026, including both horizontal and product-specific standards. These are intended to translate the general CRA requirements into concrete technical and organisational measures and to facilitate manufacturers’ demonstration of conformity in the future. For the fourth quarter of 2026, the European Commission has also announced a delegated act establishing the conditions for a presumption of conformity on the basis of the European cybersecurity certification system EUCC (European Cybersecurity Certification Scheme on Common Criteria). This could further increase the significance of existing cybersecurity certifications within the framework of CRA compliance.

Regardless of these further clarifications, affected businesses should make active use of the remaining transitional period. In view of the reporting obligations taking effect from 11 September 2026, it is particularly advisable to establish processes for vulnerability handling, incident response, and regulatory reporting at an early stage. By the time of the CRA’s full applicability on 11 December 2027, product development, documentation, and compliance processes should also be reviewed and adapted to the CRA requirements. Given the ongoing clarification of the regulatory requirements, there is much to be said for beginning implementation now rather than waiting for all standards and guidelines to be finalised.

This article was created in collaboration with our student employee Emily Bernklau.

In its judgment of 4 December 2025 (Case No. 2 AZR 55/25), the Federal Labour Court held that an extraordinary termination is ineffective if the employer fails to comply with the two-week deadline under Section 626 (2) of the German Civil Code (BGB) by remaining inactive during the employee’s annual leave and making no attempt to contact the employee for a hearing. According to the Court, neither the Federal Leave Act (Bundesurlaubsgesetz) nor EU law establishes a general prohibition on contacting an employee during annual leave. Rather, the employer is obliged to make at least one attempt at contact – for example by telephone, email or post – provided no special circumstances preclude this.

A. Facts of the Case

The claimant had been employed by the defendant since 2006, most recently as a train manager and specialist trainer for apprentices. The parties mutually agreed that the employment relationship could no longer be terminated by ordinary notice due to a collective bargaining agreement provision incorporated into the contract. The defendant had provided the claimant with a company mobile phone, although he was not required to be reachable on it during rest periods or annual leave.

On 24 April 2023, the claimant was on duty as a train manager together with another train attendant. On 27 April 2023, the other train attendant alleged to the defendant that the claimant had sexually harassed him during the journey. The claimant had already been on rest time since 25 April 2023 through 1 May 2023 and was on approved annual leave immediately thereafter until 21 May 2023.

The defendant waited for the claimant’s return from leave and only confronted him by letter dated 22 May 2023 with the allegation of sexual harassment and the possibility of termination, inviting him to a staff meeting on the following day, 23 May 2023. At the staff meeting on 23 May 2023, the claimant stated that he wished to respond to the allegations only in writing. At the claimant’s request, the defendant extended the deadline for his response until 30 May 2023. By letter of that date, the claimant rejected the allegations.

By letter dated 2 June 2023, the defendant consulted the works council regarding the intended extraordinary termination without notice as well as an alternative extraordinary termination with a notice period. The works council dealt conclusively with the consultation at its meeting on 5 June 2023, whereupon the defendant terminated the employment relationship by letter dated 6 June 2023, which was received by the claimant on the same day.

The claimant filed an unfair dismissal claim against both terminations before the Labour Court of Karlsruhe, arguing that the two-week deadline under Section 626 (2) BGB had not been observed, that the works council had not been properly consulted, and denying the allegation of sexual harassment.
The defendant took the view that the terminations it had issued were valid. In particular, it argued that the deadline for declaring termination under Section 626 (2) BGB had been observed, since contacting the claimant during his annual leave would have been contrary to the recuperative purpose of the leave, and therefore the defendant had not been obliged to hear the claimant during his leave.

The Labour Court of Karlsruhe (Judgment of 29 February 2024 – Case No. 1 Ca 147/23) upheld the claim in its entirety. The defendant’s subsequent appeal was dismissed by the Higher Labour Court of Baden-Württemberg (Judgment of 12 December 2024 – Case No. 12 Sa 25/24).

B. Reasoning of the Federal Labour Court

The Federal Labour Court also dismissed the defendant’s appeal on points of law (Revision).

1. Failure to Comply with the Termination Declaration Deadline Under Section 626 (2) BGB

The Federal Labour Court confirmed the lower courts’ view that the extraordinary terminations were ineffective due to non-compliance with the termination declaration deadline under Section 626 (2) BGB. Under Section 626 (2) sentence 1 BGB, an extraordinary termination may only be issued within two weeks. The deadline begins to run as soon as the person authorised to terminate has reliable and sufficiently complete knowledge of the relevant facts justifying termination, enabling that person to decide whether or not to continue the employment relationship.

While the employer may, at its reasonable discretion, carry out further investigations and hear the affected employee without the deadline beginning to run, this applies only as long as the employer conducts investigations with due diligence for justifiable reasons (Federal Labour Court, 27 February 2020 – Case No. 2 AZR 570/19, NZA 2020, 1405, para. 30). If the party subject to the potential termination is to be heard, this must take place within a short period, which as a general rule may not exceed one week and may only be exceeded in the presence of special circumstances.

2. Contact During Annual Leave

In a further development of its case law, the Federal Labour Court clarified that even in cases of leave-related absence, mere inactivity on the part of the employer is generally insufficient to prevent the commencement of the termination declaration deadline under Section 626 (2) BGB. In particular, it cannot be assumed that the employer is prohibited from approaching the employee solely because leave has been granted, in order to ascertain whether the employee is willing to participate in clarifying the facts.

In cases of leave-related absence, the conflicting obligations and interests must be considered. While the need to safeguard the recuperative purpose of leave may restrict the employer’s ability to make contact, it does not entirely preclude it. Conversely, the underlying rationale of Section 626 (2) BGB requires the swiftest possible clarification of allegations and an early hearing of the affected employee.

The Federal Labour Court emphasised that neither the Federal Leave Act, nor the Working Time Directive (Directive 2003/88/EC), nor Article 31 (2) of the Charter of Fundamental Rights of the European Union provide for an absolute prohibition on contact during annual leave. The Federal Leave Act contains neither an express provision on the permissibility of contact during leave nor does a prohibition arise by way of interpretation. The employer’s contact for the purpose of a hearing does not constitute a demand for the employee to perform the principal contractual obligation. Even if the employee decides to respond to the allegations, this merely constitutes compliance with an obligation incumbent upon the employee or at most a secondary obligation within the meaning of Section 241 (2) BGB. EU law likewise does not yet recognise a right of the employee to be unreachable during leave.

The decisive factor, according to the Federal Labour Court, is the anticipated actual duration of the employee’s absence. The defendant’s argument that, unlike in cases of illness, the employer can reliably predict the employee’s return in the case of leave, was not persuasive. The employee’s interest in having no contact with the employer during annual leave must yield to the imperative of legal certainty. Ultimately, it is left to the employee’s own decision whether and how to respond to such a contact attempt by the employer. If the employer is unable to reach the employee, or if the employee declines to comment by reference to the leave, special circumstances regularly exist that preclude a hearing during leave.

3. Application to the Specific Case

In the specific case, the defendant became aware of the allegations against the claimant on 27 April 2023. However, the termination letters were not received by the claimant until 6 June 2023, i.e. after the deadline under Section 626 (2) BGB had already expired. In the intervening period, the defendant had not pursued the investigation it considered necessary with the required diligence and, in particular, had not attempted to contact the claimant within an appropriate timeframe. According to the findings of the Higher Labour Court, communication with the claimant via the company mobile phone would generally have been possible during the leave. Alternatively, an attempt at contact by post to the claimant’s private address could also have been considered. The defendant had not demonstrated any special circumstances that would have made an attempt at contact during the leave appear futile.

4. No Conversion into an Ordinary Termination

In the Federal Labour Court’s view, a conversion of the time-barred extraordinary terminations into an ordinary termination was not possible. According to the findings of the Higher Labour Court, the works council had only been consulted regarding the extraordinary terminations. Since the defendant itself had not claimed to have received the works council’s unconditional consent, conversion into an ordinary termination was already excluded on this ground.

C. Practical Implications

The Federal Labour Court’s judgment contains important clarifications for the practice of extraordinary termination in cases of leave-related employee absence.

Employers cannot rely on the assumption that the two-week deadline under Section 626 (2) BGB is suspended during an employee’s leave if they simply remain inactive. An employee’s annual leave does not constitute a special circumstance that permits the employer to wait several weeks before making contact without further justification. Rather, the employer is required to make at least one attempt at contact – for example by telephone, email, messaging services or post – in order to hear the employee on the allegations. The employee, for their part, is not obliged to respond to such a contact attempt during their leave. If the employee declines to comment by reference to their leave or is unreachable, special circumstances regularly exist that suspend the running of the deadline.

For practitioners, the following recommended course of action arises: If the employer becomes aware of grounds for extraordinary termination during an employee’s leave, it should immediately and in a documented manner attempt to contact the employee – even during ongoing leave. From the employer’s perspective, it is advisable to use multiple channels of communication simultaneously (e.g. company mobile phone, private email address, postal delivery to the private address). Every contact attempt should be carefully documented in order to demonstrate, in the event of a dispute, that the hearing was pursued with the required diligence. Furthermore, the judgment makes clear that rigid time limits for the permissible waiting period do not apply. A shorter leave absence may, under certain circumstances, be waited out, but in the case of a longer absence, an attempt at contact within an appropriate timeframe is mandatory. Finally, employers should, as a precautionary measure, always consult the works council regarding an alternative ordinary termination as well, in order to preserve the possibility of conversion should the extraordinary termination fail for formal reasons.

Why is an administrative court deciding on an employment law issue? The applicant is a staff officer in the German Armed Forces (Bundeswehr). For claims brought by soldiers of this rank, the Military Service Senates located at the Federal Administrative Court (BVerwG) have first and final instance jurisdiction, meaning the case went directly to the Federal Administrative Court, pursuant to Sections 21(1) and 22 of the Military Complaints Regulation (WBO). On the occasion of the birth of his daughter in January 2024, the officer applied for ten working days of special leave with continued payment of salary, relying on Articles 4(1) and 8(2) of Directive (EU) 2019/1158 (the Work-Life Balance Directive). The authority denied the request and instead granted annual leave. The Federal Government takes the position that Germany fully transposed the Directive through the Work-Life Balance Directive Implementation Act (Vereinbarkeitsrichtlinienumsetzungsgesetz) of 19 December 2022. A separate paternity leave entitlement was not necessary, since the derogation provisions of Articles 20(6) and 20(7) of the Directive applied: Germany already had parental leave and parental allowance regulations providing each parent with at least six months of parental leave at adequate remuneration.

Decision

The BVerwG stayed the proceedings and referred several questions to the CJEU. In essence, the questions concern (1) whether Article 8(2) of the Work-Life Balance Directive is directly applicable where the State itself is the employer, (2) whether Germany may combine the derogation provisions of Articles 20(6) and 20(7) in order to treat both the temporal requirements (via parental leave) and the remuneration requirements (via parental allowance) as fulfilled, and (3) whether reliance on Article 20(7) is even possible where the parental allowance is not paid in certain cases, particularly in the case of high incomes or where the minimum two-month reference period is not met.

The existing lower court case law is divided: the Administrative Court of Cologne (judgment of 11 September 2025, Case No. 15 K 1556/24) affirmed a direct entitlement under the Directive against the State as employer. The Regional Court of Berlin II (judgment of 1 April 2025, Case No. 26 O 133/24), by contrast, denied a State liability claim and held the German regulations to be compatible with EU law.

Practical Note

Politically, the issue is at an impasse: the previous “traffic light” coalition had already agreed on a two-week paid leave (“Familienstartzeit”, or family start time) in its 2021 coalition agreement but failed due to internal disagreements over funding. In the current coalition agreement of the 21st legislative period, the family start time is no longer included. For employers in the private sector, the following applies: a direct entitlement to paternity leave under the Directive is not available due to the lack of vertical direct effect against private employers. However, if the CJEU rules that the Directive has not been properly transposed, the legislature will be compelled to act. Employers should closely monitor the proceedings: in the event of a CJEU ruling in favour of the applicant, the statutory introduction of paid paternity leave of ten working days can be expected, likely financed through the U2 levy procedure.

Where an employee (repeatedly) reports sick for the exact period immediately following a denied leave request, the evidentiary value of a medical certificate of incapacity for work is undermined, as this gives rise to serious doubts regarding the alleged illness.

Facts

The employee was employed as a production and warehouse worker at an animal feed manufacturer. In the summer of 2025, he was on approved annual leave from 28 July 2025 to 15 August 2025, which he spent together with his partner in Romania. While still on leave, he contacted his supervisor by telephone on several occasions requesting an extension of his leave by an additional week (18 to 22 August 2025). As justification, he stated that his partner was receiving inpatient hospital treatment and the date of her discharge was uncertain. The employer declined the extension. On the morning of 18 August 2025 – only a few hours before his scheduled shift – he reported sick, presenting a medical certificate of incapacity for work from his general practitioner, for precisely the period for which he had previously sought, without success, an extension of his leave. A comparable sequence of events had already occurred in 2024 – at that time, too, the employee had been certified unfit for work for exactly one week immediately following his three-week summer holiday. Against this background, the employer refused to provide continued payment of remuneration for the period of the sick note from 18 to 22 August 2025. The employee brought an action seeking continued payment of remuneration in the amount of EUR 700.21 gross plus interest.

Decision

The Labor Court Heilbronn dismissed the action for continued payment of remuneration in its entirety, holding that the evidentiary value of the medical certificate of incapacity for work presented had been undermined by the overall circumstances. In the court’s view, several indicia were decisive: the claimant had first unsuccessfully attempted to extend his annual leave for the exact period for which he immediately thereafter reported unfit for work. The sick note was, moreover, submitted only a few hours before the scheduled start of work. In addition, a practically identical sequence of events had already occurred in the previous year, such that the same pattern was discernible over two consecutive years. As a consequence of the undermining of the evidentiary value, and in accordance with the principles of graduated burden of presentation and proof, it fell to the claimant to substantiate and prove his actual incapacity for work. The claimant was unable to meet these requirements: the general practitioner, examined as a witness, could no longer recall the specific treatment situation and was, in particular, unable to state whether he had personally examined the claimant or had merely issued the certificate of incapacity for work on the basis of a telephone description. The medical treatment records contained only a diagnosis but no documented examination findings. On the basis of this evidentiary position, the court was unable to reach the degree of conviction required under Section 286 of the Code of Civil Procedure (ZPO) that the claimant had in fact been unfit for work due to illness during the disputed period.

Practical Tip

The evidentiary value of a medical certificate of incapacity for work is not unassailable. The employer has the possibility of rebutting it by presenting concrete facts that give rise to serious and objectively comprehensible doubts regarding the alleged illness. If such rebuttal succeeds, the burden of proof is reversed: the employee must then prove his or her incapacity for work independently. In concrete terms, this means that the employee must set out in detail – while releasing the treating physicians from their duty of confidentiality – what illness existed, what health impairments were present, and what medical treatment was administered.

The decision of the Labor Court Heilbronn is consistent with a line of case law that is favorable from an employer’s perspective. The circumstances present here (failed leave request, recurring pattern) now stand alongside other constellations in which, according to the case law of the labor courts, rebuttal of the evidentiary value of a certificate of incapacity for work may be considered: for example, incapacity for work covering the notice period or the performance of activities during sick leave that are incompatible with the stated illness.

Employers may accordingly be justified in refusing continued payment of remuneration even where a certificate of incapacity for work has been presented, and should always examine in each individual case whether the conditions for rebutting the evidentiary value are met.

The Frankfurt Stock Exchange has now amended its General Terms and Conditions for the Open Market (“GTC”) with effect from 12 June 2026. In doing so, certain facilitations for issuers already listed on the regulated market have been introduced for inclusion in the “Scale” segment. However, some of the previous requirements remain in place.

Inclusion Requirements

Capital Market Partner

An issuer’s application for inclusion in Scale continues to require the involvement of a Capital Market Partner. This “Applying Capital Market Partner” must, as before, be a credit institution, financial services institution, or an enterprise operating pursuant to Section 53 or Section 53b of the German Banking Act (KWG). Even in the case of a downlisting, this partner must confirm the suitability of the issuer for the Scale segment in a formal declaration based on an “adequate legal and financial due diligence” on the basis of certain legal, business-related, financial, organisational, and personnel criteria set out in the GTC.

The issuer’s ongoing support by a Capital Market Partner also continues to be required. The role of the so-called “Supporting Capital Market Partner” may, however – unlike in the case of the application – also be assumed by a lawyer or auditor recognised by Deutsche Börse AG. This role consists of conducting an annual information meeting with the issuer regarding the issuer’s ongoing inclusion obligations under the GTC and the relevant statutory provisions such as those under MAR and the German Securities Trading Act (WpHG). Furthermore, the Capital Market Partner is expected to advise the issuer with regard to its investor relations activities and a possible admission of the securities to the regulated market. In future, however, this will only be required during the first two years following inclusion, as will the publication of financial analyses (so-called research reports), which may need to be commissioned by the issuer.

Market Capitalisation and Free Float

The previous minimum market capitalisation of EUR 30 million has been abolished without replacement. The minimum free float requirement, which continues to apply, will in future – as in the regulated market – generally only amount to 10 %. The stock exchange may accept a lower free float if it considers the number of shares held by the public, the number of shareholders, or the market value of the shares held by the public to be sufficient to ensure orderly exchange trading.

Inclusion Documentation

The requirement for a securities prospectus or inclusion document is maintained. The latter remains a document sui generis with specific disclosures set out in the GTC. In the case of a downlisting, reduced requirements will in future apply compared to the “standard” introduction.

For this purpose, the issuer’s shares must have been admitted to trading on a regulated market without interruption for more than 18 months, and a prospectus approved in accordance with the requirements applicable to that market must have been published in connection with the admission. There are no specific requirements regarding the age of this prospectus. The issuer must also have complied with its ongoing obligations arising from the admission of its shares. To this end, the Applying Capital Market Partner must provide a confirmation that neither circumstances to the contrary are known to it nor could it reasonably obtain knowledge thereof from generally accessible sources of information. This raises questions similar to those concerning the compliance confirmation for the so-called Annex IX document under the EU Prospectus Regulation. In individual cases, a qualified confirmation was included there that discloses known deviations. BaFin has apparently not objected to this approach. Whether the FWB will proceed in a similar manner remains to be seen in light of the different objective in the present context. In any event, early coordination with the FWB appears advisable.

In the simplified inclusion document, the disclosures on “business activities and prospects” are replaced by a new section containing material information on the business and financial situation. This essentially consists of the incorporation by reference of the issuer’s annual or consolidated financial statements, together with information on significant changes in its financial position and a separate declaration by the issuer regarding compliance with the obligations arising from stock exchange admission (compliance declaration). In addition, the issuer must confirm that its working capital is sufficient for its current requirements (Working Capital Statement) or explain how it intends to procure any additional working capital that may be needed. Apparently with a view to the ongoing regular and ad hoc disclosure obligations of an issuer already listed on the regulated market, the inclusion of issuer-specific risk factors has been eliminated, while the risk factors material to the securities still have to be included. Otherwise, the minimum disclosures remain largely unchanged. In particular, the person responsible for the inclusion document must declare that, to their knowledge, the information in the document is correct and complete. In addition, the Applying Capital Market Partner must confirm that, to its knowledge, the information in the inclusion document is complete, coherent, and comprehensible.

Summary and Assessment

By amending the GTC for the Open Market, the Frankfurt Stock Exchange has facilitated the transfer of issuers from the regulated market to the Open Market segment Scale. In particular, the elimination of the minimum market capitalisation and the reduced free float requirements represent significant simplifications. The same cannot be said to the same extent for the inclusion documentation. Here, the European legislator had created a lean format for a prospectus-replacing document with the so-called Annex IX document, which considerably reduces the effort for secondary issuances – the offering and admission of additional shares of issuers already listed on the stock exchange – by assuming that the information already available in the market due to the stock exchange listing from previous prospectus, regular financial and ad hoc disclosure is known and does not need to be repeated. This would also avoid inconsistencies in risk disclosure. In the inclusion document, this is now incomprehensibly limited to risks specific to the securities. By implication, issuer-related risks are apparently excluded, possibly in reliance on the risk reporting in the management report. By contrast, in an Annex IX document, the issuer’s specific risk factors are a material component.

It would therefore have been consistent to use an Annex IX document also for the purposes of a segment change, instead of continuing to require an inclusion document with its own requirements. It is particularly noteworthy that, to this extent and with regard to previous compliance with ongoing admission obligations, separate declarations by an Applying Capital Market Partner are required. This may make good sense for issuers not yet listed on a stock exchange. For companies experienced in capital markets, it appears dispensable. The potentially liability-inducing declaration is likely to increase the cost of engaging an Applying Capital Market Partner to a not insignificant extent. This appears all the less comprehensible given that the Frankfurt Stock Exchange made use in 2025 of the simplification of admission to the regulated market in the General Standard segment introduced by the Future Financing Act (Zukunftsfinanzierungsgesetz). There, the admission application is now filed solely by the issuer; the involvement of a bank is no longer required. That such involvement is required for the transfer of an issuer already listed on a stock exchange to Scale as a – less strictly regulated – Open Market segment does not appear consistent. Nor is such a declaration by an external adviser such as a Capital Market Partner required in an Annex IX document for a public offering or the admission of additional shares to the regulated market.

The mandatory engagement of a supporting Capital Market Partner during the first two years of listing in Scale is surprising for issuers whose shares have already been listed on the regulated market for a considerable period. For such issuers, sufficient experience in dealing with the ongoing obligations arising from the listing should be expected due to the previous listing in a more strictly regulated exchange segment.

It therefore appears desirable to critically review the separate format of the inclusion document and the remaining procedural requirements for inclusion in Scale in the case of a downlisting. Some of the remaining requirements for this case are also tailored to growth companies that are not experienced in being listed on the capital market. For companies that have been admitted to the regulated market for a longer period and are merely undertaking a segment change, they appear to be a burdensome and potentially costly, but ultimately unnecessary formality. By further simplifying the downlisting process, the Frankfurt Stock Exchange could therefore make a genuine contribution to the current deregulation discussion.

Further References:

• Open Market Circular 01/2026 of the Frankfurt Stock Exchange dated 21 May 2026 on the amendment of the General Terms and Conditions of Deutsche Börse AG for the Open Market at the Frankfurt Stock Exchange

The standard contractual clauses are to be applied to certain agreements on clinical trials of medicinal products concluded between commercial sponsors and trial sites in Germany from 18 December 2025 onwards.

Legal Nature and Applicability

The standard contractual clauses constitute binding minimum content requirements for clinical trial agreements concluded between a commercial sponsor and a trial site for the conduct of a clinical trial with medicinal products. In the case of an investigator-initiated clinical trial (IIT), in which a non-commercial sponsor (such as a university) conducts the clinical trial, the standard contractual clauses do not apply.

The standard contractual clauses are not suitable for replacing complete contracts. This is mainly due to the fact that not all provisions necessary for a contract have been included in the standard contractual clauses. Rather, only those provisions that are considered particularly negotiation-intensive in practice have been included.

The standard contractual clauses are, in principle, binding. However, pursuant to Section 42d para 2 of the German Medicinal Products Act, the parties may mutually agree on deviations, amendments and supplements.

Key Content of the Standard Contractual Clauses

The standard contractual clauses not only cover essential areas such as name and trademark rights, but also regulate the provision of equipment and materials, inspections and audits, as well as documentation and archiving. In addition, they contain provisions on data protection and on the modalities of termination and cancellation. Overall, a clearly structured and comprehensive set of clauses has been developed, which largely adheres to compromises established in practice.

Key content also includes:

• Publication Rights: The standard contractual clauses leave statutory publication obligations unaffected, but grant the sponsor a right to first publication of the study results. If the sponsor does not make a first publication within twelve months after completion of the clinical trial, the trial site is entitled to publish the results generated at the trial site for non-commercial scientific purposes in compliance with the procedure set out in clauses 1.2 and 1.3. It is irrelevant whether the results are favourable or unfavourable. It is noteworthy that the standard contractual clauses take into account that confidential information and intellectual property rights of the sponsor are, at the sponsor’s request, excluded from publication. This corresponds to common contractual practice.
• Rights to Protectable Results: The standard contractual clauses provide that the trial site shall promptly inform the sponsor of protectable inventions within the meaning of the German Employee Inventions Act (“ArbnErfG”), to the extent legally permissible. The sponsor receives an exclusive option right to the transfer of inventions arising at the trial site in the course of the contractual and protocol-compliant conduct of the clinical trial. With regard to invention remuneration, the parties may choose between a market-standard lump-sum or recurring payment based on the ArbnErfG and a fixed amount. An option whereby protectable inventions are already included in the budget does not exist.
• Rights to Non-Protectable Results: Rights to results generated or produced by the trial site in the course of the contractual and protocol-compliant conduct of the clinical trial that do not constitute protectable inventions are, as is market standard, assigned to the sponsor in advance. For copyrights, the trial site grants the sponsor an exclusive licence. The transfer or granting of rights to non-protectable results is already covered by the agreed remuneration.
• License for the Trial Site: It is provided that the trial site receives a free-of-charge, non-exclusive licence to use all results generated by the trial site. It should be noted that this licence also covers protectable results.
• Confidentiality: Confidential information comprises, subject to clause 3.2, in principle all information relating to the clinical trial, to the performance of the contract and all results. There are no confidentiality obligations of the sponsor with regard to results generated in accordance with the contract and the trial protocol.
• Liability: The standard contractual clauses limit the liability of trial sites for slight negligence in terms of amount.

Need for Adaptation in Practice

The standard contractual clauses are intended to standardise and harmonise provisions that are particularly negotiation-intensive. However, they do not constitute a complete contract template, which is why the clinical trial agreement using the standard contractual clauses must also be tailored to the individual case.

In particular, sponsors should consider the following aspects:

• Customary Provisions: Provisions such as a jurisdiction clause or an arbitration agreement, provisions on assignability, the engagement of vicarious agents or indemnification claims are not part of the standard contractual clauses, but are typically part of the content of a contract. Corresponding provisions should therefore be included in addition to the standard contractual clauses.
• Provisions on the Performance of Services: Provisions on the precise performance of services by the trial site, the standard of care and the obligations under applicable laws are also not covered by the standard contractual clauses, but should be defined in order to establish clear performance obligations and responsibilities.
• Particularities Regarding University Inventions: As already mentioned, the trial site is only obliged to disclose employee inventions if this is provided for under the ArbnErfG. In contractual practice, the bridge to the ArbnErfG will still need to be built: University employees are not legally obliged to disclose inventions (negative freedom of publication). A transfer to the sponsor may therefore fail without further provisions, as the trial site may not become aware of the invention.

Supplementary Contract Template

In order to minimise the aforementioned need for adaptation in practice, representatives from academia and industry have already published, in addition to the StandVKlV, a complete standard contract template as a model in German and English. The contract template integrates the legally prescribed standard contractual clauses with further provisions established in practice and is designed to be used as a self-contained contractual framework. Since the template was developed with the participation of stakeholders from both pharmaceutical sponsors and trial sites, it reflects a balanced consideration of the respective economic interests. Nevertheless, despite the balanced design of the template, sponsors should carefully examine whether the provisions envisaged are consistent with their internal requirements and processes. Where appropriate, the use of the contract template can contribute to simplifying and overall accelerating contract negotiations between sponsors and trial sites.

Outlook

With the binding nature of the standard contractual clauses for clinical trial agreements concluded from 18 December 2025 onwards, the contractual design of clinical trials will undergo a complete paradigm shift. It will only become apparent in practical application to what extent the standard contractual clauses will continue to offer the contracting parties room for manoeuvre in the future.

In practice, it is becoming apparent that trial sites will demand the application of the standard contractual clauses and invoke their binding and negotiation-accelerating character. Sponsors should, in this case, adapt their existing contract templates to the standard contractual clauses and examine which amendments or additional provisions are necessary for them. Insofar as sponsors are considering the use of the published complete contract templates, they should, as part of this decision, also examine whether the provisions contained therein meet the respective specific requirements.

This assessment gains additional significance in light of the current European debate on technological sovereignty. As recently as 3 June 2026, the European Commission presented a “European Technological Sovereignty Package” that includes, among other things, the “Chips Act 2.0”, a Cloud and AI Development Act, an open-source strategy, and a strategic roadmap for digitalisation and AI in the energy sector. The proposal aims to strengthen European cloud and AI capacities, better protect critical applications and sensitive data, and create an EU-wide framework for assessing cloud and AI sovereignty. At the same time, it must be noted that the legislative proposals must first be negotiated by the European Parliament and the Council of the European Union.

I. Direct Use of Claude: The Data Protection Starting Point

The direct use of Claude initially raises questions regarding the transfer of personal data to the USA. Anthropic is headquartered in the United States and, according to its publicly available certification information, does not currently hold a certification under the EU-U.S. Data Privacy Framework. Where personal data is processed through Anthropic’s services, a third-country transfer regularly occurs that must meet the requirements of Art. 44 et seq. GDPR.

Anthropic bases such transfers on Standard Contractual Clauses pursuant to Art. 46 GDPR, which are automatically incorporated into the Commercial Terms of Service via the Data Processing Addendum. Nevertheless, the uncertainties associated with processing by a US provider remain. In particular, US authorities may assert access rights under certain statutory conditions, for example on the basis of the CLOUD Act or FISA 702. The fact that data may be stored on servers outside the USA does not necessarily preclude such access possibilities.

For enterprises, the contractual structure is also decisive. Anthropic provides a Data Processing Agreement within the framework of its Commercial Terms for its commercial products, in particular for Claude for Work – which, according to Anthropic’s own documentation, encompasses both the Team and the Enterprise plan – as well as for the Anthropic API. Insofar as personal data is processed within the commercial services in accordance with the DPA, the customer is typically the controller and Anthropic the processor. Data is not used for model training in this context. By contrast, the Free, Pro, and Max tiers do not include a Data Processing Agreement and are subject to the Consumer Terms. For a deployment that is robust from a data protection perspective, therefore, only the commercial offerings (Team/Enterprise) or the API are generally suitable.

II. Claude via AWS Bedrock or Google Vertex AI

Against this background, the question arises whether the assessment changes when Claude is used not directly through Anthropic, but via AWS Bedrock or Google Vertex AI. Both services enable access to the Claude models and their integration into existing cloud infrastructure, with usage subject to commercial terms that exclude model training.

A precise distinction must be drawn between the deployment variants. With “Claude in Amazon Bedrock,” AWS operates the inference infrastructure, is the sole data processor, and, according to its own representations, does not grant Anthropic access to the inference environment. Through regional endpoints – such as Frankfurt – processing within the EU can be achieved. This variant can improve the data protection position compared to direct use. However, it does not replace the assessment of what role Anthropic plays in the specific data flow and what significance the absence of a dedicated European Anthropic cloud has for the respective use case. The situation is different with “Claude Platform on AWS”: here, Anthropic operates the inference. AWS and Anthropic act as independent processors, and data does not necessarily remain within AWS but may be forwarded to Anthropic’s own cloud. EU data residency is not envisaged for this variant at launch. Only a coarse geography (US or global) can be controlled per request. With Google Vertex AI as well, the assessment depends on the chosen endpoint type. Global endpoints offer no residency guarantee. The advantage of EU processing therefore exists only with an appropriate regional configuration. Additionally, many enterprises already have established data protection and compliance structures for AWS or Google Cloud. This facilitates integration into existing governance frameworks. At the same time, an independent assessment remains necessary because the data protection evaluation depends significantly on the deployment model, endpoint selection, routing, and operator role.

AWS furthermore maintains certification under both the EU-U.S. and the Swiss-U.S. Data Privacy Framework. When using a DPF-certified platform provider, a different transfer-law basis may apply for certain transfer constellations. However, this does not replace the assessment of whether and to what extent data reaches Anthropic or other recipients outside the EEA – which is practically always the case with the Anthropic-operated variants. Whether the specific Google Cloud recipient used is also certified accordingly must be examined separately. For enterprises, this means: Claude cannot simply be approved as a “cloud feature” but requires a separate, product- and route-specific data protection assessment.

In conclusion, the use via AWS or Google does not automatically eliminate the underlying third-country connections. Amazon and Google are also US companies, meaning that questions regarding potential government access may persist. A data protection-compliant configuration rather requires that a platform-operator-side (AWS or Google) operated variant with an EU region is selected, global routing is excluded or controlled, and the specific data flow – including any onward transfers to Anthropic – is examined on a case-by-case basis. For broadly deployed enterprise use, this means that the configuration, data flows, and contractual roles must be documented in advance and included in the Data Protection Impact Assessment.

III. Claude Cowork and Desktop Access

The agentic features of Claude carry particular compliance relevance, especially Claude Cowork, which Anthropic offers as an agentic function and product interface for multi-step knowledge work. Unlike the conventional use of an AI chatbot, processing here is not limited to individual user inputs: depending on the configuration, the AI can access applications, files, browser content, and other enterprise resources, as well as independently execute certain work steps.

This shifts the risk assessment from the question of data location to the question of the AI’s access and action capabilities. While conventionally only consciously entered information is regularly processed, Claude Cowork can access significantly larger data sets within the permissions granted – such as personal data, confidential corporate information, communication content, or business-critical documents. That Cowork requires separate treatment is also evident from the fact that Anthropic regulates the function separately in its contracts and, for example, excludes it from BAA coverage.

From a compliance perspective, the focus is therefore on adherence to the need-to-know principle, the protection of trade secrets, and control over the actions performed by the AI. Deficient permission concepts or overly broad access rights can lead to sensitive information being processed even though this is not necessary for the task. Particular sensitivity is required where professional secrets, personnel data, or other particularly sensitive information is concerned.

Enterprises should therefore carefully assess before deployment which systems and data sets Claude Cowork may actually access. Clearly defined permission concepts, a restriction of access rights to the necessary minimum, logging of activities, and appropriate approval and control mechanisms for critical actions are recommended.

IV. Conclusion and Outlook

The deployment of Claude in an enterprise context requires a careful data protection and compliance assessment. With direct use and with the Anthropic-operated variant “Claude Platform on AWS,” the transfer of personal data to the USA, the absence of a DPF certification by Anthropic, and the lack of a genuine first-party EU cloud are the primary concerns. In these constellations, significant legal assessment and justification requirements exist. By contrast, the AWS- or Google-operated variant with an EU region can reduce risks through controllable data residency and – in the case of AWS – the DPF certification of the platform operator. This, too, applies only with careful configuration and case-by-case assessment.

The assessment of Claude thus differs from the assessment of other enterprise solutions such as Microsoft Copilot or OpenAI ChatGPT Enterprise, each of which requires examination of their own data protection, contractual, and operational models. With Claude, the absence of Anthropic’s own EU cloud, the varying operator role depending on the deployment model, and the potential third-country connections are particularly prominent. The fact that Anthropic models in Microsoft 365 Copilot are currently excluded from the EU Data Boundary and are disabled by default in the EU, EFTA, and the United Kingdom illustrates the practical relevance of these questions. As long as Anthropic does not offer its own EU cloud, it remains necessary to assess with particular care in data protection-sensitive constellations whether and under what conditions deployment is legally defensible. This assessment aligns with a regulatory trend that is increasingly focused on European cloud and AI sovereignty, the protection of sensitive data, and the reduction of strategic dependencies. The determining factors are, in particular, the chosen deployment variant, the endpoint and routing configuration, the contractual roles, the sub-processors employed, and the question of whether personal data or confidential corporate information is affected. Productive deployment should therefore only take place on the basis of a documented risk assessment and with close technical and organisational controls.

With the increasing proliferation of agentic features such as Claude Cowork, the legal discussion is also shifting from classic questions of third-country transfer towards information security, access control, and AI governance. For enterprises, it will therefore be decisive in the future not only where data is processed, but also which systems and information AI applications may access and how such access is controlled.

Enterprises should therefore only consider deploying Claude within a comprehensive data protection, security, and governance framework. The focus is on the documented assessment of data residency, operator role, third-country connections, contractual safeguards, and agentic access rights. Only when these points have been robustly clarified for the specific use case can the deployment be classified as sustainable from a data protection and compliance perspective.

This article was created in collaboration with our student employee Emily Bernklau.

1. Definitions: Provider and Deployer

Provider

According to Article 3(3) of the AI Regulation, a provider is a natural or legal person, public authority, agency, or other body that develops or has developed an AI system or a general-purpose AI model and places it on the market or puts the AI system into service under its own name or brand – regardless of whether this is done for remuneration or free of charge. The provider is not required to have technically developed the system themselves; what matters is that they place it on the market or put it into service under their own name or brand. Even the purely internal use of a self-developed AI system makes the developer a provider, as they are “putting the system into service.”

Deployer

According to Article 3(4) of the AI Regulation, a deployer is a natural or legal person, public authority, agency, or other body that uses an AI system under its own responsibility, unless the use takes place in the context of a personal, non-professional activity. The operator thus uses an AI system provided by a provider within their own operational context without placing it on the market themselves. Typical examples include a company that uses a third-party AI-powered applicant management tool, or a bank that uses a third-party AI-based credit scoring system.

Distinction and Role Shift

This distinction is of central importance, as providers bear significantly more extensive obligations than operators. In practice, a company can simultaneously be a provider for one AI system and an operator for another—for example, if it develops its own AI recruitment tool (provider) while also using an external AI analytics tool (operator).

Of particular practical relevance is the shift in role from operator to provider under Article 25(1) of the AI Regulation. An operator becomes a provider if they place a high-risk AI system on the market under their own name or brand, make a substantial change to a high-risk AI system, or change the intended use of an AI system in such a way that it becomes a high-risk AI system.

In these cases, the operator assumes full provider obligations for the system in question.

2. Prohibited AI Practices

As of February 2, 2025, certain AI applications are completely prohibited, including social scoring, subliminal manipulation, real-time biometrics in public spaces (with narrow exceptions), and biometric categorization for the derivation of sensitive characteristics. Furthermore, following the trilogue outcome of May 7, 2026, the use of AI systems that generate non-consensual sexually explicit or intimate content (so-called “nudifier apps”) or child sexual abuse material is prohibited. This ban takes effect on December 2, 2026, and applies to both providers and operators of such systems.

3. Obligations of Providers of High-Risk AI Systems

An AI system is considered high-risk if it is either used as a safety component in a product covered by EU product safety law or if it is intended for specific use cases listed in Annex III (e.g., biometrics, critical infrastructure, education, employment, law enforcement, migration).

Providers bear the main burden of compliance obligations under the AI Regulation.

Specifically, they must:

• Establish and maintain a comprehensive risk management system throughout the system’s entire lifecycle (Art. 9).
• Ensure appropriate data governance, i.e., training, validation, and test data must be relevant, representative, and as error-free as possible (Art. 10).
• Prepare comprehensive technical documentation demonstrating the system’s conformity (Art. 11, Annex IV).
• Design the system for automatic logging of relevant events (Art. 12).
• Provide operators with appropriate instructions for use that cover the intended purpose, performance characteristics, limitations, and requirements for human oversight (Art. 13).
• Design the system to enable effective human oversight by the operator (Art. 14).
• Ensure adequate accuracy, robustness, and cybersecurity (Art. 15).
• Establish a quality management system (Art. 17).
• Conduct a conformity assessment prior to placing the system on the market, draw up an EU declaration of conformity, and affix the CE marking (Art. 43, 47, 48).
• Register the system in the EU public database (Art. 49).
• Operate a post-market surveillance system after placing the device on the market, report serious incidents, and take necessary corrective actions (Art. 72, 73).
• Cooperate with the competent authorities and demonstrate conformity upon request.

4. Obligations of operators of high-risk AI systems

The obligations of operators are less extensive than those of providers, but by no means insignificant.

In particular, operators must:

• Use the high-risk AI system in accordance with the provider’s instructions for use and implement appropriate technical and organizational measures (Art. 26).
• Ensure human oversight by qualified personnel and designate appropriate individuals (Art. 26).
• Check the input data for relevance and representativeness, to the extent that they have control over the data (Art. 26).
• Monitor the operation of the AI system and, in the event of identified risks or serious incidents, inform the provider or the competent market surveillance authority (Art. 26).
• Inform natural persons affected by the AI system when the system makes or supports decisions regarding them, and provide a comprehensible explanation of the decision upon request (Art. 26, 86).
• In the case of public authorities or certain sensitive use cases, conduct a Fundamental Rights Impact Assessment (FRIA) prior to the first deployment (Art. 27).
• When using the equipment in the workplace, inform the affected employees and their representatives in advance (Art. 26).
• Retain the automatically generated logs (Art. 26).

You can find a summary of this section of our article here in chart form.

5. Transparency obligations for providers and operators (Art. 50)

Starting August 2, 2026, the transparency obligations under Art. 50 of the AI Regulation will apply equally to both roles.

The obligations are distributed differently:

Providers must ensure that AI systems that interact directly with natural persons (e.g., chatbots) are designed in such a way that the data subject is informed that they are communicating with an AI system.

In addition, AI-generated content must be labeled in a machine-readable format and be recognizable as artificially generated (watermarking).

Operators must inform individuals when they are subject to an emotion recognition or biometric categorization system.

They must also disclose when deepfakes – that is, AI-generated or manipulated image, audio, or video content – are used.

Similarly, operators must disclose when AI-generated or manipulated texts are published that serve to inform the public about matters of public interest.

The deadline for implementing watermarking and transparency solutions for AI-generated content was set by the trilogue on May 7, 2026, to December 2, 2026 (shortening the transition period from 6 to 3 months).

6. Obligations for Providers of General-Purpose AI Models (GPAI)

Since August 2, 2025, specific obligations have applied to providers of general-purpose AI models (GPAI). These obligations apply exclusively to providers; operators have no independent obligations with respect to GPAI models alone – but they do have obligations regarding AI systems built on GPAI models.

All GPAI providers must:

• Create and maintain technical documentation.
• Provide downstream providers with sufficient information and documentation.
• Implement a policy for compliance with EU copyright law. Publish a summary of the training content.

For GPAI models posing systemic risk (10²⁵ FLOPs of computing power or more), the following additional obligations apply:

• Conduct model evaluations and adversarial testing,
• Reporting serious incidents,
• Assess and mitigate systemic risks, and Ensure adequate cybersecurity.

7. Changes resulting from the trilogue of May 7, 2026 (Digital Omnibus on AI)

The provisional agreement of May 7, 2026, between the Council and the European Parliament introduces significant changes that affect both providers and operators.

Postponed application deadlines for high-risk obligations: For standalone high-risk AI systems (Annex III), the obligations apply as of December 2, 2027 (instead of August 2, 2026). For high-risk AI systems in regulated products, the obligations apply as of August 2, 2028 (instead of August 2, 2027).

Other significant changes include:

• Avoiding duplicate regulation for machinery: For AI systems in mechanical engineering products, compliance with sector-specific safety regulations (Machinery Directive) is sufficient; they are exempt from the direct application of the AI Regulation.
• Narrower definition of “safety component”: AI systems that merely assist users or optimize performance are not automatically considered high-risk if their failure does not cause health or safety risks.
• Extension of SME privileges to small mid-cap companies (SMCs): Certain exemptions that previously applied only to SMEs are being extended to small mid-cap companies.
• Processing of sensitive data for bias detection: Under the strict standard of “strict necessity,” personal data may be processed to detect and correct biases—for both high-risk and non-high-risk AI systems.
• Registration requirement for self-exemption: Providers who classify their systems as non-high-risk pursuant to Article 6(3) must nevertheless register them in the EU database.
• Strengthening the AI Office: The enforcement powers of the EU AI Office will be expanded for certain AI systems, particularly those based on GPAI models.
• Regulatory Sandboxes: The deadline for establishing national AI regulatory sandboxes is postponed to August 2, 2027.

8. AI Literacy

As of February 2, 2025, both providers and operators of AI systems are required to ensure a sufficient level of AI literacy among their employees and other persons involved in the operation and use of AI systems (Art. 4).

9. Sanctions

Violations of the AI Regulation may result in substantial fines that can affect both providers and operators:

• Up to €35 million or 7% of global annual turnover for prohibited AI practices.
• Up to €15 million or 3% for violations of other obligations (including high-risk obligations and GPAI obligations).
• Up to €7.5 million or 1.5% for providing inaccurate information to authorities.

10. Next Steps

The provisional agreement of May 7, 2026, must still be formally adopted by the European Parliament and the Council; this is expected to take place before August 2, 2026. Providers and operators should already begin classifying their AI systems, determining their respective roles, assessing whether their systems fall under the high-risk or prohibited categories, and starting to establish the necessary compliance structures. The additional transition period secured through the trilogue provides an opportunity to thoroughly prepare for the new requirements.

I. What are so-called “prompt injections”?

“Prompt injection” refers to targeted attempts to manipulate AI systems, particularly large language models (“LLMs”), in which inputs or external content are designed to influence the system’s behavior in an unintended manner. Unlike traditional software, generative AI does not process instructions strictly based on rules, but rather contextually based on natural language. This results in the unique characteristic that not only direct user inputs, but also processed documents, website content, or emails can influence the system’s behavior.

In practice, such attacks can take various forms. In a so-called “direct prompt injection,” a user attempts to circumvent internal security policies or system restrictions through inputs such as “Ignore all previous instructions.” Of particular practical relevance, however, are so-called “indirect prompt injections.” In this case, malicious instructions are embedded in external content that is automatically processed by the AI system. It is conceivable, for example, that a scanned PDF document, an email signature, or website content contains hidden instructions that cause the AI agent to disclose confidential information or perform specific actions.

This poses significant risks, particularly when using AI agents that can independently access internal systems, databases, or external applications. For instance, an AI-powered email assistant could be tricked by manipulated content into summarizing internal documents and forwarding them to unauthorized recipients. Equally conceivable are scenarios in which an AI agent triggers erroneous transactions, bypasses internal approval processes, or processes and discloses sensitive corporate data during automated research.

The practical relevance of such attacks is increasing, particularly because companies are increasingly integrating generative AI deep into existing business processes . The more extensively AI systems can access internal information, communication channels, and digital tools, the greater the potential attack surface for prompt injection attacks.

II. Regulatory Framework for AI Agents

With the entry into force of the AI Regulation, the European Union has established a comprehensive legal framework for the use of artificial intelligence for the first time. The AI Regulation fundamentally distinguishes between the underlying AI models and the AI systems built upon them. This distinction is particularly significant for AI agents, as they typically rely on large language models (LLMs) and are simultaneously capable of independently planning tasks, processing information, and controlling external applications or interfaces.

Even without a specific risk classification, the AI Regulation contains general compliance requirements for companies. Of particular practical relevance here is Article 4 of the AI Regulation, which has been in effect since February 2025 and, for the first time, explicitly establishes an obligation to ensure sufficient “AI competence” (as we reported). Accordingly, providers and operators of AI systems must take measures to ensure that persons involved in the operation and use of AI systems possess adequate technical knowledge, experience, and training. For companies, this means in particular that employees working with generative AI and AI agents must not only be technically trained but also made aware of risks such as erroneous decisions, hallucinations, or manipulation attacks, for example through prompt injections.

Furthermore, the specific scope of obligations depends largely on the regulatory classification of the respective system. At the level of the underlying AI models, large language models are generally considered “general-purpose AI models” within the meaning of Art. 53 et seq. of the AI Regulation. Providers of such models are subject to specific transparency, documentation, and information obligations. If a model is additionally classified as a model “with systemic risk,” further requirements apply, such as regarding model evaluations, risk assessments, and cybersecurity measures.

However, classification at the system level is particularly relevant for businesses in practice. The specific intended use of the AI agent is decisive here. If an AI agent is used in sensitive areas such as human resources, the financial sector, or in the context of critical infrastructure, it may be classified as a high-risk AI system. In this case, extensive regulatory obligations apply, particularly with regard to risk management, human oversight, and technical robustness. According to Article 9 of the AI Regulation, a continuous risk management system must be established to identify, assess, and minimize risks. Article 14 of the AI Regulation also requires effective mechanisms for human oversight to detect and correct malfunctions or undesirable system decisions. Additionally, Article 15 of the AI Regulation mandates ensuring an appropriate level of accuracy, robustness, and cybersecurity.

These requirements take on particular significance in the context of AI agents. Unlike traditional AI applications, AI agents are often not limited to the mere generation of content, but can independently control processes, retrieve external data, or perform digital actions. The degree of their autonomy therefore significantly influences the system’s risk profile and, consequently, the intensity of regulatory requirements. A particular challenge is that the AI Regulation’s risk-based approach focuses primarily on the intended use, while the actual technical capabilities of an AI agent – such as the independent control of browsers or IT systems – have so far been taken into account only to a limited extent.

III. Technical and Organizational Safeguards

Companies should view prompt injection attacks not merely as a theoretical risk, but as a concrete security challenge in the productive use of generative AI. Since such attacks often cannot be completely prevented, the key in practice is to identify risks early, establish technical safeguards, and specifically limit the scope of action of AI agents.

From a technical perspective, it is advisable to first strictly limit permissions and system access. AI agents should only be able to access those data, applications, and interfaces that are absolutely necessary for the respective use case (“least privilege principle”). Systems that independently send emails, call up external tools, or have write access to internal systems are particularly critical. The broader the scope of an AI agent’s capabilities, the greater the potential attack surface for prompt injection attacks.

Furthermore, external content processed by AI systems should be handled in as isolated and controlled a manner as possible. This applies in particular to emails, website content, PDF documents, or other files that may contain hidden instructions. Companies are increasingly relying on technical protection mechanisms such as input filters, prompt sanitization, or isolated execution environments (“sandboxing”) to detect manipulative content early on or limit its impact.

Human oversight also remains of central importance. AI agents should not operate completely autonomously, especially in critical processes, but should be integrated into appropriate approval and control mechanisms. For example, it can be stipulated that sensitive actions – such as external communication, payments, or data sharing – are executed only after human confirmation. Especially in the context of prompt injections, such “human-in-the-loop” control can play a crucial role in detecting misconduct early on and preventing damage.

Finally, it is recommended to continuously review deployed AI systems through testing, monitoring, and so-called “red-teaming.” This involves deliberately attempting to induce systems to malfunction through manipulated inputs or atypical scenarios in order to identify vulnerabilities early on. Given the dynamic development of generative AI, a security concept implemented once is likely to be insufficient on a regular basis. Rather, the secure use of AI agents requires continuous adaptation of technical and organizational protective measures.

IV. Liability Risks in the Event of Non-Implementation

Companies that deploy AI agents without adequate security and control mechanisms expose themselves to significant liability risks. If, for example, prompt injection leads to the disclosure of confidential information, erroneous decisions, or unintended system actions, the question regularly arises as to whether sufficient technical and organizational safeguards were implemented.

In addition to potential fines under the AI Regulation, civil liability risks due to organizational negligence or breach of contractual obligations are of particular concern. Added to this are potential reputational damage and loss of trust among customers and business partners. Precisely because AI agents are increasingly accessing corporate systems and business processes autonomously, effective AI risk management is thus gaining significant importance from a liability law perspective as well.

V. Conclusion and Outlook

Prompt injection attacks illustrate that the use of generative AI, and AI agents in particular, not only offers significant efficiency potential but also brings with it new security and compliance risks. As autonomous AI systems become increasingly integrated into corporate processes, both regulatory requirements and expectations regarding technical and organizational safeguards are likely to rise further. Companies are therefore well advised to consider AI governance, IT security, and compliance together at an early stage and to adapt existing control mechanisms to the specific characteristics of generative AI. Particularly against the backdrop of the ongoing implementation of the AI Regulation and dynamic technological developments, it can be assumed that prompt injections and similar attack scenarios will continue to gain practical relevance in the future.

This article was created in collaboration with our student employee Emily Bernklau.

While some of the deadlines for the application of the provisions of the AI Act (Regulation (EU) 2024/1689, the “AI Act”) have been extended by the so-called AI Omnibus, this is unlikely to apply to the labelling obligation under Article 50(4) AI Act. Accordingly, this obligation is expected to apply as early as 2 August 2026. In the fields of advertising and marketing in particular, the obligation to label certain AI-generated content – such as images and videos – is of significant practical importance.

This article outlines the specific requirements arising from these rules and examines the practical implications of the labelling obligation, particularly for advertising and marketing.

I. Key Legal Provisions

The central provision governing the labelling obligation is Article 50(4) AI Act. It requires operators of AI systems that generate or manipulate image, audio or video content qualifying as deepfakes to disclose that such content has been artificially generated or altered.

A corresponding obligation also applies to operators of AI systems that generate or manipulate text, provided such text is published in order to inform the public about matters of public interest. In such cases, it must likewise be indicated that the content has been artificially generated or modified.

Article 50(4) AI Act therefore establishes two distinct regulatory regimes: one for image, audio and video content, and another for certain types of text.

1. Images and Videos

The most relevant obligation in practice for companies in advertising and marketing concerns the labelling of AI-generated or AI-manipulated images and videos, provided these qualify as deepfakes. In this area, the AI Act imposes particularly extensive transparency obligations.

a) What qualifies as a deepfake?

A deepfake is defined in Article 3(60) AI Act as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful.

There is currently significant legal uncertainty regarding the interpretation of this definition, which will likely only be clarified through future case law. A literal reading suggests that the content must resemble a real, specifically identifiable person or existing object, place, etc.

However, the prevailing view goes further: Even an abstract resemblance to fictional persons or objects may suffice, provided the content could be perceived as authentic or truthful. This approach is also reflected in the European Commission’s draft guidelines on the implementation of transparency obligations under Article 50 AI Act. According to these guidelines, it is sufficient that simulated persons, objects, places or events resemble something that exists – or could plausibly have existed – in reality.

By contrast, obviously unrealistic depictions are not covered. This includes content that contradicts the laws of nature or well-established biological principles, such as humans flying without technical assistance or dragons driving cars. The guidelines cite, for example, an AI-generated video of a mouse speaking with a human voice as content that would not qualify as a deepfake.

As a result, virtually any photorealistic depiction of human figures or realistic-looking objects, places or situations may qualify as a deepfake.

b) Classification of standard AI-assisted edits

It is controversial whether AI-assisted editing of existing content – such as adjustments to background details, lighting, audio parameters, colours or noise reduction – already leads to a classification as a deepfake and thus triggers a labelling obligation.

The view currently prevailing in many cases is that this is not necessarily the case, particularly where the respective edits play only a minor role in assessing the authenticity or truthfulness of the content. However, this always requires a case-by-case assessment.

The European Commission’s draft guidelines also differentiate in this respect. Substantial AI-based alterations – for example, changes to background details in journalistic images – may negatively affect the authenticity of the content. By contrast, measures such as colour correction, background extension of existing content or simple scaling of images (e. g. in product advertising) generally have only a limited impact on perceived authenticity.
A definitive clarification of these distinctions is still pending and will likely be left to future case law.

c) No privileged treatment for commercial advertising

Although Article 50(4), third sentence, AI Act provides for reduced transparency obligations for deepfakes forming part of clearly artistic, creative, satirical or fictional works or programmes, this exception does not apply to traditional product advertising according to the European Commission’s draft guidelines.

Companies therefore cannot generally rely on the argument that their advertising is merely creative or artistic in order to benefit from reduced transparency requirements. Moreover, the overarching objective of the AI Act – to prevent deception and ensure a high level of transparency – supports a broad interpretation of the labelling obligations.

d) AI models

The use of so-called “AI models” – AI-generated personalities that appear on social media as influencers or in advertising campaigns like real people – is particularly sensitive.

As such AI models are deliberately designed to resemble human beings and may even convey the impression of having a personal life, there are strong arguments that they qualify as deepfakes subject to labelling. Advertising measures involving AI models will therefore, in principle, have to include a corresponding indication of their AI-based origin once the labelling obligation becomes applicable.

2. Texts

The legal position for AI-generated text is significantly less strict. Article 50(4), second subparagraph, AI Act applies only to text intended to inform the public about matters of public interest. Traditional advertising copy, product descriptions, social media posts or newsletters will therefore generally fall outside its scope.

In addition, there is an important exception: No labelling is required where the text has been subject to human review or editorial control and where a natural or legal person assumes responsibility for it. This will typically be the case in marketing contexts. If AI-generated text is reviewed, revised and approved, a labelling obligation will usually not arise.

Nevertheless, it is advisable to implement clear internal processes and to document editorial responsibility transparently. Unreviewed AI drafts may not only entail legal risks but can also result in considerable reputational damage.

II. Who is subject to the labelling obligation?

According to its wording, the labelling obligation under Article 50(4) AI Act is addressed exclusively to the “operator” of an AI system. Under Article 3(4) AI Act, an operator is any natural or legal person who uses an AI system under their own responsibility, unless such use is purely private.

In practice, this means that essentially anyone who uses generative AI independently for commercial purposes will qualify as an operator.

However, it remains unclear how to assess cases where an advertising company does not use the AI system itself but merely uses AI-generated output created by an external agency. While operators must be distinguished from end users who simply use AI output without exercising control over the system, legal literature suggests that an “organisational” attribution of operator status may be possible. This could apply, for example, where a party assumes responsibility for the accuracy or completeness of the AI-generated output and third parties may reasonably rely on such responsibility.

Against this background, and in light of the protective purpose of the AI Act, there are strong arguments that the advertising company itself may also be subject to the labelling obligation – even where it did not create the AI-generated or manipulated content. Otherwise, such obligations could easily be circumvented by outsourcing advertising activities. Further clarification by the courts will be required in this regard.

III. Form of the labelling

Under Article 50(5) AI Act, the labelling must be provided in a “clear and unambiguous manner” and must comply with applicable accessibility requirements. The legislation does not prescribe a specific format.

Depending on the medium, target audience and context, possible forms include textual notices such as “AI-generated” or “created using AI”, visual indicators (e. g. pictograms) or auditory notices in the case of audio content.

Importantly, where content is directed at the German market, a German-language label should be used as a precaution. Purely English-language notices or hashtags such as #AIgenerated may carry increased legal risk, particularly in light of case law on influencer advertising disclosures.
IV. Potential consequences of non-compliance

1. Fines under the AI Act

Infringements of the labelling obligations may result in substantial administrative fines. Article 99(4)(g) AI Act provides for fines of up to EUR 15 million or up to 3 % of the total worldwide annual turnover, whichever is higher. While reduced maximum thresholds apply to small and medium-sized enterprises (SMEs), even these may represent a significant financial burden.

2. Unfair Competition law risks

From a practical perspective, the competition law dimension is particularly relevant. The labelling obligations under Article 50 AI Act are likely to qualify as rules governing market conduct within the meaning of Section 3a of the German Unfair Competition Act (UWG). As a result, a breach of the labelling obligation may also constitute an act of unfair competition.

This means that enforcement is not limited to regulatory authorities: Competitors, trade associations and consumer protection organisations may also take action. Warning letters, cease-and-desist claims and, in some cases, damages claims are therefore realistic scenarios.

V. Conclusion and practical recommendations

The labelling obligations under the AI Act are likely to have a tangible impact on the use of AI in marketing. This is particularly true for images and videos, given the broad interpretation of the concept of deepfakes and the tendency towards a wide application of the rules. By contrast, purely advertising texts are often less affected, as they frequently fall outside the scope of the provision or benefit from the editorial control exception.

Companies should therefore prepare for the new requirements without delay, especially since the rules will apply from 2 August 2026 and will also affect ongoing marketing activities.

In practice, it is advisable to establish clear internal guidelines for the use of AI in marketing. Where in doubt, providing a transparent indication (e. g. “AI-generated”) will generally be the safer approach. Such labelling should be clear, easily perceptible and – where content is aimed at the German market – generally provided in German.

This article was prepared with the support of our research assistant Franziska Klinzing.

I. Current Developments

The national implementation of the eIDAS 2.0 Regulation is in an advanced but not yet completed phase in Germany as of May 2026. On 26 March 2026, the Federal Ministry for Digital Affairs and State Modernisation (BMDS) presented a ministerial draft for a Digital Identities Act (DIdG), which is currently undergoing inter-ministerial coordination and is expected to be submitted to the Cabinet shortly. The draft specifies central elements of the future wallet infrastructure, in particular user onboarding, the integration of additional functions such as payment options, and potential acceptance obligations for companies. In terms of timing, the Federal Government is pursuing an ambitious roadmap: the Act is intended to enter into force during the course of the year, while the practical rollout of the wallet at the European level is scheduled for early 2027. In parallel, technical foundations are being established, for example through planned open-source documentation and supplementary security measures such as bug bounty programmes. Nevertheless, particularly at the municipal level, doubts remain regarding the feasibility of the timeline and the practical integration into existing administrative structures.

The reactions from industry associations are nuanced. In principle, the introduction of a Europe-wide harmonised digital identity solution is welcomed, but at the same time significant need for improvement is identified. Particular criticism is directed at the high complexity of the draft legislation and the resulting legal uncertainty, as numerous cross-references to other national and European regulations complicate application and increase the risk of incorrect implementation with potential sanctions. Furthermore, the market structure envisaged in the draft is questioned: associations call for a “level playing field” between public and private wallet providers, while a potential state preference is seen as inhibiting investment. In functional terms, there are also expectations that the wallet should provide all essential core functions – digital identification, attribute attestations, and qualified electronic signatures – in full from the outset, in order to avoid acceptance problems.

In parallel with the legal design, work is also continuing on the conceptual and technical development of the wallet. The BMDS has announced that the “EUDI Wallet“ will receive a new, more user-friendly name in Germany, as the current designation is considered difficult to remember and acceptance problems are feared. Technically, a phased expansion of functionalities is planned: in addition to traditional identity credentials, payment functions are also to be integrated over time, for example through the incorporation of existing credit cards or online payment services, with regulatory guardrails planned particularly regarding security and functional separation. At the same time, close integration with existing digital infrastructures such as BundID is planned, which promises synergies but also brings technical and organisational challenges, particularly on the administrative side. Overall, it is evident that implementation is currently in a dynamic phase between legislative specification, technical development, and political-economic coordination, with the coming months being decisive for the system’s practical viability.

II. Affected Companies

The eIDAS 2.0 Regulation does not impose a blanket obligation on all companies to integrate the EUDI Wallet. Rather, a distinction must be drawn between different categories of market participants, with specific obligations arising in particular for companies that offer or rely on digital identification processes.

Directly addressed are, first, so-called “relying parties”, i. e. service providers that use digital identification procedures to grant users access to their services or to receive legally relevant declarations. These include in particular regulated sectors such as credit institutions, payment service providers, telecommunications providers, and providers of digital platform services, insofar as they are legally obligated to identify their customers (for example under KYC or anti-money laundering requirements). These companies will in future be required to accept the EUDI Wallet as an identification tool, provided they use digital identification procedures and the wallet meets the required level of assurance. In such cases, a concrete need for integration and adaptation arises in existing onboarding and authentication processes.

A further group comprises companies that have not yet implemented mandatory identification processes but offer digital services for which identity verification is typically required or advisable. These include, for example, platform operators, providers of online marketplaces, or services with age verification obligations. For these actors, there is not necessarily an immediate obligation arising directly from the Regulation itself to integrate the wallet; however, the European legal framework opens up the possibility for Member States to establish corresponding acceptance obligations at the national level. Against this backdrop, it can be expected in the German context in particular that certain sectors will in future be subject to regulatory obligations to accept the wallet and process the corresponding attestations. The circle of specifically affected companies will therefore be significantly determined by subsequent national regulations.

By contrast, companies without any connection to digital identification processes – i. e. purely physical businesses without digital customer interaction – are generally not directly affected. Companies that exclusively use internal identity solutions and do not process external user identities also do not, in principle, fall within the direct scope of application of the eIDAS 2.0 Regulation.

Finally, a third group of actors must be considered, for whom the situation gives rise not so much to obligations as to market opportunities. These include in particular providers of wallet solutions, trust service providers, and technical service providers that offer interfaces, identity management systems, or verification solutions. These actors are also subject to regulatory requirements, for example regarding certification and security standards, but they are not primarily addressees of acceptance obligations; rather, they form part of the emerging ecosystem.

III. Recommendations for Action for Companies

In the short term, companies should first clarify whether and in which processes they already use digital identification procedures today. Particularly relevant are onboarding processes, contract conclusions, age verifications, and existing KYC or authentication solutions. As a first step, it is advisable to specifically inventory and prioritise these processes in order to identify those use cases in which the EUDI Wallet is likely to become mandatory or at least practically relevant in the future.

In parallel, internal responsibilities should be assigned, ideally involving Legal, Compliance, and IT. The EUDI Wallet is not a purely IT topic; regulatory requirements, liability issues, and technical integration are interlinked. Without clear responsibilities, there is a risk that necessary preparations will be delayed.

At the technical level, it is advisable to review the company’s own system architecture for wallet compatibility at an early stage. Companies should assess whether their existing identification and authentication systems are fundamentally open to external identity providers and have standardised interfaces (APIs). If this is not the case, at least a conceptual opening should be prepared in order to reduce subsequent integration effort.

Furthermore, it is advisable to closely monitor developments at the national level, particularly with regard to potential acceptance obligations for certain sectors. Companies that are potentially active in regulated areas (e.g. financial services, platform economy, telecommunications) should develop scenarios for how a mandatory wallet integration can be implemented organisationally and technically. This also includes early coordination with existing service providers, for example in the areas of identity verification or payment processing.

Finally, companies should consider concrete pilot or testing strategies as soon as corresponding interfaces or reference implementations become available. Early practical experience – even in limited use cases – makes it possible to realistically assess integration effort, user acceptance, and operational impacts, and to make necessary adjustments in a timely manner.

IV. Conclusion and Outlook

The EUDI Wallet will gradually gain practical significance with the further implementation of the eIDAS 2.0 Regulation and the accompanying national legislation. With a view to the planned rollout by early 2027, it is foreseeable that it will establish itself as an additional standard for digital identification and attestation processes. For companies, this primarily means that existing digital processes will need to be supplemented by or adapted to the use of the wallet over time.

At the same time, the current state of implementation shows that numerous detailed questions – particularly regarding specific technical design, market organisation, and potential acceptance obligations – remain open. Against this backdrop, a pragmatic approach is recommended: companies should closely follow regulatory developments and establish the necessary organisational and technical foundations at an early stage, without prematurely committing to specific solutions. Ultimately, what will be decisive is how clearly and practicably the national requirements are designed and to what extent the wallet actually gains traction in the market.

This article was created in collaboration with our student employee Emily Bernklau.

While the original ministerial draft and the cabinet draft were still considered comparatively restrained, the German Bundestag has now followed the recommendation of the Finance Committee and adopted an explicit “clarification” of the external ownership ban.

Despite the Bundestag’s approval, the legislative process is currently blocked. The Bundesrat unexpectedly rejected the draft legislation on 8 May 2026. However, the background was not the new regulation on the external ownership ban itself. Rather, the decisive factor was a tax-free relief premium for employees that had been incorporated into the law at short notice, intended as a response to the increased cost of living resulting from the Iran conflict. As the federal states saw significant tax revenue losses for themselves and the municipalities and there was no adequate offsetting financing, the Bundesrat refused to approve the law as a whole. The legislative process has thus been halted for the time being; in particular, convening the Mediation Committee now appears possible. In substantive terms, however, there is much to suggest that the professional law amendments regarding the external ownership ban will remain largely unchanged in the further proceedings.

I. The New Regulation: Look-Through Across All Levels of Participation

At the core of the reform of the external ownership ban is the new Section 55a(1) sentence 3 of the German Tax Advisory Act (StBerG). Under this provision, in the future not only directly participating auditing or bookkeeping firms will be required to meet the professional law recognition requirements. Rather, this is expressly intended to apply to all indirectly participating entities within multi-tiered participation structures.

The new regulation thus directly targets the private equity structures via foreign auditing firms that have been widespread to date. The external ownership ban is effectively extended to the entire chain of participation.

Notably, the legislature has characterised this as a mere “clarification” rather than the closing of a previously existing regulatory gap. The legislature is thus clearly pursuing the objective of retroactively providing a statutory basis for the existing restrictive administrative practice.

It is precisely this doctrinal construction that has significant practical consequences: the law contains neither transitional provisions nor explicit grandfathering protection for existing participation structures. According to the understanding set out in the legislative explanatory memorandum, even already implemented investor structures could become impermissible under professional law immediately upon entry into force.

In extreme cases, affected tax advisory firms could even face a revocation of their recognition.

II. Extended Transparency and Disclosure Obligations

Complementing the substantive tightening, the legislature is also significantly expanding regulatory transparency requirements. In the future, tax advisory firms will be required to notify the competent Chamber of Tax Advisors (Steuerberaterkammer) without delay of any changes to direct and indirect ownership interests. This applies in particular to participations by auditing or bookkeeping firms. In the case of changes at the indirect level, the entire participation structure up to the affected level must additionally be disclosed. Furthermore, indirect shareholders will in future already need to be declared during the recognition procedure.

The new regulation thus provides the chambers with significantly broader supervisory powers with respect to complex participation and platform structures.

III. Which Participation Structures Will Remain Permissible for Private Equity Investors?

Current developments already indicate how the market will react to the new statutory regulation. Numerous investors are currently considering whether to organise existing platform structures in the future via auditing firms (Wirtschaftsprüfungsgesellschaften) rather than tax advisory firms, or to restructure existing tax advisory platforms accordingly.

The background is that the tightening now envisaged is directly linked to tax advisory law, while the professional law governing auditors has not undergone a comparable reform. At the same time, auditors and auditing firms remain fully authorised to provide assistance in tax matters. Auditing firm structures are thus increasingly becoming the central alternative for investor-driven professional services platforms.

However, it remains to be seen whether this trend will prove sustainable in the long term. The legislative explanatory memorandum clearly shows that the legislature is taking an increasingly critical view of indirect influence by institutional investors. Should the market increasingly shift towards auditing firm structures in the future, it appears quite possible that the professional law governing auditors will also be subject to regulatory tightening in due course. On 23 April 2026, the board of the German Chamber of Public Accountants (Wirtschaftsprüferkammer) issued a statement clarifying that it continues to consider a private equity participation via an auditing firm to be permissible, provided that the independence of the auditing firm and the quality of the services are not called into question.

IV. Outlook

Legislative developments in this area remain dynamic. Market participants should regularly review the permissibility of their respective participation models and make adjustments as necessary to remain compliant.

I. Background and Objectives of the AI Omnibus

The European Commission presented the so-called AI Omnibus in November 2025 as part of its European “Simplification Agenda.” The background to this was, in particular, concerns expressed early on by industry, Member States, and practitioners regarding the practical feasibility of the AI Regulation. Criticism focused primarily on the high administrative burden, short implementation deadlines for high-risk AI systems, and overlaps with existing sector-specific regulations, such as in the area of product safety law. Furthermore, it was argued that certain requirements of the AI Regulation entail significant legal uncertainty and additional compliance costs, particularly for small and medium-sized enterprises.

Against this backdrop, the Commission’s proposal aimed in particular to better align the application of the AI Regulation with existing sectoral regulatory frameworks and to avoid double regulation. Among other things, the proposal included longer transition periods for high-risk AI systems, selective relief from documentation and compliance obligations, and closer integration with sector-specific harmonization legislation. At the same time, the division of responsibilities between national authorities and the European AI Office was to be clarified, and regulatory fragmentation within the EU reduced.

However, the proposals sparked controversial discussions even during the legislative process. While parts of the industry and individual member states welcomed the planned simplifications as a necessary step to ensure European competitiveness, other stakeholders warned of a potential watering down of the AI Regulation’s risk-based approach and increasing legal fragmentation.

II. The Key Points of Agreement

The political agreement of May 7, 2026, essentially adheres to the objectives of the original Commission proposal but includes important refinements and compromise solutions in several areas.

1. New Deadlines

A central component of the trilogue agreement is the adjustment of the application deadlines for high-risk AI systems. This is based in particular on the assessment that the harmonized standards and technical tools required for practical implementation are unlikely to be available in time. The Council and Parliament have therefore agreed on a phased postponement of the relevant application dates.

For so-called stand-alone high-risk AI systems, the relevant provisions of the AI Regulation will now apply only from December 2, 2027. For high-risk AI systems that are part of regulated products, such as in the fields of machinery, elevators, or toys, a later start date of August 2, 2028, is planned.

In contrast, the deadlines for transparency obligations related to AI-generated content have been shortened. Providers are to implement the necessary technical solutions for labeling artificially generated content, such as watermarks or machine-readable markers, as early as December 2, 2026. This is intended, in particular, to curb the misuse of generative AI systems more quickly.

2. New Prohibitions

The trilogue agreement also provides for an expansion of the prohibitions on certain AI practices previously set forth in the AI Regulation. In particular, an explicit ban on AI systems used to create non-consensual sexual or intimate content, as well as depictions of sexualized violence against children (CSAM), has been newly included.

This addition underscores that, despite the simplifications sought, European lawmakers are maintaining the AI Regulation’s protection framework rooted in fundamental rights. At the same time, the agreement responds to the increasing prevalence of abusive deepfake applications and growing political pressure in the area of child and personal data protection.

3. Sector-Specific Solutions

Another key focus of the agreement concerns the relationship between the AI Regulation and existing sector-specific regulatory frameworks. Particularly for regulated product areas such as medical devices, machinery, toys, watercraft, or elevators, there was concern that parallel requirements from the AI Regulation and sectoral harmonization acts could lead to double regulation and additional conformity assessment procedures.

Against this backdrop, a mechanism was agreed upon that is intended to allow for the targeted resolution of overlaps between the AI Regulation and sectoral regulations through subsequent implementing acts. In addition, the Machinery Regulation is to be partially exempted from the direct application of certain AI Regulation requirements. At the same time, the Commission is given the option to adopt supplementary health and safety requirements specifically for AI systems within the scope of the Machinery Regulation.

III. Recommendations for Action

While the trilogue agreement provides companies with additional time and greater regulatory flexibility in key areas, there is no reason to suspend ongoing AI compliance projects. Rather, companies should make targeted use of the transition periods granted to further develop existing governance and risk structures in a robust manner and to integrate the foreseeable adjustments into their compliance strategy at an early stage.

1. Do not pause existing AI compliance projects

Despite the extended transition periods, the fundamental requirements of the AI Regulation remain in place. Companies should therefore continue ongoing implementation projects, particularly in the areas of risk classification, documentation, governance, and internal responsibilities. The additional deadlines primarily provide greater planning certainty, but do not alter the fact that the regulatory requirements must be fully implemented in the medium term.

2. Prioritize transparency obligations for generative AI

There is an immediate need for action regarding AI-generated content. Companies that use generative AI systems or publish such content should implement technical solutions for labeling requirements – such as watermarks or machine-readable tags – at an early stage. Since the transition period is significantly shorter in this regard, this area is likely to become relevant before many traditional high-risk requirements.

3. Assess the relationship to sector-specific law early on

For companies in regulated industries – such as medical devices, mechanical engineering, mobility, or consumer products – the intersection between the AI Regulation and sector-specific product law is becoming increasingly important. Affected companies should therefore analyze early on which regulatory requirements will apply in parallel in the future and in which areas potential exemptions or special provisions might apply. Particularly in light of the announced further implementing acts, additional adjustments are to be expected in this area in the future.

4. Integrate prohibited AI practices and deepfake risks into existing governance

The new prohibitions make it clear that regulatory attention is increasingly focused on abusive applications of generative AI. Companies should therefore supplement existing AI governance structures with clear internal guidelines for handling synthetic media, deepfakes, and sensitive content. This applies not only to their own AI developments but also to the use of external AI tools by employees, service providers, or marketing departments.

IV. Conclusion and Outlook

The trilogue agreement on the AI Omnibus makes it clear that the European Union is placing greater emphasis on the practical implementability of the AI Regulation while simultaneously responding to increasing economic and regulatory pressure to adapt. In particular, the extended transition periods and the greater consideration of sector-specific characteristics are likely to provide many companies with additional planning certainty. At the same time, however, the agreement also shows that the EU is sticking to the AI Regulation’s fundamental risk-based regulatory approach and is even expanding it further in certain areas.

The political agreement must now be formally confirmed by the Council and the European Parliament and undergo a final legal-linguistic review. The AI Omnibus is expected to be finally adopted in the coming weeks. Companies should therefore closely monitor further developments and use the additional transition periods to adapt existing AI compliance structures to the foreseeable changes at an early stage.

This article was created in collaboration with our student employee Emily Bernklau.

Background: What Was Planned?

The legislation provided that employers could grant their employees a tax- and social security contribution-free relief bonus of up to EUR 1,000 in the form of allowances and benefits in kind until 30 June 2027. The bonus was intended to mitigate the impact of rising consumer prices and followed the proven model of the earlier inflation compensation bonus (Inflationsausgleichsprämie). Employees had no legal entitlement to the payment – the decision as to whether and in what amount the bonus would be paid was to rest solely with the employer.

Current Situation: Why the Bundesrat Blocked the Legislation

The rejection by the Bundesrat was politically motivated. The federal states consider themselves – together with the municipalities – to be exposed to a disproportionate cost burden, as the tax exemption would have led to significant revenue shortfalls in income tax, the proceeds of which are shared jointly by the federal government, the states, and the municipalities. The Federal Government has since announced that it intends to adhere to its plan and will decide on the next steps in the near future. Several scenarios are now conceivable: a referral to the Mediation Committee (Vermittlungsausschuss) and renegotiations with the states regarding compensation for the tax revenue shortfalls or – in the worst case – a definitive failure of the initiative.

Recommendations for Action for Employers

1. No Payment Without a Legal Basis

The legislation has not entered into force. There is currently no legal basis for a tax- and social security contribution-free relief bonus. Payments that employers now make under the designation “relief bonus” (Entlastungsprämie) are subject to regular tax and social security contributions. Employers should therefore refrain from making any payments and wait until the legislation has actually been promulgated and entered into force. This applies even if budgets have already been approved internally or communication measures have been prepared.

2. Put Internal Plans on “Standby” – Do Not Abandon Them

Many companies have already developed distribution models, drafted works council agreements (Betriebsvereinbarungen), or at least initiated budget approvals in anticipation of the legislation. This preparatory work is not wasted. The Federal Government has signalled that it intends to pursue the initiative. We therefore recommend not discarding the internal plans but rather converting them into a “ready-to-deploy” concept. Should the legislation enter into force at short notice following an agreement in the Mediation Committee, this will provide a considerable time advantage in implementation.

3. Involve the Works Council Early – Even Now

For companies with a works council (Betriebsrat), the following applies: The distribution of such a bonus is subject to the co-determination right under Section 87(1) No. 10 of the Works Constitution Act (BetrVG). The involvement of the works council in determining the distribution criteria, identifying the eligible employee groups, and setting the payment modalities requires the conclusion of a works council agreement (Betriebsvereinbarung). This coordination process typically takes time. Employers should therefore already now – on the basis of a draft works council agreement – seek discussions with the works council in order to be ready to act immediately upon the legislation entering into force. The fundamental decision as to whether a bonus will be paid at all and in what total amount remains solely with the employer and is not subject to co-determination.

4. Ensure Equal Treatment in Distribution

Those who use the preparation time should already now measure the planned distribution criteria against the employment law principle of equal treatment (Gleichbehandlungsgrundsatz). Differentiation is permissible – for example, a graduated scale based on income level, scope of employment, or actual work performance. A restriction to certain employee groups may also be possible, provided there are objective reasons. However, arbitrary distinctions or groupings based on irrelevant criteria are not permissible. In the event of violations, there is a risk of “upward adjustment”: disadvantaged employees could then demand to also receive the full bonus, which can cause considerable additional costs.

The case law on the earlier inflation compensation bonus (Inflationsausgleichsprämie) provides valuable guidance in this regard. In particular, it should be noted that, according to the case law of the Federal Labour Court (Bundesarbeitsgericht), the blanket exclusion of employees in the release phase of partial retirement (Altersteilzeit) is impermissible, and fixed-term employees may not be excluded without objective justification.

5. Manage Employee Communication

Particularly in larger companies and corporate groups, employee expectations are high following the public debate. Employers should communicate proactively and transparently: The legislation has not yet entered into force, but the Federal Government continues to pursue the initiative. A premature commitment to the bonus – for example at works assemblies or in internal communications – should be strictly avoided.

Conclusion

The blockade in the Bundesrat is a setback, but not a definitive end. Employers should closely monitor the situation and maintain their internal preparations without prematurely creating facts on the ground. Those who set the right course now – particularly with regard to works council agreements and distribution concepts – will be able to act quickly and with legal certainty once the legislation enters into force.

We are closely monitoring further developments in the legislative process and will inform you promptly as soon as the situation becomes clearer.

While HEUKING has in numerous iterations of publications, workshops and webinars, assessed the content and effects of the draft EU Space Act, this newsletter now focuses on the proposal for a regulation of the European Union Space Service Agency (new name used) itself.

Background: The European Union Space Agency (EUSPA or the Agency) has outgrown its original mandate. Additional tasks and responsibilities were conferred upon it by Regulation (EU) 2023/588 on the European Union Secure Connectivity Programme, and further expansion is foreseen under the proposed European Competitiveness Fund (ECF) Regulation for 2028–2034. The EUSPA currently supports the operation and exploitation of Galileo and EGNOS navigation services, manages security accreditation of EU space components, promotes downstream market development for Copernicus (Earth observation), operates the GOVSATCOM Hub and the EU Space Surveillance and Tracking (SST) Front Desk, and has assumed responsibilities regarding IRIS².

Broader Strategic Context: Mario Draghi's report on the future of European competitiveness highlighted how the European space economy faces critical challenges, including lower public investment compared to the US and China, supply chain dependencies, and regulatory fragmentation. The Commission has also explicitly described the regulation as part of Europe's pursuit of "space readiness," a concept prominently featured in the March 2025 White Paper for European Defence Readiness 2030.

Connection with the envisaged EU Space Act: In parallel, the EU Space Act, proposed as a first draft the Commission on 25 June 2025, aims to create a unified legal framework for the authorisation, registration, and supervision of space activities, with the EUSPA serving as a key implementation body with multiple tasks. Both legislative initiatives together form a comprehensive regulatory package: the Space Act harmonises the rules applicable to space operators, while the EUSPA Regulation provides the institutional architecture for enforcement and service delivery.

Legislative Status: The legislative process now moves to the European Parliament and the Council under the ordinary legislative procedure. If adopted, the new regulation is intended to apply from 1 January 2028.

I. High-Level Summary of Material Changes

The proposal introduces several material changes that together transform the character of the EUSPA from a programme-implementation vehicle into a permanent, operationally significant EU space services agency.

Renaming: The agency will be renamed from the "European Union Agency for the Space Programme" to the "European Union Space Services Agency," while retaining the well-established EUSPA acronym.

Expanded Operational Mandate: The proposal divides the EUSPA's tasks into three categories:

• own tasks, that the agency performs autonomously (security accreditation, operational security of PNT and EO, space security monitoring);
• tasks delegated by the Commission (management of PNT exploitation, GOVSATCOM Hub operation, downstream market development), EU Space Act tasks; and
• tasks to be delegated subject to operational readiness, including Earth Observation Governmental Service (EOGS), IRIS² governmental services, space weather, space surveillance and tracking, radio-frequency interference monitoring, and support for space commercialisation.

Governance Reforms. The organisational structure (Administrative Board, Executive Director, Security Accreditation Board) is retained but enhanced.

Budget Increase. The Union contribution rises from EUR 525.7 million for 2021–2027 to EUR 979.6 million for 2028–2034, nearly doubling the fix available financial resources.

Fee-Based Revenue. A new provision in Art. 25(3e) allows the EUSPA to charge fees for services rendered, with the legal basis for fee collection to be established by the EU Space Act.

Digital and AI Compliance. A "Digital Annex" obliges the EUSPA to align its digital solutions with the EU AI Regulation, the Cybersecurity Framework, the eIDAS Regulation, and the Single Digital Gateway Regulation, with consequences for contractors providing digital services to the agency.
Continuity Obligations for Contractors. Article 4(7) requires the EUSPA to ensure that its contractual operators maintain competency frameworks, succession planning, and operational capability to ensure service continuity during crises or extended disruptions.

Transitional Provisions. The new EUSPA shall continue operations and activities of the current agency in respect of all ownership, agreements, legal obligations, employment contracts, financial commitments, and liabilities. The new regulations and the transitional period until new regulations will actually have effect are arguably the most challenging effects for the EUSPA in the coming years.

II. Material Practical Effects

1. Near-Doubling of the Agency's Budget

The proposed increase from EUR 525.7 million to EUR 979.6 million represents a clear signal that the Commission envisions a materially larger and more capable agency. The budget increase is linked to both the continuation of current tasks and the financing of new activities under the expanded mandate. For industry participants, this translates directly into a larger addressable market for EUSPA-managed contracts and procurement opportunities.

2. Role under the EU Space Act

The EUSPA Regulation must be read together with the proposed EU Space Act, which assigns the agency central responsibilities for supervising compliance by EU-owned asset operators and third-country space service providers:

• under the Space Act, the EUSPA would manage the URSA, issue electronic certificates of compliance (e-certificates), and conduct technical assessments that form the basis for Commission authorisation decisions
• authority responsibilities of the EUSPA regarding EU own assets
• at least in the 2025 draft, an EU Space Label system
• crisis exemption and other easement or derogations decisions
• NIS2 and CRITIS similar implementation measures and interplay questions
• connection and cooperation with ESA and Institutions
• enhanced capacity building specifically regarding the requirements regarding the EU Space Act
• a number of further, yet unclear, areas of responsibility under future delegated acts.

The EUSPA would also be empowered to open investigations in the event of serious indications of infringement of the Space Act's technical requirements and to propose fines to the Commission.

3. Crisis Management and Operational Continuity Framework

The proposal introduces a crisis management responsibility that is novel for an EU decentralised agency of this type. Once a crisis is declared, the Executive Director of EUSPA gains authority to impose operational measures on staff and to activate business continuity procedures. Staff from Member States may be deployed for up to two years to address urgent situations or peaks of work. This framework requires the EUSPA to be 24/7 operational entity rather than a policy secretariat.

4. Enhanced Security Accreditation Authority

While the Security Accreditation Board (SAB) remains autonomous within the agencies, several procedural innovations streamline its decision-making. A single approval may now cover entire satellite constellations rather than requiring individual assessments. The Commission may request a decision within three months in duly justified cases; if no decision is adopted within that timeframe, it shall be deemed affirmative. This "silence is consent" could significantly reduce the time-to-market for new space systems and constellation deployments.

5. Digital Compliance and AI Regulation Alignment

The Digital Annex represents a significant regulatory extension into the technology governance sphere. By requiring the EUSPA to align its digital solutions with the AI Regulation, the EU Cybersecurity Framework, eIDAS, and the Single Digital Gateway, the Commission creates cascading compliance requirements for the agency's digital service providers and contractors. Companies supplying AI-powered analytics, cybersecurity tools, or digital infrastructure to the EUSPA must anticipate heightened compliance expectations, including conformity assessments under the AI Regulation for high-risk AI systems used in security-critical applications.

6. Fee-Based Revenue Model

The introduction of a fee-based financing mechanism in Article 25(3e) signals a shift toward partial cost-recovery for EUSPA services. While the precise fee structure and applicable services will be defined through the EU Space Act, this provision opens the door to registration fees, compliance certification charges, and service delivery fees that could affect space operators and data providers interacting with the EUSPA. Initial third-party estimates show a very broad range, without any concrete basis yet. The fee-based model, however, may create additional cost considerations for small and medium-sized enterprises and start-ups seeking access to the EU space market.

7. Contractual Business Continuity Requirements

Article 4(7) introduces a novel obligation for the EUSPA to ensure that its contractual operators maintain robust competency frameworks, succession planning, and operational capability sufficient to guarantee service continuity during crises or extended disruptions. For companies contracting with EUSPA, this translates into concrete contractual requirements for business continuity management (BCM) and disaster recovery plans.

8. Expanded Geographic and Organisational Footprint

Prague remains the agency's seat, but the proposal provides clearer legal backing for the establishment of local offices in Member States and the placement of staff at ground infrastructure centres across the EU. For host Member States, this may create opportunities for local economic development and specialised workforce requirements tied to space operations.

9. Interaction with the ESA and Clarification of Institutional Boundaries

The proposal implicitly addresses the long-standing institutional boundary question between the EUSPA (an EU agency) and the European Space Agency (an intergovernmental organisation). The EUSPA is positioned as the operational arm responsible for service delivery, security, market development, and user-facing functions, while the ESA retains focus on research, development, and technical oversight.

10. Commercialization and Facilitation

The proposal creates significant new opportunities for companies active in the “New Space” sector – start-ups, scale-ups, and innovative SMEs developing commercial space applications, downstream services, and space-derived data products. Article 4(3)(l) explicitly tasks the EUSPA with supporting the implementation of the “Space commercialisation and space economy” Union space component, including continuation of the CASSINI initiative, the EU’s dedicated support framework for space entrepreneurship.

Moreover, the EUSPA is mandated to foster technological development and the commercialisation of EU space industry and services, with a specific objective of helping entrepreneurs to grow and scale up. The Agency will continuously monitor the market, the evolution and impact of the space economy, and provide inputs on new user needs, creating an opportunity for innovative companies seeking to develop downstream applications, integrated services, and new data products based on EU space infrastructure.

11. The Military Dimension

The military dimension of space further amplifies these opportunities. As noted above, the Commission has explicitly described the EUSPA Regulation as part of Europe’s pursuit of “space readiness,” a concept prominently featured in the March 2025 White Paper for European Defence Readiness 2030. At the national level, Germany has made available a budget of EUR 35 billion for military space, signalling that defence-related space capabilities, notably and most prominently including secure communications, intelligence, surveillance, and reconnaissance (ISR), and space situational awareness, will be a major growth driver for the sector, in particular through trickle down effects to suppliers and startups.

For startups, this convergence of civilian and military demand creates a substantially larger addressable market. Companies offering dual-use technologies, resilient satellite constellations, space-derived data analytics, or cybersecurity solutions for space infrastructure are particularly well-positioned to benefit from both the EUSPA’s expanded commercialisation mandate and the parallel surge in national defence space procurement.

Stakeholders should note that the EUSPA’s enhanced role in operational security, its cooperation with ENISA on cybersecurity, and the Agency’s positioning as a 24/7 operational entity (described above) all reflect the growing integration of space into Europe’s broader security and defence architecture.

III. Recommended Actions for Stakeholders

The EUSPA Regulation proposal, in combination with the EU Space Act, creates a new regulatory ecosystem that will require proactive engagement from a wide range of stakeholders. The following recommendations are structured by stakeholder category.

1. EU-based space operators and manufacturers should begin mapping their current and anticipated interactions with the EUSPA to identify which authorisation, registration, and compliance obligations will apply once the EU Space Act enters into force on 1 January 2030. They should assess

• the adequacy of their cybersecurity risk management systems,
• environmental footprint calculation methodologies, and
• business continuity plans

in light of the heightened requirements of both the Space Act and the EUSPA Regulation. Early engagement with national competent authorities and envisaged Qualified Technical Bodies (QTBs) is advisable to understand the forthcoming certification processes.

2. Third-country operators providing space-based services or data within the EU, including US satellite operators, data providers, and hosted payload owners, should

• carefully assess their exposure to the EU market and determine whether they fall within the scope of the EU Space Act's authorisation requirements; and, where applicable,
• they should plan for the designation of an EU legal representative, prepare for potential equivalence decision applications, and monitor the legislative process for possible modifications to the extraterritorial scope provisions.

3. EUSPA prime contractors and service providers:

• should review their existing contractual arrangements in anticipation of enhanced business continuity and operational resilience obligations under Article 4(7) of the EUSPA Regulation;
• should prepare for compliance with the AI Regulation and the broader digital governance framework referenced in the Digital Annex if providing digital services to the agency;
• should anticipate deepened cooperation requirements between the EUSPA and ENISA, particularly if providing cybersecurity services.

4. Suppliers and service providers to EUSPA primes, in particular as it regards resilience or safety requirements should

• assess the new rulings to determine if and how these address also the supply chain, either by a requirement for the primes to contractually agree with suppliers in the same standards or indirectly, because the new Regulations may steer the market regarding certain standards and requirements;
• should engage with their prime contractors in order to, where possible, be included in cooperation and compliance planning at an early stage.

5. Member States and EU Regions should

• begin preparing for the pitch and the designation or establishment of national competent authorities as required by the EU Space Act and for contributing to the Security Accreditation Board's expanded activities.
• Member States and Regions that have not yet enacted national space legislation should consider whether to adopt interim rules or to await the final text of the EU Space Act before acting.

6. Investors and financial institutions active in the European space sector should

• factor the new regulatory costs and compliance timelines into their transaction due diligence and valuation models.
• The expanded EUSPA mandate and the near-doubling of its budget represent both regulatory risk and addressable market opportunity, depending on the positioning of portfolio companies within the emerging EU space regulatory framework.

7. Industry associations and trade bodies should

• actively participate in the legislative process during the European Parliament committee stage and Council working party negotiations, as the final text may differ significantly from the Commission's proposal.
• The public consultation period for the EU Space Act closed in November 2025, but ongoing advocacy and engagement with rapporteurs and shadow

rapporteurs remain essential channels for shaping the implementing measures and delegated acts that will determine the practical application of both the Space Act and the EUSPA Regulation.

IV. Conclusion and Outlook

The Commission's proposal for a standalone EUSPA Regulation marks a structural shift in European space governance. Seen together with the EU Space Act, it creates an integrated regulatory framework that will reshape the terms of access to the European space market for EU and non-EU operators alike.

The legislative process is now underway (also for the draft EU Space Act), with the European Parliament and the Council expected to begin substantive deliberations in the second half of 2026. While the broad objectives of the proposal enjoy broad support, specific provisions, particularly regarding the scope of Commission control over EUSPA decisions, the accreditation of third-country operators, the fee-based revenue model, and the interaction with national space legislation, are likely to generate debate during the trilogue negotiations and, possibly, again regarding the question of competency.

For all stakeholders in the European space ecosystem, from launch providers and satellite manufacturers to data service companies and downstream application developers, the message is clear: the regulatory environment for space activities in Europe is fast developing and early preparation is essential.

HEUKING’s Space Law team continues to monitor the legislative process closely and is available to assist clients in navigating the evolving EU space regulatory framework.

I. Affected Companies

The personal scope of the e-Evidence Regulation is deliberately broad and covers all “service providers” that offer electronic communication or data processing services. The decisive factor here is not formal industry affiliation, but the specific function of the respective business model. The key question is whether a company enables users to communicate with one another or stores and processes data on their behalf.

In practice, this initially includes traditional providers of electronic communication services, particularly telecommunications companies, email providers, and messenger and VoIP services. Typical examples are providers of email hosting, enterprise communication solutions, or collaboration tools. Operators of video conferencing systems or business messaging platforms may also be covered, provided they enable interpersonal communication.

Furthermore, hosting and cloud services are centrally affected. These include, for example, cloud storage providers, Software-as-a-Service (SaaS) platforms, data hosting service providers, or providers of project management and CRM systems, to the extent that they store or process data on behalf of users. This is particularly relevant in practice for companies that provide their customers with digital infrastructures, such as data rooms, document management systems, or platform solutions.

However, the scope of application extends even further and also covers other information society services, provided they offer communication or storage functions. These include, in particular, social networks, online marketplaces, gaming platforms with chat functions, dating apps, and collaboration platforms. Even services where communication is only a secondary function – such as chat features in online games or comment features on platforms – may be covered.

Also explicitly included are providers of domain and internet infrastructure services, such as domain registrars, hosting providers, CDN providers, or providers of IP addressing services. These are regularly the focus of when it comes to identifying users based on technical data such as IP addresses.

Finally, the company’s place of business is irrelevant. Providers based outside the EU are also subject to the Regulation if they offer their services within the Union, for example through a corresponding market orientation or a relevant user base within the EU. An exception applies only to certain financial services; otherwise, there are no size- or industry-based exemptions.

II. Production and Preservation Orders (EPOC and EPOC-PR)

At the heart of the e-Evidence Regulation are two new instruments: the European Production Order Certificate (EPOC) and the European Preservation Order Certificate (EPOC-PR). These enable law enforcement authorities to directly and cross-borderly compel service providers to produce or preserve electronic evidence (Art. 5, 6 E-Evidence Regulation).

The EPOC under Art. 5 of the E-Evidence Regulation obligates the addressed service provider to transmit the requested data directly to the competent authority. In particular, the order must be necessary and proportionate and, depending on the type of data, is subject to various substantive and procedural requirements, such as a judicial review requirement for traffic and content data. Upon receipt of the order, the data must generally be transmitted within ten days; in urgent cases, the deadline is reduced to eight hours (Art. 10 E-Evidence Regulation).

In contrast, the EPOC-PR under Art. 6 E-Evidence Regulation serves to secure data in order to prevent its deletion or alteration. Service providers are obligated to retain the relevant data for an initial period of 60 days (Art. 11 E-Evidence Regulation), with the possibility of an extension. It typically functions as a preliminary measure prior to a subsequent production order.

For companies, this means that they may not only be obligated to actively transmit data but must also implement and maintain data preservation measures at short notice. The Regulation thus establishes, for the first time, directly enforceable, cross-border obligations on private service providers.

III. German Implementing Act

With the Act Implementing Regulation (EU) 2023/1543, the German legislature has created an independent national legal framework that specifically defines, in particular, jurisdictions, procedures, and enforcement mechanisms. At its core is the Electronic Evidence Implementation and Enforcement Act (EBewMG), which integrates the requirements of EU law into German criminal procedure law.

First and foremost, the obligation to designate a designated recipient is central: service providers must designate a branch or a representative within the EU who is responsible for receiving and implementing production and preservation orders (§ 3 EBewMG). This designated recipient must be equipped with sufficient powers and resources to actually comply with the orders.

The law also regulates domestic jurisdictions and procedures. Depending on the type of data, public prosecutors’ offices and courts are specifically responsible for issuing and enforcing European Production Orders (Sections 9, 10 EBewMG), while the public prosecutor’s office generally acts as the enforcement authority (Section 11 EBewMG). At the same time, it is clarified that the general provisions of the Code of Criminal Procedure apply in addition (Section 7 EBewMG).

The law also provides for comprehensive enforcement and sanction mechanisms. Violations of cooperation and implementation obligations—such as the failure to provide or secure data in a timely manner—may be punished as administrative offenses with substantial fines, which, for larger companies, are based on global revenue (Section 18 EBewMG).

IV. Recommendations for Companies

In light of the E-Evidence Regulation coming into force on August 18, 2026, affected companies should take concrete organizational and technical measures at an early stage:

1. Define responsibilities and an “e-evidence response process”

Companies should establish a clearly defined internal process for handling EPOC and EPOC-PR orders. This includes, in particular, designating a central point of contact (e. g., Legal/Compliance), setting up a 24/7 availability plan, and defining binding escalation procedures to ensure compliance with the 8-hour deadlines in urgent cases.

2. Implement and document the recipient structure in a timely manner

The designation of a recipient (branch office or representative) required by the Implementation Act should not be merely a formality but should be supported by organizational measures. The recipient must actually be able to review orders, forward them internally, and implement them. This includes clear powers of attorney, access to relevant data structures, and documented communication channels with authorities.

3. Prepare technical processes for data backup and extraction

Companies should verify whether their IT systems allow for a short-term backup (“freeze”) as well as a structured extraction of relevant data (e.g., inventory, traffic, or content data). In practice, it is advisable to establish standardized export and provisioning processes (e.g., for mailboxes, log files, or account data) to ensure requests can be fulfilled in a timely and complete manner.

4. Develop review and decision-making procedures

Incoming orders should not be implemented without review. Companies should develop an internal review framework that systematically maps out, in particular, the formal requirements (e. g., competent authority, correct data category, deadlines) as well as possible grounds for refusal or further inquiry. This review must be designed to function reliably even under significant time pressure.

5. Adapt interfaces to data protection and deletion concepts

Existing deletion and archiving concepts should be reviewed to ensure they are compatible with preservation orders. In particular, mechanisms must be implemented that enable the immediate suspension of automated deletion routines. At the same time, the legal basis for processing and transmitting data in the context of e-evidence orders should be documented.

V. Conclusion and Outlook

The e-evidence regulation and the accompanying German implementing law establish a new, immediately effective regime for cross-border access to electronic evidence. For affected companies, this means a significant expansion of their obligations to cooperate, as well as the need to be able to respond to official orders at short notice. The combination of tight deadlines, direct contact from foreign authorities, and severe sanction mechanisms significantly increases compliance pressure.

In practice, the key factors will be how frequently and to what extent the new instruments are actually used, and how the competent authorities handle the existing discretion – for example, regarding rights of review and refusal. At the same time, interfaces with data protection law, particularly the General Data Protection Regulation, remain fraught with uncertainty and are likely to be subject to further clarification through case law and administrative practice.

Companies should use the time remaining until August 18, 2026, to specifically adapt their internal processes, technical structures, and responsibilities. The e-evidence rules are expected to quickly become an integral part of the regulatory requirements for data-processing business models.

Raids in North Rhine-Westphalia and Bavaria

Press reports describe this as the biggest crackdown on German tax havens in the history of the Federal Republic. The investigation is being led by the newly established Central and Contact Point for the Prosecution of Economic and Financial Crime (Zentral- und Ansprechstelle für die Verfolgung von Wirtschafts- und Finanzkriminalität (Zefin)) at the Düsseldorf Public Prosecutor’s Office. Together with approximately 110 investigators from the State Office for Combating Financial Crime (Landesamt zur Bekämpfung der Finanzkriminalität (LBF NRW)), Zefin carried out searches at numerous locations – particularly in Monheim and Leverkusen, but also in Düsseldorf, Mönchengladbach, and Siegburg, as well as in Bavaria.

The search operations targeted not only the companies themselves, which the authorities viewed as suspects, but – according to media reports – primarily a service provider that, allegedly knowing that the company’s registered office was only listed there as a front, rented offices to more than 100 companies, thereby enabling them to maintain a fictitious registered office. Law enforcement agencies in North Rhine-Westphalia, in particular, have stepped up their efforts against tax evasion. Last year alone, there were large-scale searches related to allegations of trade tax evasion. Further investigative measures and searches by the aforementioned, newly established, and adequately staffed agencies in the field of economic and financial crime are expected in the future.

Focus on Low Trade Tax Rates

The background to the statewide search operations is an investigation into tax evasion based on inaccurate trade tax returns regarding the so-called “center of business management.” Municipalities such as Monheim am Rhein, Grünwald, and Leverkusen attract companies with exceptionally low trade tax assessment rates. The assessment rate in Monheim is 250 points – significantly below the national average of around 405 points. The tax savings for companies headquartered in these locations are substantial. Tax authorities are now examining whether the reported business locations actually exist or whether they are merely mailbox addresses. The suspicion is directed at companies that do not maintain their own premises, staff, or operational activities at the low-tax location, but instead conduct their actual business operations elsewhere.

Criminal tax law risks associated with incorrect information regarding the permanent establishment

If trade tax was due at a location other than the permanent establishment location stated by the company, the previous trade tax returns may contain incorrect or incomplete information regarding tax-relevant facts within the meaning of Section 370(1)(1) of the German Fiscal Code (AO). Whether and where a permanent establishment exists is determined in accordance with § 12 AO. According to this provision, a permanent establishment is any fixed place of business or facility that serves the activities of the enterprise. In particular, a permanent establishment may also be the location of the management. In determining the location of management, the center of the overall business management must be taken into account (§ 10 AO). The decisive factors here are the actual circumstances and the actual exercise of management activities, not merely a formal registration. The tax authorities rely on indicators such as the lack of dedicated office space, no staff working on-site, the use of coworking spaces or virtual offices without a physical presence, as well as management and operational decisions being made at a different location. Criminal liability for tax evasion requires, in addition to the aforementioned incorrect or incomplete information, that this results in reduced tax payments or the obtaining of unjustified tax advantages (Section 370(1) AO). In the event of a conviction for such tax evasion, fines or imprisonment of up to five years may be imposed; in particularly serious cases, up to ten years (Section 370(1), (3) AO).

What Companies Should Do Now

Companies based in low-tax jurisdictions should immediately conduct (or have conducted) a tax review to determine whether their permanent establishment structure would withstand scrutiny under tax law or criminal tax law. It is particularly crucial that actual business activity takes place at the reported location – documented by the company’s own premises, on-site staff, and verifiable operational decisions made locally. Those who proactively analyze their own permanent establishment situation and make corrections where necessary can significantly reduce the risk of criminal prosecution.

Under the conditions of Section 371 of the German Fiscal Code (AO), a voluntary disclosure that exempts one from punishment may also be considered in individual cases – but only as long as the offense has not yet been discovered, for example, through a search and seizure of incriminating documents. Finally, companies should generally – regardless of any justified or unjustified allegations against them – prepare for potential searches, which means establishing guidelines, training employees accordingly, designating an external criminal defense attorney as an emergency contact, and maintaining an appropriate emergency plan. This plan should contain clear instructions for the employees present. In particular, it is essential to remain calm and generally cooperate until a consultant – who should be contacted as soon as possible – arrives on site to constructively assist with the search.

The Act implements various EU directives and aims to ensure a uniform and high level of consumer protection within the EU internal market. In particular, it regulates the (partial) restriction of the so-called perpetual right of withdrawal for financial services, as well as the introduction of an electronic withdrawal function for online contracts. Furthermore, the model withdrawal policy is being eliminated.

Below, we outline selected changes and highlight the resulting implications that financial service providers should consider in the future:

I. Restriction of the so-called perpetual right of withdrawal for consumer contracts regarding financial services

Under the previous legal framework, a consumer could have an indefinite right of withdrawal if the financial services provider had not properly fulfilled its information obligations under Article 246b § 2(1) EGBGB (§ 356(3) BGB, old version).

The revised version of § 356(3) and (4) BGB seeks to limit this risk. In the future, the right of withdrawal will expire, even in distance contracts for financial services, no later than 12 months and 14 days after the date specified in § 356(2) BGB or § 355(2), sentence 2, BGB. This date is generally the conclusion of the contract, even if the financial services provider has not fully complied with its duty to provide information.

However, a perpetual right of withdrawal may still arise if the consumer has not been informed of their right of withdrawal and the procedures for exercising it in accordance with Article 246b § 1(1)(16) of the Introductory Act to the German Civil Code (EGBGB), meaning the business operator has not properly instructed the consumer regarding the right of withdrawal.

II. Introduction of an electronic withdrawal function (so-called “withdrawal button”)

Section 356a(1) of the German Civil Code (BGB) introduces a mandatory electronic withdrawal option.

Businesses that enter into distance contracts via an online user interface must provide consumers with an easily accessible, consistently available, and user-friendly electronic option to cancel the contract. Canceling the contract must be just as easy as entering into it. The cancellation option must be clearly labeled with “Cancel Contract” or another equally unambiguous phrase.

The responsibility lies with the company as the consumer’s contractual partner, even in cases where the contract is concluded through third-party providers (intermediary platforms). The company must ensure – if necessary through a contractual obligation to the third-party provider – that the consumer can use an electronic withdrawal function. Exactly how this obligation is to be fulfilled in practice remains open.

III. Elimination of the Model Cancellation Policy for Financial Services

The previous model withdrawal notices from Annex 3-3b of the EGBGB are deleted without replacement. Article 246b § 2(3) of the EGBGB, which guaranteed the business that it fulfilled its duty to inform regarding the right of withdrawal by providing the consumer with the corresponding model withdrawal notice, has been deleted accordingly. The legislative rationale states that the model withdrawal notices are not provided for in the version of the fully harmonized Consumer Directive to be implemented, and there is no legislative leeway. Financial service providers must therefore independently develop and implement legally compliant withdrawal notices.

In practice, this change – contrary to its intention – leads to legal uncertainty at the expense of the business. The financial services provider cannot simply assume that the cancellation policy it uses is sufficient to fulfill the duty to inform.

IV. Expansion/Update of the Information Obligations under Article 246b § 1 EGBGB

The financial service provider’s duty to inform the consumer in accordance with Article 246b §§ 1 to 3 EGBGB (§ 312d(2) BGB) remains in effect and is expanded in scope.

New requirements include, in particular, information from the financial service provider regarding the consequences of late payment or default (Article 246b § 1 No. 8 EGBGB) as well as – where applicable – notices regarding personalized pricing based on automated decision-making. Furthermore, if environmental and social factors are incorporated into the financial service provider’s investment strategy, information must be provided regarding the environmental and social objectives pursued by the financial service (Article 246b § 1 No. 15 EGBGB).

Violations of this obligation may be punished with a fine under Article 246e EGBGB.

V. New Obligations: Duty to Remind and Duty to Explain

The law introduces additional obligations for financial service providers.

The duty to remind (Article 246b § 2 (2) EGBGB) applies if, upon conclusion of a distance contract, the information required under Article 246b § 1 (1) EGBGB is provided to the consumer less than one day before the time at which the consumer becomes bound by the contract. In this case, the consumer must be reminded of the right of withdrawal under § 355 BGB as well as the procedure for withdrawal. This reminder must be provided on a durable medium between one and seven days after the conclusion of the distance contract.

The duty to provide explanations (Article 246b § 3 EGBGB) requires financial service providers to provide the consumer with comprehensible explanations of the essential features and implications of the contract on a durable medium prior to the conclusion of the contract. The aim is to enable an informed decision. In the case of distance contracts for financial services, consumers may use online tools to request additional explanations from a human representative, even after the contract has been concluded.

VI. Conclusion and Need for Action

The new regulations lead to significant changes that require special attention from financial service providers.

A positive aspect is that the clear time limit on the right of withdrawal now generally applies to distance contracts for financial services as well. At the same time, requirements regarding information obligations, digital processes, and contract drafting are increasing. The removal of the model withdrawal instructions and the resulting legal uncertainty must be viewed critically.

Financial service providers should therefore assess at an early stage whether adjustments are necessary. Particular attention must be paid to the proper preparation and distribution of the cancellation policy in accordance with Article 246b § 1 (1) No. 16 EGBGB, as well as to the implementation of the new digital requirements.

I. Data Protection Classification

The use of AI-powered transcription tools in online meetings constitutes the processing of personal data within the meaning of the General Data Protection Regulation (GDPR). This regularly involves the capture of both spoken words and additional contextual information from participants, thereby bringing the activity within the scope of the GDPR. In its 40th Annual Report, the LfDI Baden-Württemberg clarifies in this regard that companies that decide to use such a tool are generally to be regarded as data controllers themselves and bear overall responsibility under data protection law.

In practice, the provider of the transcription service will often be classified as a processor, meaning that a data processing agreement pursuant to Article 28 of the GDPR must be concluded. This agreement must be critically reviewed and technically secured, particularly with regard to any potential use of the data for the provider’s own purposes, such as for training AI systems.

Furthermore, the processing requires a sound legal basis. In particular, the consent of the data subjects or the protection of legitimate interests may be considered, although a careful balancing of interests must be carried out on a case-by-case basis. In this context, the BayLDA emphasizes that consent, particularly in an employment context, often cannot be regarded as a valid basis, and instead the legitimate interest under Article 6(1)(f) of the GDPR takes on particular significance, provided that the necessity of the transcription can be justified.

In addition, the information obligations under Article 13 of the GDPR must be observed. Participants must be informed in a timely and transparent manner about the use of the transcription tool, the purpose of the processing, and any storage of data. Furthermore, it must be ensured that data subjects’ rights, such as the right to object, can be exercised effectively in practice.

II. Protection of the spoken word (Section 201 StGB)

In addition to data protection requirements, the criminal law protection of the spoken word must also be observed when using transcription tools. Under § 201 StGB, anyone who records or makes accessible a non-public spoken statement without the consent of the data subjects may be liable to prosecution. This is regularly the case with automated transcription, as at least an audio recording is technically made.

In practice, this means that prior consent from the participants is generally required. While this consent may also be implied – for example, by participating in a meeting clearly marked as such – it always requires clear and transparent information about the transcription. Companies should therefore ensure that all participants are explicitly informed about the transcription before the recording begins and that they consent to it.

III. Requirements of the AI Regulation

The AI Regulation introduces an additional legal framework that must be taken into account when using transcription tools. The risk-based approach of the Regulation is particularly relevant here. Pure transcription solutions will generally not be classified as high-risk AI systems as long as they are limited to converting speech into text and do not make any further assessments or decisions.

However, this classification may change if transcription functions are combined with additional analysis or evaluation elements, such as for monitoring employee performance or analyzing the content of communications. In such cases, a connection to high-risk applications – particularly in an employment context – may be considered.

Regardless of a high-risk classification, companies are required to systematically document and manage the use of AI systems. This includes, in particular, clearly defining areas of application, assessing risks, and embedding the use of such tools into internal policies and compliance frameworks.

IV. Recommendations for Companies

In practice, the following measures can be derived from the requirements outlined above:

• Ensure transparency and participant involvement: The invitation should already clearly inform participants about the planned transcription and its purpose. An additional notice (e. g., verbally or via a pop-up) is recommended at the start of the meeting. Furthermore, it must be ensured that participants can object to the transcription or switch to alternative communication channels.
• Configure and review tool settings carefully: Features such as AI training, advanced content analysis, or unnecessary data storage should be deactivated wherever possible. Additionally, it should be assessed whether transcription without permanent storage (e. g., live captions) is sufficient. The blanket or permanent activation of such features should be avoided.
• Implement contractual and organizational safeguards: Entering into a robust data processing agreement is essential and should be carefully reviewed, particularly with regard to the provider’s access to data. Additionally, it is recommended to introduce internal guidelines for the use of AI tools that include clear guidelines on use cases and the handling of sensitive content.

V. Conclusion and Outlook

The transcription of online meetings using AI-powered tools offers significant efficiency potential but is subject to complex legal requirements. In addition to data protection regulations and criminal law restrictions, the framework of the AI Regulation must increasingly be taken into account. It is therefore crucial for companies to manage the use of such tools in a structured manner and to ensure legal compliance. Given the ongoing regulation and the growing practical significance of this field, it is expected that regulatory authorities and legislators will devote even greater attention to this area in the future.

This article was created in collaboration with our student employee Emily Bernklau.

The new requirements, which apply exclusively to the B2C sector and are implemented through a revised version of the UWG, will take effect on September 27, 2026. As things stand, no transition period is planned.

I. Scope of Application of the New UWG Rules

The amendment to the UWG introduces several categories of environmental business practices, each of which is subject to separate regulations.
Specifically, this applies, among other things, to:

• “generic environmental claims” that, due to a lack of specificity in the same medium, pose a particular risk of misleading consumers;
• “sustainability labels,” which in the future must be based on a certification system or be established by the government;
• advertising “future environmental performance,” i. e., statements about environmental performance not yet achieved that are linked to a robust implementation plan;
• product-related statements regarding environmental or climate friendliness through “offsetting of greenhouse gas emissions,” which will be prohibited in the future.

In our HEUKING series, Part 1 dealt with general environmental claims, Part 2 with sustainability labels, Part 3 with future environmental performance, and Part 4 with the offsetting of greenhouse gas emissions. This article examines the consequences for trademarks, business names and corporate logos.

II. Applicability of the New Prohibitions to Protected Signs

The provisions of the EmpCo Directive do not distinguish between whether an advertising claim is protected as a trademark, a business name or a corporate logo (collectively: protected signs). Such advertising claims may now only be used under the prescribed conditions. In the opinion of the European Commission, even the subsequent cancellation of trademarks that violate the Directive should be considered.

1. Protected Signs as “Generic Environmental Claims”

In addition to its distinctive element, a trademark may also contain elements with ecological significance (e. g., eco, green, climate-neutral). Since trademarks are typically short and concise, a more detailed explanation is usually lacking, meaning they may constitute a generic environmental claim, which is only permissible under strict conditions (see ESG Update 1/2026). The overall impression is decisive: the prohibition applies only if the average consumer perceives the trademark as an environmental claim.

In the case of business names and corporate logos, classification as a generic environmental claim is often questionable, as consumers typically perceive them merely as a reference to the company. However, such a classification cannot be ruled out in individual cases.

The trademark user can counteract a classification as a generic environmental claim by providing a clear explanation on the same medium (e. g., product packaging or advertisement). However, the general requirements for permissible advertising practices and the specific provisions of the EmpCo Directive remain applicable.

2. Trademarks as “Sustainability Labels”

Trademarks may also be classified as sustainability labels, particularly if they are intended to indicate specific ecological or social product characteristics.

Typically, such trademarks are registered as certification marks. In the opinion of the European Commission, these should be classified as sustainability labels, meaning their use is permitted only under strict conditions (government designation or certification system) (see ESG Update 2/2026). For regular individual trademarks, the Commission considers this unlikely but not impossible. In the legislative rationale, the German legislature states that regular individual trademarks cannot, in principle, be sustainability labels.

This view is not entirely convincing, as some certification logos have also been registered as regular individual trademarks. Case law will therefore likely decide on a case-by-case basis whether a trademark is to be understood as a sustainability label.

3. Signs as statements regarding “future environmental performance”

The possibility that protected signs might contain statements about future environmental performance is largely theoretical. Such statements are typically not concise enough to qualify as a protected sign. If this is nevertheless the case, their use is permitted only in compliance with the relevant regulations (in particular: implementation plan, external verification) (see ESG Update 3/2026).

4. Protected Signs as Statements on Environmental or Climate Friendliness Through Greenhouse Gas Emission Offsetting

If a protected sign contains a statement regarding environmental or climate friendliness, its permissibility depends on what it is based on. If climate friendliness is to be achieved through the offsetting of greenhouse gas emissions, the statement is absolutely impermissible (see ESG Update 4/2026). In the case of actual reductions, however, the use is not objectionable under this aspect

III. Consequences for the Granting of Protection for New Signs

1. German Trademarks

To the extent that German trademarks are applied for after the provisions of the EmpCo Directive come into force, and their use is clearly inadmissible under the EmpCo Directive, the German Patent and Trademark Office (DPMA) could refuse registration of the trademark in question because this would then constitute an absolute ground for refusal under Section 8(2)(13) of the German Trademark Act (MarkenG).

However, this ground for refusal of registration only applies if it involves a statutory prohibition that prohibits the use of the trademark for the goods and services for which it is to be protected, regardless of the context of the specific use. Whether this is the case with the prohibitions arising from the EmpCo Directive is highly questionable:

The use of a generic environmental claim may (apart from cases where the user can demonstrate recognized excellent environmental performance) also be permissible, for example, by adding explanatory notes during use that transform it into a specific environmental claim. Against this background, a trademark containing a generic environmental claim can hardly be refused registration on this ground, since its use is not impermissible under certain circumstances. Trademarks that can be understood as sustainability labels or contain statements about future environmental performance may be lawfully used if certain conditions set forth in the EmpCo Guidelines are met. Whether these conditions are met is not apparent to the Trademark Office in any case, which is, however, a prerequisite for refusing protection under Section 8(2)(13) of the German Trademark Act (MarkenG). Finally, if the trademark applied for constitutes an indication of environmental or climate friendliness, its use is indeed (absolutely) prohibited under the EmpCo Directive if the environmental or climate friendliness results from greenhouse gas offset measures; however, precisely this circumstance is typically not apparent to the Trademark Office and therefore likely cannot be invoked as grounds for refusing registration either.

The absolute ground for refusal based on the registered trademark’s violation of public policy (Section 8(2)(5) of the German Trademark Act) is also unlikely to apply as a rule. Under German law, this ground for refusal also applies only to cases in which the use of the trademark is impermissible in any event, regardless of its context. Furthermore, this provision covers only violations of regulations that constitute fundamental principles of the legal system; whether this is the case with the provisions of the EmpCo Directive appears, at the very least, questionable.

Overall, therefore, it is unlikely that the restrictive requirements of the EmpCo Directive will lead to a significant change in the trademark registration practice of the German Patent and Trademark Office (DPMA). Regarding the (separately assessable) question of the subsequent cancellation of a trademark already applied for or registered at the time the legal amendment comes into force, see section IV below.

2. EU Trademarks

There is no provision in EU trademark law corresponding to German § 8(2)(13) MarkenG. Rather, the relevant absolute ground for refusal under EU trademark law arises from Art. 7(1)(f) of the EU Trademark Regulation (violation of public policy). Here, too, “public policy” does not encompass every legal regulation, and it therefore appears at least doubtful whether a violation of EmpCo regulations would be sufficient to preclude trademark registration.

However, if a violation of the EmpCo Directive is considered a violation of public policy within the meaning of Article 7(1)(f) of the EUTM Regulation, the application of this ground for refusal under EU trademark law – unlike under German trademark law – is not precluded merely because certain facts necessary for assessing the legal violation are not apparent to the European Union Intellectual Property Office (EUIPO); rather, the EUIPO may, in principle, conduct the necessary supplementary factual investigations ex officio.

Furthermore, under EU trademark law as well, the assessment of whether the ground for refusal applies cannot be based on circumstances accompanying the use of the mark, meaning that a refusal of registration cannot, in any event, be justified solely on the grounds that the applied-for mark contains a generic environmental claim.

3. Business Names and Corporate Logos

Unlike trademarks, protection of business names and corporate logos cannot be achieved through registration but arises rather through their owner’s (authorized) use in the course of trade. If the use of a new business name or corporate logo occurs only after the prohibitive provisions of the EmpCo Directive have entered into force and such use violates these provisions, the use is not “authorized,” and no protection of the corporate signarises.

IV. Consequences for Pre-Existing Protected Signs

It is questionable whether the prohibitions of the EmpCo Directive also apply to protected signs that already existed at the time the legal amendment entered into force (or, in the case of trademarks: had at least already been applied for). The European Commission assumes this is the case and argues, in particular, that the Trademark Directive even provides for the possibility of canceling trademarks whose use violates national and EU law outside the scope of trademark law (see Section 3 of the European Commission’s Q&A on the EmpCo Directive).

However, this argument fails to recognize that the subsequent cancellation due to the existence of absolute grounds for refusal of a trademark that has already been registered is, in principle, only possible if the relevant absolute ground for refusal already existed at the time of the trademark application; subsequent changes after the filing date, on the other hand, do not, in principle, permit trademark cancellation. On the other hand, it must be recognized that ownership of a trademark naturally does not give its owner the right to use the trademark in every conceivable manner, including in a manner that violates legal provisions.

Against this background, there is good reason to believe that, following the entry into force of the prohibitions under the EmpCo Directive, it will be impermissible to use protected signs in a manner that violates these provisions, even if such protected signs already existed prior to the entry into force of the legislative amendment (or, in the case of trademarks: were at least applied for). However, it will likely not be possible to remove trademarks applied for prior to this date from the register solely because their use has become impermissible following the entry into force of the amendments under the EmpCo Directive. Protected business names and corporate logos, on the other hand, could lapse if the corporate sign in question is no longer used in an authorized (i. e., legally compliant) manner, but only in a manner that violates the provisions of the EmpCo Directive or the new provisions incorporated into the German Unfair Competition Act (UWG) for its implementation.

V. What Are the Consequences of Violating the EmpCo Directive?

Violations of the provisions of the EmpCo Directive or the UWG in the version effective as of September 27, 2026, will primarily be pursued by consumer and competition associations as well as eligible competitors. In practice, this may result in particular in costly cease-and-desist letters and, if an out-of-court settlement is not reached, preliminary injunctions and injunctive relief actions.

This is particularly problematic when trademarks are printed on products or their packaging in a manner prohibited by the EmpCo Directive, as this risks rendering the products unsellable. Potential claims for damages and the risk of reputational damage must also be taken into account.

IV. Recommendations for Action and Outlook

The implementing regulations for the EmpCo Directive present companies with significant legal and practical challenges. There is not much time left until the new provisions of the UWG take effect on September 27, 2026. Companies should therefore ensure in a timely manner that, for example, products or product packaging, print advertisements, and websites no longer contain any content prohibited under the EmpCo Directive by this date at the latest. This also applies where statements prohibited under the Directive are contained in a protected sign.

It is to be expected that, once the new legal framework takes effect, consumer protection and competition associations in particular will strictly monitor compliance with the new regulations and consistently pursue violations – typically through costly cease-and-desist letters.

We would be happy to assist you in implementing the new UWG rules in a timely manner and to help you continue to communicate your commitment to sustainability in a legally compliant manner.

All ground handling organisations must, among other things:

• register with the competent supervisory authority in good time;
• review whether their documentation and record-keeping practices meet the new requirements;
• have a ground handling manual that addresses the current requirements in terms of both content and form;
• ensure that their own processes are carried out in accordance with the ground handling manual;
• review their management systems, including: safety management and operational procedures, compliance monitoring, training and ongoing instruction of ground handling personnel and maintenance programme for ground handling equipment;
• review and, where necessary, adapt the reporting system for safety-related occurrences;
• adapt the training and assessment programme for personnel;
• review responsibilities and associated qualifications;
• ensure comprehensive change management including risk assessment;
• integrate subcontractors into the safety management system in accordance with regulations and be able to demonstrate this.

If handlers operate at multiple airports, including cross-border activities, issues at one airport may prompt supervisory authorities to take at other airports as well.

What is changing in the licensing process?

The new regulations do not govern the selection of handlers. However, the new requirements will play a significant role in the future awarding of handling licences. The selecting body will review the extent to which applicants meet or are able to meet the new requirements during the application process. For all parties involved, this will also mean a noticeable increase in effort when preparing and reviewing documentation. In addition, the commencement of ground handling operations must be coordinated with the required notifications to the aviation authority.

Next Steps

The new rules are extensive and, in part, complex. All ground handling service providers should therefore ensure, in a structured manner, that they have the required notifications and systems in place in good time and are able to demonstrate their compliance in the prescribed manner.

Particular challenges exist at airports where the re-tendering of handling licences is imminent: the selecting bodies – and potentially also competitors – will be scrutinising closely whether the new regulations are being observed. We are happy to provide support, drawing on many years of legal experience.

Sources:

• Delegated Regulation (EU) 2025/20
• Delegated Regulation (EU) 2025/21
• Delegated Regulation (EU) 2025/22
• Implementing Regulation (EU) 2025/23
• Implementing Regulation (EU) 2025/24

The new requirements, which apply exclusively in the B2C sector – that is, wherever businesses interact with consumers – and are implemented through a revised version of the Unfair Competition Act (UWG), will take effect on September 27, 2026. As things stand, no transition period is planned, not even for products already on the market.

Anyone who engages in environmental advertising or intends to do so in the future and wishes to continue operating on the market in compliance with the law as of September 27, 2026, should familiarize themselves with the new rules now at the latest and, where necessary, take appropriate measures.

I. Scope of Application of the New UWG Rules

The amendment to the UWG introduces several categories of environmental business practices, each of which is subject to its own set of regulations.
Specifically, this applies, among other things, to:

• “general environmental claims” that, due to a lack of specification within the same medium, pose a particular risk of misleading consumers;
• “sustainability labels,” which in the future must be based on a certification system or be established by the government;
• “future environmental performance,” i. e., statements about environmental performance not yet achieved that are linked to a robust implementation plan;
• product-related claims regarding environmental or climate friendliness through “offsetting of greenhouse gas emissions,” which will be prohibited in the future.

As part of our HEUKING series on the aforementioned practices covered by the EmpCo Directive, Part 1 dealt with “general environmental claims” (available here), Part 2 with “sustainability labels” (available here), and Part 3 with advertising claims regarding “future environmental performance” (available here). This article now focuses specifically on the regulations governing advertising that claims environmental or climate friendliness through the offsetting of greenhouse gas emissions.

II. Advertising environmental or climate friendliness through greenhouse gas emissions offsetting

Increased consumer awareness of climate change and its causes has led many companies to attempt to reduce their greenhouse gas footprint and, naturally, to advertise this fact. As an alternative to the actual reduction of a company’s own greenhouse gas emissions – which is often difficult to achieve in practice – companies may consider implementing measures designed to offset their own greenhouse gas emissions elsewhere. For years now, a specialized market for such offset measures has been developing. Companies can “purchase” offset services from relevant providers, which may involve, for example, planting trees on land specifically acquired for this purpose.

However, such measures are often not very transparent and, upon closer inspection, turn out to be of little climate effectiveness. In the case of many projects marketed for the purpose of greenhouse gas offsetting, it is particularly doubtful whether they actually lead to an additional net reduction in greenhouse gases – such as projects intended to promote the use of renewable energy (which, however, is already the most economical form of energy in most countries, making its increased use likely anyway) or projects intended to reduce deforestation by placing forest areas under protection (which is based on assumptions that are difficult to objectively verify).

Another problem with advertising the alleged climate-friendliness of products is that it often does not make it sufficiently clear to the consumer whether a product advertised in this way caused fewer greenhouse gas emissions during its production (or whether a service advertised in this way has caused fewer greenhouse gas emissions at the time of its provision) or whether these emissions were merely offset by the provider or a third party commissioned by the provider through other measures outside the manufacturing or provision process.

In particular, the latter aspect prompted the EU legislator to include particularly restrictive provisions in the EmpCo Directive regarding advertising that claims a product’s environmental or climate-friendly nature is achieved through the offsetting of greenhouse gas emissions. According to Recital 12 of the Directive, such advertising is to be “prohibited in all circumstances,” which the EU legislator even considers to be “particularly important.”

1. New Provisions in the UWG

The EmpCo Directive provides that environmental advertising of the aforementioned type is prohibited by including it in the “blacklist” of commercial practices that are always prohibited vis-à-vis consumers. The German legislature has therefore, in transposing the EmpCo Directive into German law, decided to add a corresponding provision to the “blacklist” (Annex to Section 3(3) of the UWG), pursuant to the new subparagraph 4.c) of which it will henceforth always be impermissible to advertise to consumers with

“a statement which is based on the offsetting of greenhouse gas emissions and according to which a product has a neutral, reduced, or positive impact on the environment with regard to greenhouse gas emissions.”

2. Examples of affected advertising claims

Recital 12 of the EmpCo Directive lists various examples of advertising claims that will be prohibited in the future, which suggest that the advertised product has a neutral, reduced, or even positive environmental impact in terms of greenhouse gas emissions, namely “climate neutral,” “CO₂ neutral certified,” “carbon positive,” “climate net zero”, “climate compensated,” “reduced climate impact,” or “limited CO₂ footprint.” This list is merely illustrative and not exhaustive; all formulations that, in the understanding of consumers, have a comparable meaning are, of course, equally covered by the prohibition.

According to the wording of the law, it is not necessary for the advertising to also mention the greenhouse gas offset measures for the claim to be prohibited; rather, it is sufficient that the advertised environmental or climate-friendly nature of the product is actually based on such offset measures (and not, for example, on the avoidance of greenhouse gas emissions during the production of the goods or the provision of the service). However, given the generally presumed inadmissibility of using general environmental claims (see our ESG Update 1/2026 on this topic), the use of advertising claims such as “climate neutral” or similar will in the future impose an indirect obligation on the advertising company to provide justification, meaning that such claims cannot be used in isolation in practice anyway. As a general rule, a more detailed justification will need to be provided alongside an advertising claim regarding environmental or climate friendliness. If the advertised environmental or climate friendliness of the product is based (as is so often the case) on greenhouse gas offset measures, it becomes evident that the prerequisites of subparagraph 4.c) of the “blacklist” are met and the advertising is therefore inadmissible.

3. Product Advertising vs. Corporate Advertising

Both the aforementioned Recital No. 12 of the EmpCo Directive and the wording of the new subparagraph 4.c) of the Annex to Section 3(3) of the UWG cited above distinguish between product advertising on the one hand and (non-product-related) image advertising of the advertising company on the other. Product advertising that suggests reduced environmental impact will henceforth always be prohibited vis-à-vis consumers if the reduced environmental impact is achieved through greenhouse gas offset measures. In contrast, it remains possible to promote the advertising company’s commitment to environmental protection in a manner not related to a specific product, including with regard to greenhouse gas offset measures it has implemented. Of course, this representation must meet the general requirements for advertising claims, i. e., it must not be misleading in particular. However, the legislature explicitly does not intend to impose a general ban on image advertising regarding offsetting measures.

4. Tightening of the existing legal framework

Even under the previous legal framework, product advertising that touted environmental or climate-friendly credentials through greenhouse gas offsets was not without its problems. By way of example, reference is made to the decision of the Federal Court of Justice dated June 27, 2024 (Case No.: I ZR 98/23), which concerned the admissibility under competition law of advertising a food product as allegedly “climate neutral.” In fact, the production of the food product (naturally) resulted in greenhouse gas emissions; however, the advertising company had supported climate protection projects through a relevant service provider (namely ClimatePartner), which led to the mathematical offsetting of the greenhouse gas emissions generated during the production of the food product. The Federal Court of Justice (BGH) ruled that advertising the food product as “climate neutral” was misleading, despite the use of the ClimatePartner logo in the advertisement. In the field of environmental advertising (as in the field of health advertising), particularly strict requirements must be imposed on the accuracy, unambiguity, and clarity of advertising claims (the so-called “principle of strictness”), because the risk of misleading consumers is particularly high in these areas and, accordingly, there is an increased need for consumer information. Since the consumer targeted by the advertisement could interpret the promotion of the product as “climate neutral” to mean that the production process itself already takes place without greenhouse gas emissions (which did not correspond to the facts), the consumer is subject to a misconception triggered by the advertisement and is misled in a manner relevant to competition. The ClimatePartner logo used in the advertisement does not rule out this misconception because it was not explained exactly what role ClimatePartner plays in relation to the advertised product; thus, it was conceivable to the consumer, for example, that this was a partner company commissioned by the product manufacturer to install filtration systems in production, assist in establishing climate-friendly manufacturing processes, or supply climate-optimized raw materials. Nor did the Federal Court of Justice (BGH) consider the fact that consumers can learn more about the offset measures offered by ClimatePartner on its website to be sufficient to avoid the risk of misleading consumers, since such information should have already been provided in the product manufacturer’s own advertising.

Even under current law, advertising that highlights a product’s environmental or climate-friendly nature – achieved through greenhouse gas offset measures – is therefore only permissible if the consumer is clearly informed in the advertisement itself that the touted environmental or climate-friendly nature is based on such offset measures and what those measures specifically are. This is the reason why many such advertising campaigns fail to meet the legal requirements even today. Furthermore, it must naturally be the case that the offsetting measure actually reduces greenhouse gases to an extent that makes the advertising claim appear accurate; this, too, represents a significant hurdle.

The EmpCo Directive and its implementation in the German Unfair Competition Act (UWG) further tighten this already restrictive legal framework, rendering such advertising claims in consumer-directed product advertising absolutely impermissible in the future, regardless of whether the claim is likely to mislead or whether such misleading effects could be avoided through explanatory notes.

III. What are the consequences of violating the EmpCo?

Violations of the provisions of the EmpCo Directive or the UWG in its version effective as of September 27, 2026, will primarily be pursued by consumer and competition associations as well as eligible competitors. In practice, this entails the risk of costly cease-and-desist letters and, if an out-of-court settlement is not reached, preliminary injunctions and injunctive relief actions.

This is particularly problematic when the prohibited advertising is printed on products or their packaging, as this risks rendering them unsellable. Potential claims for damages and the risk of reputational damage must also be taken into account.

IV. Recommendations for Action and Outlook

The implementing regulations for the EmpCo Directive present companies with significant legal and practical challenges. There is not much time left before the new provisions of the UWG take effect on September 27, 2026. Companies should therefore ensure in a timely manner that, for example, products or product packaging, print advertisements, and websites no longer contain any impermissible claims regarding the environmental or climate-friendly nature of products – claims that are intended to be substantiated by greenhouse gas offset measures – by this date at the latest.

It is to be expected that, once the new legal framework takes effect, consumer protection and competition associations in particular will strictly monitor compliance with the new regulations and consistently pursue violations – typically through costly cease-and-desist letters.

However, the legal change does not affect (non-product-related) image advertising by companies promoting their commitment to climate protection, which may also consist of supporting greenhouse gas offset measures. This type of advertising will not be prohibited per se in the future. However, as has been the case up to now, the strict requirements regarding the accuracy, unambiguity, and clarity of environmental advertising claims must still be observed to prevent such advertising from being prohibited as misleading.

We are happy to assist you in implementing the new UWG rules in a timely manner and will continue to help you communicate your commitment to sustainability in a legally compliant manner.

I. Areas of AI Application

Artificial intelligence is increasingly being used in human resources throughout the entire employee lifecycle, encompassing both strategic and operational HR processes. The spectrum ranges from supportive tools to systems that prepare or significantly influence decisions.

Recruiting is a key area of focus. Here, AI systems are used in particular for the automated pre-screening of applications, for matching candidate profiles with job requirements, and for communicating with applicants, for example via chatbots. The analysis of resumes and the structured evaluation of interviews are also increasingly being carried out with AI support.

Furthermore, AI is applied in onboarding and employee development, for example through the creation of individualized onboarding plans or personalized learning and training opportunities. In the areas of performance management and employee retention, AI systems are used to evaluate performance data, identify development potential, or predict turnover risks. The employer’s managerial authority is also likely to be increasingly supported by AI in the future – whether in the allocation of work or the scheduling of shifts or departmental plans.

Finally, AI is also playing a growing role in HR administration, for example in the automated processing of employee inquiries, the creation of documents, or the analysis of HR data.

II. Requirements of the AI Regulation

1. High-Risk AI

The AI Regulation follows a risk-based regulatory approach. The scope of the legal requirements is determined by the classification of an AI system into one of the risk categories provided for in the Regulation. While systems with low or minimal risk are subject only to limited transparency obligations, the Regulation imposes comprehensive requirements on high-risk AI, particularly with regard to risk management, data quality, documentation, and human oversight. Systems with unacceptable risk, on the other hand, are generally prohibited.

For the HR sector, it is of central importance that numerous typical use cases are classified as high-risk AI. Pursuant to Article 6(2) in conjunction with Annex III of the AI Regulation, this specifically covers AI systems used in connection with employment, human resources management, and access to employment. This primarily includes applications in recruitment, such as for the automated pre-selection and evaluation of applicants, as well as systems that prepare or influence decisions regarding hiring, promotion, or termination of employment. The same applies to AI-supported systems for performance evaluation or for assigning tasks based on individual behavioral or performance data. In these areas, there is a particular risk to the rights and freedoms of data subjects, which is why the regulator provides for classification as high-risk AI.

In contrast, not all AI applications used in HR must necessarily be classified as high-risk AI. In particular, support systems in HR administration or in standardized, purely technical processing steps may fall below the high-risk threshold, provided they do not independently evaluate or make decisions regarding individuals or significantly influence such evaluations or decisions. This applies, for example, to simple automations in document creation or AI-supported tools for internal process optimization that do not involve personal data.

The exemption provided for in Article 6(3) of the AI Regulation is also of particular practical relevance. According to this provision, AI systems that generally fall within the application areas listed in Annex III are, in exceptional cases, not considered high-risk AI if they do not pose a significant risk to the health, safety, or fundamental rights of natural persons and, in particular, do not substantially influence decision-making. This may be the case, for example, with AI systems that merely perform a narrowly limited, supportive function, such as the purely formal structuring or sorting of application documents without evaluating their content – but not if the use of AI results in applicants being excluded from consideration from the outset. Systems that merely provide preparatory information without conducting an independent evaluation or significantly influencing the decision may also fall under this exception.

However, distinguishing between cases is challenging and requires a careful analysis of the specific function of the respective AI system within the HR process. A key factor here is whether the system merely supports the decision regarding an individual or whether it effectively dictates or significantly pre-structures it. Particularly in recruiting and in performance- and behavior-related evaluations, the threshold for high-risk AI is therefore regularly crossed.

2. Obligations for Operators of High-Risk AI

Companies that use AI systems in the HR sector are generally classified as operators within the meaning of the AI Regulation. Article 26 of the AI Regulation attaches a separate, comprehensive system of obligations to this operator status.

Central to this is the obligation to implement appropriate technical and organizational measures to ensure that the high-risk AI system is used in accordance with its intended purpose and the specifications in the operating instructions. In addition, the use of the system must be subject to effective human oversight. This oversight must be carried out by sufficiently qualified and trained individuals who are capable of understanding the system’s functioning and results and intervening to correct them if necessary.

Another key focus is on ensuring data quality. To the extent that the input data is subject to the operator’s control, it must be ensured that it is suitable, relevant, and sufficiently representative for the intended purpose. This aspect is particularly important in the HR context, such as in applicant selection or performance evaluation, as erroneous or distorted data can directly lead to discriminatory or factually inaccurate results.

In addition, there are ongoing monitoring and response obligations during the operation of the AI system. Operators must monitor the system’s functioning and are obligated to immediately report any risks, malfunctions, or serious incidents to the provider and the competent authorities and, if necessary, suspend use of the system. This is accompanied by documentation obligations, in particular the obligation to retain automatically generated logs for a reasonable period of time, typically at least six months.

Finally, transparency obligations toward employees are of particular relevance to the HR sector. Employers are required to inform employee representatives and the affected employees about the use of a high-risk AI system before its introduction or use in the workplace. Furthermore, affected individuals must be informed if an AI system makes decisions about them or significantly supports such decisions.

III. Data Protection Aspects

The use of AI systems in the HR sector regularly involves the processing of personal data and is therefore subject to the provisions of the GDPR with virtually no exceptions. In this regard, the AI Regulation does not create a separate legal framework for data processing but rather supplements existing data protection requirements. Companies must therefore ensure that there is a sound legal basis for every form of AI use in HR and that the principles of purpose limitation and data minimization are upheld.

Particular challenges arise as early as the training and implementation phase of AI systems. Existing personnel data is often used for training purposes without having been originally collected or processed for this purpose, which raises questions regarding a change of purpose and permissibility under Article 6 of the GDPR. Compliance with transparency obligations toward applicants and employees can also prove difficult in practice, particularly with complex or opaque (“black box”) systems.

Article 22 of the GDPR is also of central importance, as it grants data subjects the right not to be subject solely to an automated decision that produces legal effects or similarly significantly affects them. Particularly in recruiting, in performance-based evaluations, or in connection with the employer’s managerial authority, it must therefore be ensured that AI systems, at most, prepare decisions, but that the final decision is made by a natural person. It should be noted that even AI recommendations that effectively influence outcomes can pose problems under data protection law.

In addition, further data protection requirements must be observed, in particular the conduct of a data protection impact assessment for high-risk applications, the safeguarding of data subjects’ rights, and – when using cloud-based AI services – compliance with the requirements for transfers to third countries.

IV. Recommendations for Companies

Companies should first create a structured AI inventory in the HR sector and systematically record all AI applications currently in use and those planned. On this basis, a legal classification under the AI Regulation must be performed for each system, particularly with regard to a possible classification as high-risk AI. This inventory forms the basis for all further compliance measures and should be updated regularly.

Building on this, it is recommended to implement clear human-in-the-loop structures in HR. Specifically, this means that AI systems – particularly in recruiting or performance evaluations – must not be allowed to make autonomous decisions, but must always be subject to review and override by qualified HR staff. This requires not only organizational guidelines but also appropriate training for the relevant employees to critically assess the AI’s results.

Another key step is the early involvement of the works council and the creation of transparent regulations. The introduction of AI systems in human resources is almost always subject to the works council’s right of co-determination. Ideally, therefore, a framework works agreement on the use of AI should be concluded. In parallel, an internal AI policy should be established that specifically regulates the permissible use of AI in HR, for example regarding the handling of applicant data or the use of external AI tools.

Finally, companies should make targeted investments in data quality and testing. Before productive use, it must be verified whether the data used is representative and free of systematic biases. Additionally, AI systems should be regularly tested using specific HR use cases, such as through spot checks in the recruiting process, to identify and correct discriminatory or factually incorrect results at an early stage.

V. Conclusion and Outlook

The use of AI in HR offers significant potential for efficiency and optimization, but is subject to complex legal requirements. In particular, the classification of many HR applications as high-risk AI leads to extensive obligations under the AI Regulation, which in practice are closely intertwined with the provisions of the GDPR. Companies are therefore required to systematically document the use of AI in human resources at an early stage and ensure legal compliance.

With regard to the implementation of the AI Regulation, current regulatory developments are also gaining further momentum. As part of the so-called “AI Omnibus,” discussions at the European level are focusing in particular on adjustments and clarifications regarding implementation deadlines, which is also significant for high-risk AI systems in HR. Regardless of potential exemptions or delays, however, it is already clear that companies must establish the necessary organizational and technical prerequisites to meet future requirements. The legally compliant use of AI is thus increasingly becoming an ongoing compliance task – not only in the HR sector.

This article was created in collaboration with our student employee Emily Bernklau.

The focus here is less on the specific sample and more on a fundamental question of copyright law: When is creative reference permissible – and when does it cross the line into use requiring consent?

The Core Issue: Creative Reference and Copyright Protection

Sampling, remixes, memes, and mashups make it clear how much artistic and communicative creation thrives on engagement with existing works. At the same time, copyright law grants authors and holders of related rights comprehensive exclusive exploitation rights. Any recognizable incorporation of protected elements therefore generally constitutes an infringement.

It would be unrealistic to limit modern forms of art and communication solely to completely original material. Especially in digital culture, creative value often lies in transformation, a shift in context, or deliberate recognition. This is where the concept of pastiche comes in. It describes uses that do not aim merely to adopt third-party content, but rather to engage in a recognizable creative dialogue with an existing work.

A pastiche can take various forms: it can appear to be inspired by or appreciative of the original, such as a stylistic homage, but – unlike caricature or parody – it need not be humorous or critical. The decisive factor is that the original work does not merely serve as a source of material, but as a point of reference for a distinct creative statement. Typical examples include altered film scenes in memes or texts that incorporate characteristic motifs of well-known authors and recontextualize them. The original remains recognizable but is placed in a new context.

Conversely, uses in which third-party works are merely appropriated to replace one’s own creative output or to capitalize on the original’s fame are not covered. The line is not drawn based on quantitative criteria such as length or scope, but is determined by whether the new work appears as an independent creative engagement.

How did the decision come about?

The legal dispute between Kraftwerk and Moses Pelham began in the late 1990s with a lawsuit filed in the Hamburg Regional Court. In 1997, Pelham had taken a roughly two-second rhythm sample from the Kraftwerk track “Metall auf Metall” for Sabrina Setlur’s song “Nur mir,” slightly altered it, and used it as a continuous loop. Kraftwerk viewed this as an infringement of their neighboring rights in the sound recording.

In the years that followed, the case went through the courts several times. After the European Court of Justice (ECJ) clarified in 2019 that the then-existing German regulation on “free use” was contrary to EU law, the Federal Court of Justice (BGH) ruled in 2020 that the sampling constituted an infringement of rights, at least for the period from 2002 to 2021.

The case took a new turn with the introduction of Section 51a of the German Copyright Act (UrhG) in 2021, which for the first time explicitly provides for an exception for caricature, parody, and pastiche. Since the legal dispute was still pending, it now had to be examined whether the sampling could be permissible under the new legal situation. The Higher Regional Court of Hamburg affirmed this and classified the use as a pastiche. The Federal Court of Justice (BGH) subsequently stayed the proceedings and referred the question of how the EU-law concept of pastiche is to be interpreted to the European Court of Justice (ECJ).

The ECJ’s Decision

The ECJ clarified that the concept of pastiche must be interpreted autonomously under EU law and should not be understood narrowly. It encompasses creations that evoke existing works but exhibit perceptible differences and use protected elements to engage in a recognizable artistic or creative dialogue with the original. This dialogue may consist, for example, of a stylistic reference, an homage, or even a critical engagement; a humorous intent is not required.

Of particular practical significance is that, for a use “for the purposes of a pastiche,” the user’s subjective intent is irrelevant. It is sufficient that the pastiche character is objectively recognizable to an audience familiar with the referenced work. The Court thus focuses on the effect of the new work and refrains from examining internal motives.

Significance for the case at hand and beyond

With this interpretation, the ECJ significantly lowers the thresholds for applying the pastiche exception. Sampling may also be permissible in principle, provided it is part of a recognizable creative engagement. However, determining where the line into impermissible appropriation is crossed in individual cases remains subject to the discretion of national courts.

For the Kraftwerk v. Pelham case, this means that the Federal Court of Justice must now conclusively determine whether the specific sampling in question qualifies as a pastiche since the entry into force of Section 51a of the German Copyright Act (UrhG). Regardless of the outcome, however, this is a decision of considerable significance for artistic practice and digital culture.

I. Background: Digital Sovereignty from a Corporate Perspective

From a corporate perspective, digital sovereignty describes the ability to operate and control digital infrastructures, data, and applications independently, securely, and in accordance with the applicable legal framework. At its core, the goal is to limit dependencies on individual providers, non-European legal systems, and opaque technology stacks, while maintaining actual control and access sovereignty.

The topic is particularly relevant for companies with extensive cloud usage, international data processing, or AI-supported business models, as well as for operators of critical infrastructure and companies in highly regulated industries (such as the financial sector, healthcare, or energy). Export-oriented companies and corporations with global IT structures are also increasingly confronted with requirements arising from differing legal systems and access regimes, such as the tension between European data protection law and non-European access powers.

The current situation is characterized by increasing regulatory complexity coupled with ongoing legal uncertainties (as we reported in Data Protection Update No. 237). Instruments such as the EU-US Data Privacy Framework, standard contractual clauses, or sector-specific security requirements address individual aspects but do not offer a definitive solution to the question of comprehensive digital sovereignty. Companies therefore face the challenge of translating fragmented requirements into a consistent governance and risk management framework, even though uniform assessment criteria have not yet been established for this purpose

II. European Standards: Cloud Sovereignty Framework

At the European level, the European Commission has developed the Cloud Sovereignty Framework, a structured reference framework for assessing digital sovereignty in the cloud context. The goal is to supplement existing security requirements with specific sovereignty criteria, thereby providing, for the first time, a systematic assessment model for cloud services. The framework builds on existing initiatives and regulatory regimes such as NIS-2, DORA, and Gaia-X, integrating them into a unified assessment model.

At the core of the approach are eight dimensions of sovereignty that address different levels of corporate control, including, in particular, legal and jurisdictional integration, data and AI sovereignty, operational independence, as well as supply chain and technology sovereignty. As the overview on page 3 of the framework shows, this is based on a comprehensive understanding of sovereignty that goes well beyond classic data protection and security aspects and, in particular, also takes dependencies in the value chain into account.

Methodologically, the framework combines minimum requirements with a differentiated evaluation system: so-called “Sovereignty Effectiveness Assurance Levels” (SEAL) define minimum standards that a cloud provider must meet to be considered at all. In addition, a “Sovereignty Score” is calculated, which enables a comparative ranking of different providers and serves as an award criterion, particularly in procurement processes.

Even though the Cloud Sovereignty Framework does not yet constitute a directly binding legal framework, there are already signs that it will gain significance as a de facto standard for public procurement and, in the future, for regulated industries as well. For companies, this creates a benchmark against which their own cloud and IT strategies must increasingly be measured.

This is also evident in the European Commission’s current procurement practices. As part of a large-scale procurement process (up to 180 million euros over six years), several European providers – including StackIT, Scaleway, OVHcloud consortia, and Proximus with partners – were selected to provide sovereign cloud services. The selection was based on the Cloud Sovereignty Framework and was deliberately aimed at diversification and limiting non-European influence.

III. Additional Assessment Approaches for Digital Sovereignty

In addition to the Cloud Sovereignty Framework, other models are currently emerging that seek to make digital sovereignty measurable and comparable. These approaches share the common goal of translating a concept that has thus far been heavily politicized into concrete, verifiable criteria, but differ in methodology, scope, and level of detail.

1. ES³ Model by Schwarz Digits

In mid-April 2026, Schwarz Digits introduced the “European Sovereign Stack Standard” (ES³), a practice-oriented maturity model for assessing the digital sovereignty of IT services. The starting point is the observation that, to date, there has been a lack of uniform and actionable criteria to reliably assess sovereignty in a corporate context and make providers comparable.

The model is based on a multi-level maturity approach (“Sovereignty Maturity Levels”), which classifies IT services into four levels – ranging from basic requirements (“Basic”) to fully sovereign, future-proof solutions (“Future-Proof”). The assessment is based on a comprehensive catalog of criteria with over 100 individual requirements that reflect various dimensions of digital sovereignty.

In terms of content, the ES³ model is closely aligned with the European Cloud Sovereignty Framework, but expands upon it with additional distinctions and greater operationalization. Of particular note is the independent consideration of artificial intelligence as a separate dimension of sovereignty, whereas in the European model it is classified merely as part of data sovereignty.

The practical value of the ES³ model lies primarily in its practical applicability: In the future, cloud and IT services – for example, within the Stackit Cloud environment – are to be classified using the model to provide companies with a robust basis for procurement decisions. As a result, the model is evolving into a potential market standard that goes beyond purely regulatory requirements and could gain particular significance for vendor evaluation in the private sector.

Nevertheless, it must be noted that this is a business-driven initiative whose acceptance will depend largely on the extent to which the model establishes itself as a cross-industry reference framework and can be reconciled with existing regulatory requirements.

2. Criteria Catalog of the Center for Digital Sovereignty (ZenDiS)

The Center for Digital Sovereignty in Public Administration (ZenDiS) takes a more organization-focused approach with its set of criteria, which evaluates digital sovereignty not only at the level of individual services but also holistically at the organizational and IT levels. The starting point is strategic goals such as the ability to switch providers, flexibility in design, and influence over providers, which are translated into concrete evaluation criteria and assigned to four categories: organization, applications, data, and operations.

This approach makes it clear that digital sovereignty depends significantly on governance, procurement, and technical flexibility and cannot be reduced to individual technologies. This is supplemented by a risk-based application of the criteria, which is guided by factors such as data criticality and dependencies, thereby enabling a flexible assessment

IV. Recommendations for Action for Companies

Against this backdrop, companies should not view digital sovereignty merely as an abstract guiding principle, but rather translate it into concrete measures and systematically integrate it into their IT, procurement, and compliance processes. The following starting points are particularly relevant:

• Carefully review cloud and IT contracts for access provisions and jurisdiction: Contracts with cloud and SaaS providers should be systematically reviewed to determine whether non-European access provisions exist (e. g., based on the U.S. CLOUD Act). In particular, it must be clarified where data is processed, who has access, and which technical and contractual safeguards (e. g., encryption, customer-managed keys, audit rights) are actually in place.
• Practically secure exit strategies and provider changes: Companies should not merely rely on “portability” in the abstract, but rather define and test concrete exit scenarios. This includes standardized data formats, documented migration processes, and contractually guaranteed support services from the provider in the event of a switch or a return to in-house operations.
• Make dependencies along the IT and supply chain transparent: It is advisable to conduct a structured analysis of one’s own IT landscape to systematically identify dependencies on individual providers, proprietary technologies, or non-European supply chains. In addition to software, this includes underlying infrastructure, support services, and third-party components in use.
• Integrate sovereignty criteria into procurement and governance processes: When selecting new IT and cloud solutions, criteria such as data location, provider structure, openness of interfaces, or exit capability should be mandatorily integrated into tenders and decision-making processes. In addition, it is recommended to embed corresponding requirements in internal guidelines and to assign clear responsibilities within the IT and compliance departments.

V. Outlook and Conclusion

Digital sovereignty is increasingly evolving from a political guiding principle into a concrete benchmark for IT strategies, procurement decisions, and compliance structures. With initiatives at the European and national levels, as well as market-based evaluation models, the first outlines of uniform standards are emerging, even if final harmonization has yet to be achieved. Companies are therefore advised to integrate relevant requirements into their governance and IT structures at an early stage to minimize regulatory risks and secure strategic flexibility.

Against this backdrop, the topic will also be the focus of our event “Digital Sovereignty – How Companies Strategically Use Data, Artificial Intelligence, and the Cloud” in Hamburg on April 21, 2026, where legal, technical, and strategic perspectives will be examined from a practical standpoint.

This article was created in collaboration with our student employee Emily Bernklau.

The decision is significant in practice because it separates the data protection right of access under Article 15 GDPR from civil law claims enforcement models. The BGH does not treat the right of access as a generally available instrument for preparing pecuniary claims but ties its assertion closely to the actual ownership of the claim and the respective authority to conduct the proceedings. The judgment thus sets important limits, particularly for legal tech models, debt collection constellations, and mass claims in the insurance sector.

Facts

The claimant is a stock corporation based in Switzerland whose business model consists of having consumers assign to it, by way of claims purchases, claims against their contractual counterparties so that it can assert them in its own name. In the present dispute, it asserted claims belonging to six policyholders who held private health insurance and private long-term care insurance with the defendant insurer. In 2021, the claimant entered into agreements with those policyholders under which reimbursement claims and damages claims arising from allegedly excessive premiums were to be assigned. At the same time, the agreements provided for authorisations to assert rights of access and data portability claims.

By way of a staged action, the claimant sought, for various years in the period from 2010 to 2018, information on premium income, active tariffs, and premium increases in order, on that basis, to obtain findings that certain premium adjustments were ineffective and to quantify repayment claims. The Regional Court dismissed part of the claims as inadmissible and another part as unfounded. The Higher Regional Court of Hamm dismissed the appeal. In the appeal on points of law, the claimant pursued its claims only insofar as they concerned information under Article 15 GDPR.

The Core Issues of the Proceedings

At its core, the BGH had to decide three questions. First, whether the policyholders had effectively assigned their rights under Article 15 GDPR to the claimant at all. Second, whether the data protection right of access had in any event passed to the claimant, by analogy to section 401 BGB, as an ancillary right together with the assigned reimbursement and damages claims. Third, whether the claimant could at least assert the rights of access in its own name by way of an authorised procedural standing arrangement.

Key Findings of the BGH

No transfer based on the agreed assignment

The BGH first denied, already at the level of contractual interpretation, that rights of access under Article 15 GDPR had passed to the claimant. According to the wording of the assignment agreements, only “reimbursement claims and damages claims” were covered. By contrast, “rights of access and data portability claims” were not assigned but were merely mentioned separately for the purpose of their assertion. The Senate therefore made clear that the agreements could not be construed as showing that the policyholders had intended to transfer their rights under Article 15 GDPR to the claimant as well.

Article 15 GDPR is not a mere ancillary right within the meaning of section 401 BGB

Of practical relevance is the Senate’s further finding that the right of access under Article 15 GDPR also does not pass, by analogy to section 401 BGB, together with the assigned principal claims. According to existing case law, ancillary rights such as rights to information or to an account may pass together with a claim where they serve the enforcement of the principal claim. However, that is precisely not how the BGH understands Article 15 GDPR. According to the judgment, the right was not created to prepare or quantify pecuniary claims, but rather to enable the data subject to become aware of the processing of his or her data and to verify the lawfulness of that processing. In this way, the Senate expressly distinguishes the data protection right of access from classic accessory ancillary rights.

No ruling on the general transferability of Article 15 GDPR

It is equally noteworthy what the BGH did not decide. The Senate expressly stated that the question raised by the appellate court, namely whether claims under Article 15 GDPR are generally transferable, did not arise in the present case. The reason is that, under the specific agreement, no assignment had already occurred. The frequently debated fundamental question of the general transferability of the right of access therefore remains open.

Authorised procedural standing fails because of the specific contractual structure

Nor could the claimant assert the right of access in its own name in the alternative. The BGH classified the issue of authorised procedural standing as a procedural requirement and examined the claimant’s authority to conduct the proceedings independently under German procedural law. In the end, however, the claimant failed because the specific agreement did not contain a sufficiently clear authorisation to assert third-party rights of access in its own name. According to the wording and structure of the contractual clauses, the auxiliary authorisation for the “enforcement of the above-mentioned claims in one’s own name” related only to reimbursement and damages claims, but not to rights of access and data portability claims. In addition, in the Senate’s view, it remained unclear when the scenario envisaged as “purely auxiliary” was supposed to arise at all. To that extent, the action was already inadmissible.

Implications for Practice

The decision is important for companies, first, because it places limits on claims purchase and debt collection models in the data protection context. The BGH prevents Article 15 GDPR from readily becoming an annex-like information-gathering instrument for third parties who have purchased pecuniary claims. In future, controllers will be able to argue, with good reason, that the assignment of repayment or damages claims does not automatically entail an independent standing to assert Article 15 GDPR.

The decision is equally important for the doctrinal classification of the right of access. The BGH does not understand Article 15 GDPR merely in functional terms as a preliminary step in the enforcement of other claims but instead maintains the autonomous data protection purpose of this transparency and control right. From a corporate perspective, this is ambivalent. On the one hand, the judgment limits the usability of Article 15 GDPR in claims purchase models. On the other hand, it also reinforces the autonomous character of the right of access as a data subject right. Companies should therefore not misconstrue the decision as meaning that economically motivated access requests are generally excluded. The Senate rules only on ownership of the claim and authority to conduct proceedings in the specific third-party model before it.

The judgment is particularly relevant for the insurance industry and other sectors characterised by standardised mass business. It concerns constellations in which third parties attempt to combine data protection rights of access with civil law repayment or damages models to prepare mass proceedings more efficiently. In this respect, the BGH provides procedural and substantive legal clarity in favour of controllers, at least where the specific contractual structure does not provide a reliable basis for a transfer of the right or for procedural standing.

What Companies Should Do Now

1. Carefully review standing and the legal basis of the claim

Where companies receive access requests from legal tech providers, debt collection service providers, or claims purchasers, they should in future examine more closely on which legal position the request is based. A distinction must be drawn between the sender’s own claim, a mere authorisation to act in the name of the data subject, and an alleged assertion of a third party’s right in the sender’s own name. The judgment shows that these distinctions may be decisive in the proceedings.

2. Assess contractual structure and authority not only formally, but systematically

The BGH based its decision to a significant extent on the wording and systematic structure of the contractual clauses used. Companies should therefore not stop at labels when reviewing assignment agreements and powers of attorney submitted to them but should carefully analyse which claims are actually covered and how the individual clauses relate to one another.

3. Do not overextend the judgment

The decision does not mean that Article 15 GDPR may in future be asserted only personally and never with the assistance of third parties. The BGH expressly left open the general transferability of the right of access. Nor did it decide that procedural standing is generally excluded in data protection law. Companies should therefore apply the judgment specifically to constellations involving comparable contractual arrangements and comparable claims purchase models.

Conclusion

With VI ZR 430/24, the BGH places clear limits on attempts to reinterpret data protection rights of access, via claims purchase models, as economically exploitable ancillary rights. The Senate clearly separates Article 15 GDPR from the assigned reimbursement and damages claims and rejects a transfer by analogy to section 401 BGB. At the same time, the decision shows that even an authorised procedural standing arrangement is not established merely by broadly worded standard clauses but requires a precise and sufficiently robust legal basis for authorisation. For companies, the judgment is therefore an important signal. Article 15 GDPR remains a strong data subject right, but it cannot readily be transformed into a general instrument of commercial claims enforcement.

As part of our HEUKING series on the changes introduced by the EmpCo Directive, Part 1 addressed general environmental claims and Part 2 addressed future requirements for sustainability labels. This article now focuses on the regulations regarding claims about future environmental performance.

I. Subject Matter and Background of the Regulation

Environmental claims, particularly climate-related claims, increasingly refer to future performance in the form of a transition to CO2 or climate neutrality or a similar goal by a specific date. Through such claims, businesses create the impression that consumers contribute to a low-carbon economy by purchasing their products. Typical examples include statements such as “We will be climate-neutral by 2030” or “Our company aims to be net-zero by 2035.” Since these promises can have a significant influence on consumers’ purchasing decisions, European lawmakers see a particular need for regulation.

To this end, the EmpCo Directive inserts a new subparagraph (d) into Article 6(2) of the Unfair Commercial Practices Directive (UCP Directive). Accordingly, making an environmental claim regarding future environmental performance without meeting certain conditions is prohibited as a misleading commercial practice following a case-by-case assessment.

II. The Requirements in Detail

Under the new rules, a statement regarding future environmental performance is permissible only if it is supported by clear, objective, publicly available, and verifiable commitments set out in a detailed and realistic implementation plan. Specifically, the following conditions must be cumulatively met:

1. Clear, objective, and verifiable commitments and targets

The commitments and targets underlying the environmental claim must be clearly formulated, objectively verifiable, and publicly accessible. Vague declarations of intent without concrete content do not meet these requirements. The commitments must include measurable and time-bound targets. This means that both the targeted reduction goals and the timeframes within which these goals are to be achieved must be specifically stated.

2. Detailed and realistic implementation plan

The commitments and targets must be included in a detailed and realistic implementation plan that sets out how the targets are to be achieved. The implementation plan must also include other relevant elements necessary to support its implementation, such as, in particular, the allocation of resources. According to the recitals of the EmpCo Directive, the implementation plan should, in accordance with Union law, include, where applicable, all relevant aspects necessary for fulfilling the obligations, such as financial resources and technological developments.

Consequently, the measures and milestones outlined must be genuinely suitable and feasible – mere declarations of intent without substantial backing are insufficient. In practice, this means that when making statements about future environmental performance, companies must present a robust and transparent plan that clearly indicates the specific means by which the set goals are to be achieved.

The EmpCo Directive does not require that the implementation plan be presented on the same medium as the environmental statement itself. In the opinion of the European Commission, it is sufficient if the statement directs consumers to where the information can be accessed – for example, via a QR code that links to the implementation plan on the company’s website.

3. Regular review by an independent external expert

The implementation plan and progress toward achieving the targets must be regularly reviewed by an independent external expert. According to the recitals of the EmpCo Directive, this expert must be independent of the business operator and must not be subject to conflicts of interest. Additionally, they must possess experience and expertise in environmental matters.

In its Q&A on the Directive, the European Commission has clarified that the Directive does not specify whether the expert must be a public body or a private entity. In practice, therefore, private auditors or consulting firms may also assume this role. The key requirement is that the expert be capable of assessing the business operator’s progress regarding obligations and targets in a credible, objective, and regular manner. The Directive does not prescribe a specific audit methodology.

Regarding the frequency of reviews, the Directive merely uses the term “regularly” without specifying a concrete time interval. In the Commission’s view, best practices suggest annual or biennial reviews, although additional reviews may be warranted if significant changes occur.

4. Publication of Results

The results of the regular reviews conducted by the external expert must be made available to consumers. However, the Directive does not prescribe any specific means of making the information accessible. Various options are therefore available, as long as consumers can easily access the information – for example, via a QR code on the product packaging or marketing materials that links to the results on the company’s website.

III. Case-by-Case Assessment Instead of a Per Se Ban

Unlike, for example, general environmental claims, which are per se prohibited under certain conditions and appear on the so-called “blacklist,” claims regarding future environmental performance are not subject to an absolute ban. Rather, they must be assessed on a case-by-case basis, whereby it must ultimately be demonstrated that the contested practice causes or is likely to cause the average consumer to make a business decision that they would not otherwise have made.

In practice, this means that the absence of one of the above-mentioned elements – such as a robust implementation plan or an independent review—does not automatically render the practice inadmissible, but constitutes strong evidence of a misleading commercial practice that may be prohibited in the specific case.

IV. Interaction with Other Provisions of the EmpCo Directive

Claims regarding future environmental performance may also conflict with other provisions of the EmpCo Directive in specific cases. For example, statements based on the offsetting of greenhouse gas emissions and claiming that a product has a neutral, reduced, or positive impact on the environment with regard to greenhouse gas emissions are always inadmissible at the product level. This prohibition is on the blacklist and therefore applies – unlike statements regarding future environmental performance – without a case-by-case review.

The European Commission has clarified in its Q&A that company-level claims regarding the transition to climate or carbon neutrality, as claims about future environmental performance, are subject to the relevant requirements. At the same time, the Commission emphasizes that this ban does not prevent companies from promoting their investments in environmental initiatives, provided the information is not misleading and meets the requirements of EU law.

V. What are the consequences of violations?

Violations of the provisions of the EmpCo Directive or the version of the UWG effective as of September 27, 2026, will primarily be pursued by consumer and competition associations as well as eligible competitors. In practice, this may result in costly cease-and-desist letters and, if an out-of-court settlement is not reached, preliminary injunctions and injunctive relief. Potential claims for damages and the risk of reputational damage are also conceivable.

VI. Recommendations for Action and Outlook

The effective date of the UWG amendment on September 27, 2026, is drawing nearer. Companies that advertise with statements about future environmental performance or intend to do so should promptly review their communications to ensure they meet the requirements for statements regarding future environmental performance.

To this end, all existing future-oriented environmental claims – whether on product packaging, in advertising campaigns, on company websites, or on social media – should be identified and documented. Each individual claim must then be reviewed to determine whether a detailed and realistic implementation plan with measurable and time-bound targets exists and whether a corresponding allocation of resources has been outlined. If such a plan does not yet exist, it must be created. Furthermore, steps should be taken early on to engage an independent external expert to regularly review the implementation plan. Finally, it must be ensured that the results of these reviews are made available to consumers in an easily accessible format.

Since no transition period is provided for products already on the market, existing products must also comply with the new requirements as of the effective date. It is to be expected that, once the new legal provisions take effect, consumer protection and competition associations in particular will strictly monitor compliance with the new regulations and consistently pursue violations.

We would be happy to assist you in implementing the new UWG rules in a timely manner.

In upcoming posts, we will take a closer look at other aspects of the EmpCo guidelines, particularly the implications of the ban on CO2 offset claims and the consequences for brands and corporate logos.

Competencies Remain

Following the Bundestag’s decision, the Federal Network Agency ("Bundesnetzagentur") remains – unsurprisingly – the central authority responsible for overseeing the implementation of the Data Act in Germany.

Despite opposition from the Bundesrat, the special jurisdiction of the Federal Commissioner for Data Protection and Freedom of Information (BfDI) will be retained. Accordingly, the BfDI has sole jurisdiction over the supervision of the application of the Data Act with regard to the protection of personal data when processed by non-public bodies. In addition, the state data protection authorities retain jurisdiction over processing by the data recipient. In its statement, the Bundesrat therefore warned against dual oversight and the associated risk of parallel proceedings, as well as potentially divergent assessments by different authorities and courts. Common fundamental issues – such as the classification of the information in question as personal data – could be assessed differently by the BfDI when evaluating a data usage request than by the state authority within the scope of its ongoing data protection oversight. In light of these potential divergences, no adjustments were made to the draft. Whether this will ensure the legal clarity and certainty promised by the federal government regarding the application of the Data Regulation remains to be seen, particularly given the difficulties in distinguishing between the Data Act and data protection.

Sanctions: Lower Fines Than Originally Planned

The adopted draft of the Data Act Implementation Act conclusively regulates the sanctions for violations of the Data Act and the Data Act Implementation Act.

With a maximum limit of EUR 500,000, the penalty payments are significantly lower than in the draft bill, which previously provided for penalty payments of up to EUR 10,000,000.

A tiered system is in place for determining the amount of fines: a maximum limit of EUR 50,000 applies to minor violations, EUR 100,000 to moderate violations, and EUR 500,000 to serious violations. A serious violation occurs, for example, when connected products are not designed in such a way that the data they generate or record is accessible to the user. If a user is prevented from sharing received data, this may constitute a moderate violation. A violation of the obligation to provide evidence in the event of a refusal to share data is considered minor.

Furthermore, the maximum limits may be exceeded if economic benefits were derived from the sanctioned violation.

Overall, the sanctions have been made more lenient than originally planned. The adjustment is intended, in particular, to prevent an undue burden on SMEs and to ensure proportionality. It can be assumed that this approach is designed in line with the objectives of the Digital Omnibus.

Outlook

With the Bundestag’s resolution, the groundwork has now been laid for sanctioning violations of the Data Act (and the Data Act Implementation Act). Companies are therefore well advised to use the remaining time until the national implementing regulations take effect to adapt existing processes to the new requirements at an early stage and minimize potential sanction risks. It is expected that the Data Act Implementation Act will enter into force shortly, given the already delayed national implementation.

This article was created in collaboration with our research associate Esma Yildiz.

The new requirements, which apply exclusively in the B2C sector – that is, wherever businesses interact with consumers – and are implemented through a revised version of the Unfair Competition Act (UWG), will take effect on September 27, 2026. As things stand, no transition period is planned, not even for products already on the market.

Anyone who engages in environmental advertising or intends to do so in the future and wishes to continue operating in the market in compliance with the law as of September 27, 2026, should familiarize themselves with the new rules now at the latest and, where necessary, take appropriate measures.

I. Scope of Application

The amendment to the UWG introduces several categories of environmental business practices, each of which is subject to its own set of regulations.

Specifically, this applies, among other things, to:

• “general environmental claims,” which, due to a lack of specification in the same medium, pose a particular risk of misleading consumers;
• “sustainability labels,” which in the future must be based on a certification system or be established by the government;
• “future environmental performance,” i. e., statements regarding environmental performance not yet achieved that are linked to a robust implementation plan;
• statements regarding the “offsetting of greenhouse gas emissions,” which will be prohibited in all product-related contexts in the future.

As part of our HEUKING series on the aforementioned practices covered by the EmpCo Directive, Part 1 dealt with “general environmental claims” (available here). This article now focuses specifically on the regulations regarding sustainability labels.

II. Sustainability Labels

In the EmpCo Directive (and the future Section 2(2)(4) of the Unfair Competition Act (UWG), as amended), a “sustainability label” is defined as

“a voluntary public or private trust mark, quality label, or similar, intended to highlight or promote a product, process, or business activity with regard to its environmental or social characteristics, or both, excluding all mandatory labeling under Union or national law.”

In short, sustainability labels are therefore, in particular, voluntary trust labels or quality marks that serve to highlight or promote the environmental or social characteristics of a product, process, or business activity.

Due to the broad definition, depending on the intended use, overall context, and consumer perception, even nature-related elements (e. g., green leaves or water droplets next to a text element or logo) can be considered sustainability labels and thus fall within the scope of application.

Sustainability labels serve a trust-building function for consumers. Consumers should be able to trust that the specific characteristic advertised by a sustainability label is actually present. This function of instilling trust is regularly not fulfilled when companies use their own sustainability labels. The provisions of the EmpCo Directive therefore aim to ensure the transparency and credibility of sustainability labels and to put a stop to the proliferation of private sustainability labels.

As of September 27, 2026, it will therefore be prohibited to display sustainability labels that are neither based on a so-called certification system nor established by government agencies.

In cases where the use of a sustainability label is linked to commercial communication that gives the impression that a product has a positive or no impact on the environment or is less harmful to the environment than competing products, this sustainability label should also be regarded as an environmental claim under Recital 8 of the EmpCo Directive.

1. Government-established sustainability labels

Examples of government-established sustainability labels include the EU Ecolabel introduced by the European Commission, the “Blue Angel” label as the German federal government’s environmental label, and the “Green Button” label of the Federal Ministry for Economic Cooperation and Development. These are subject to strict monitoring by government regulatory authorities.

If a sustainability label has been established by a government agency, it may continue to be used in the future. If the sustainability label was not established by a government agency, it must be based on a certification system.

2. Certification System

“Certification system” is defined in Section 2(2)(6) of the UWG (Unfair Competition Act), as amended, as

“a system of third-party verification that confirms that a product, process, or business activity meets certain requirements, that enables the use of a corresponding sustainability label, and whose terms and conditions, including its requirements, are publicly available and meet the following criteria:
a) the system is open to all businesses under transparent, fair, and non-discriminatory conditions,
b) the system’s requirements are developed by the system owner in consultation with appropriate experts and stakeholders,
c) the system establishes procedures for addressing non-compliance with the system’s requirements and provides for the withdrawal or suspension of the entrepreneur’s use of the sustainability label in the event of non-compliance with the system’s requirements, and
d) monitoring of an entrepreneur’s compliance with the system’s requirements is subject to an objective procedure and is carried out by a third party whose competence and independence from both the system owner and the entrepreneur is based on international or Union-wide standards and procedures or on standards and procedures of a Member State of the European Union.”

A certification system is therefore a formalized verification and monitoring system designed to certify products, processes, or business activities against established criteria. It constitutes the basis for the lawful use of a sustainability label.

The audit required under the system must not be conducted by the party whose product, process, or business activities are being audited, but must be carried out by an independent third party. This is intended to strengthen the “transparency and credibility” of the certification system and, consequently, of the sustainability label (Recital 7 of the EmpCo Directive). Mere self-certification therefore does not meet the requirements for a certification system.

A distinction must therefore be made between three parties involved:

• The system owner, who designs, operates, and is responsible for the respective certification system. This individual establishes the system’s requirements and conditions. This means that they specify the criteria for awarding a sustainability label and the conditions under which such a label may be used.
• The third party, independent of the certification program owner, who performs monitoring tasks and verifies compliance with the requirements set forth in the certification system.
• And finally, the certified business that is permitted to use a sustainability label based on the certification system.

The conditions of the certification system, including the requirements for the products, processes, or business activities that must be met for certification, must be publicly accessible. In this regard, easy accessibility to the public is required, for example through publication on freely accessible websites. Conversely, it is insufficient if the conditions and requirements are only available after prior registration and/or sign-up or are provided solely upon individual request.

3. What applies to test seals and trademarks?

It remains unclear whether test seals (Stiftung Warentest, Öko-Test, etc.) also qualify as sustainability labels. In principle, even a logo that primarily serves to promote test results may be perceived by consumers as a recognized seal or quality mark.

Currently, however, it is generally assumed that neutral consumer tests are not covered by the scope of application. Due to the fact that the assessment is made from a consumer’s perspective, uncertainty remains in individual cases as to when a test seal – which, while not primarily focused on sustainability, nevertheless includes sustainability aspects – can be considered a sustainability label.

The German statutory text contains no explicit exception for trademarks. According to the legislative rationale, however, the concept of a sustainability label must be interpreted narrowly from a teleological perspective and covers only marks that, from a consumer’s perspective, appear to be an independent confirmation of certain sustainability characteristics. Pure indications of origin are therefore generally not intended to fall under this definition (BT-Drs. 21/3327, p. 19). Accordingly, trademarks are generally not sustainability labels; according to the legislative history, an exception may apply at most to warranty marks.

While the European Commission shares the basic premise that traditional trademarks are not automatically classified as sustainability labels, it rejects a blanket exclusion based on the form of the trademark and always requires a case-by-case assessment. Furthermore, it points out that trademarks – regardless of their legal classification – can function as environmental statements if their name or design contains relevant references.

In practice, this therefore typically involves two stages of examination: First, it must be clarified whether the sign appears as a sustainability label, second, it must be examined independently of this whether the trademark name can be understood as an environmental statement. For companies operating throughout the EU, it is advisable to follow the Commission’s positions, as they set the stricter standard.

III. What are the consequences of violating the EmpCo?

Violations of the provisions of the EmpCo Directive or the version of the UWG effective as of September 27, 2026, are primarily pursued by consumer and competition associations as well as eligible competitors. In practice, this entails, in particular, costly cease-and-desist letters and, if an out-of-court settlement is not reached, preliminary injunctions and injunctive relief actions.

As a result, non-compliant goods may become unsellable, and potential claims for damages and the risk of reputational damage must also be taken into account.

IV. Recommendations for Action and Outlook

The implementing regulations for the EmpCo Directive present companies with significant legal and practical challenges. There is not much time left before the new provisions of the UWG take effect on September 27, 2026. Companies should therefore ensure in a timely manner that, for example, products or product packaging as well as their websites no longer feature unauthorized sustainability labels or unauthorized environmental advertising claims by that date.

It is to be expected that, once the new legal framework takes effect, consumer protection and competition associations in particular will strictly monitor compliance with the new regulations and consistently pursue violations – typically through costly cease-and-desist letters.

In upcoming posts, we will take a closer look at further aspects of the EmpCo Directive, particularly the new requirements for statements regarding future environmental performance and the implications of the ban on CO2 offset claims.

We are happy to assist you in the timely implementation of the new UWG rules and will continue to help you communicate your commitment to sustainability in a legally compliant manner.

This article was written in collaboration with our research assistant Franziska Klinzing.

I. Who the CRA Applies To

1. Manufacturers

The manufacturer is the central figure of the CRA and, at the same time, the economic actor subject to the most far-reaching obligations. The definition in Art. 3 No. 13 CRA is decisive:

A manufacturer is any natural or legal person who develops or has a product with digital elements manufactured and places it on the market under their own name or brand. What is decisive, therefore, is not so much the actual technical manufacturing as the presence on the market.

Based on this, two requirements can be identified:

“A manufacturer is any natural or legal person who develops or has manufactured a product with digital elements and places it on the market under their own name or brand. What is decisive, therefore, is not so much the actual technical manufacture as the presence on the market.”

Second, the company must market the product under its own name or brand. This “placing on the market under its own label” is the central distinguishing criterion: whoever appears to market participants as the responsible provider is the manufacturer – regardless of whether the development was actually carried out in-house or entirely by third parties.

Against this background, the following scenarios in particular should be classified as manufacturers:

• Traditional manufacturers: Companies that develop hardware or software themselves and distribute it under their own name.
• Software developers: Companies that exclusively develop and distribute software (e.g., apps, operating systems, or other standalone software) are also manufacturers, provided that the software is made available as a standalone product.
• Quasi-manufacturers (white-label): Companies that have products or software developed or produced by third parties but distribute them under their own brand are also considered manufacturers.
• Platform or system providers: To the extent that they market their own products with digital elements under their own name (e. g., bundled hardware and software solutions), they are also classified as manufacturers.

Conversely, a manufacturer is not someone who is involved in the development or production but does not act as a supplier to the market themselves. Nor does it matter whether the product is provided for a fee or free of charge.

The legal presumptions of manufacturer status are also of particular practical relevance: An importer or distributor becomes a manufacturer if they place a product on the market under their own name or brand, or make a substantial change to a product. As a result, the role of manufacturer can “shift” along the supply chain, a fact that is often overlooked in practice.

Overall, the CRA’s definition of a manufacturer is deliberately broad. Companies that “only” develop software or distribute products under their own brand, in particular, should therefore carefully examine whether they are already classified as manufacturers under the Regulation, with the resulting comprehensive regulatory obligations.

2. Importers

An importer (Art. 3(16) CRA) is any natural or legal person established in the Union who places a product with digital elements from a third country on the Union market for the first time. The decisive factor is thus solely the function as a “point of entry” for non-EU products, not the company’s own involvement in development or manufacturing.

A prerequisite is that the product continues to be marketed under the name or brand of the third-country manufacturer. In this case, the original supplier remains the manufacturer, while the importing company is classified as the importer. In practice, therefore, importer status is often not permanent but may cease to apply due to rebranding or product modifications.

3. Distributor

A distributor (Art. 3(17) CRA) is any natural or legal person in the supply chain who makes a product with digital elements available on the Union market without altering its characteristics, without being a manufacturer or importer.

The defining characteristic is thus a purely distributive function. The distributor does not place products on the market themselves, but merely passes them on within the supply chain. This covers the entire distribution level, including wholesale, intermediate, and retail trade, as well as online distribution. As soon as a company modifies products or distributes them under its own name, it ceases to be a distributor and becomes a manufacturer. It is therefore decisive whether the activity remains limited to the unaltered transfer of products.

II. Key Obligations

The obligations under the CRA are largely tied to the respective role in the supply chain, with the manufacturer facing the most comprehensive set of obligations. Central to this are, in particular, cybersecurity requirements throughout the entire product lifecycle, including secure product design, vulnerability management, and the provision of security updates.

In contrast, importers and distributors are subject to graduated due diligence and verification obligations. They may only make products available on the market if they meet the CRA’s requirements and must, in particular, verify compliance with formal conformity requirements.

All economic operators are required to take action in the event of identified risks or security incidents and to cooperate with manufacturers and authorities. The specific scope of these obligations depends crucially on the respective classification as a manufacturer, importer, or distributor.

III. Current Developments

An important step toward the practical implementation of the CRA was taken on March 3, 2026, with the publication of a draft guidance document by the European Commission. The guidance aims to make the regulation’s requirements – which have so far been somewhat abstract – more tangible for companies and to provide early guidance for the ongoing transition phase. Given that many companies still underestimate their role as manufacturers and the scope of their obligations, this document is of considerable practical importance.

In terms of content, the guidance specifically clarifies the requirements for secure product development (“secure by design” and “secure by default”). The Commission makes it clear that cybersecurity should not be an afterthought but must be systematically considered as early as the design and development phases. This includes, for example, structured risk analyses, secure default settings, and processes to minimize attack surfaces. Companies must therefore frequently conduct fundamental reviews and document their development processes.

Another key focus is on vulnerability management. The guidelines describe in detail how manufacturers must handle vulnerabilities – from establishing internal processes for identification and assessment, through coordinated disclosure procedures, to the timely provision of security updates. Particular emphasis is placed on the obligation to maintain a functioning vulnerability management system throughout the entire product lifecycle. In doing so, the Commission clarifies one of the most practically relevant and, at the same time, most resource-intensive sets of obligations under the CRA.

In addition, the Commission addresses questions regarding the scope of application. It clarifies that the CRA must be interpreted broadly and, in particular, regularly covers pure software products as well. In doing so, the guidance confirms the broad scope already inherent in the text of the Regulation and once again underscores that software providers, in particular, must closely examine their potential classification as manufacturers.

The guidance also provides further details regarding reporting obligations. In particular, it clarifies the requirements regarding the content, deadlines, and recipients of reports. This is of great importance for companies, as the relevant obligations will take effect as early as September 2026 and must be coordinated in practice with existing reporting obligations, e. g., from the NIS 2 Directive or the GDPR. The guidance already suggests that parallel compliance with multiple regimes may be necessary as long as harmonization does not occur.

In this regard, the European Commission is working within the framework of the so-called Digital Omnibus to achieve a comprehensive simplification of digital law reporting obligations. The goal is to harmonize existing reporting obligations more closely and, in the long term, to consolidate them through central contact points (we reported on this in Data Protection Update No. 221 and No. 236). For companies, this could lead to a noticeable reduction in administrative burden in the medium term. In the short term, however, the legal landscape remains fragmented, meaning that the various reporting obligations must continue to be observed in parallel and coordinated organizationally.

IV. Conclusion and Outlook

The CRA already necessitates significant action today – especially for companies that have not yet recognized that they may be classified as manufacturers under the Regulation. The transition periods should therefore be actively utilized to clarify one’s own role and implement the necessary technical and organizational measures in a timely manner.

The guidance published by the Commission provides important direction in this regard but is not yet final. Companies currently still have the opportunity to participate in its further development: The Commission is conducting a consultation and accepting comments on the guidance until April 13, 2026.

In light of further developments – particularly within the framework of the Digital Omnibus – a progressive clarification and partial standardization of the requirements is also to be expected. Nevertheless, it must be noted: Companies must set the course for CRA compliance now.

This article was created in collaboration with our student employee Emily Bernklau.

I. Background: Why the Legislator Is Regulating the Cloud Market

Anyone purchasing digital infrastructure today – whether storage space, computing power, or a complete software platform – often enters into a long-term commitment. Data is stored in proprietary formats, interfaces are tailored to a specific provider, and switching providers often fails due to the technical and financial hurdles of migration. This phenomenon – known in technical jargon as vendor lock-in – not only impairs the flexibility of individual companies but also hinders competition across the entire European cloud market.

This is precisely where Chapter VI of the Data Act (Regulation (EU) 2023/2854) comes into play. The regulations, effective as of September 12, 2025, require providers of so-called data processing services to enable their customers to switch providers seamlessly. The scope of these obligations ranges from mandatory contract terms and the provision of open interfaces to the phased elimination of switching charges. However, for these obligations to take effect, a preliminary question must first be answered: Does the service in question even fall under the definition of a data processing service?

II. What the Data Act means by a data processing service

Article 2(8) of the Regulation contains a definition that establishes the scope of Chapter VI. According to this, a data processing service exists when a digital service provides the customer with network-based access to a shared pool of computing resources – such as storage, processing power, or network components – that can be provided on-demand, in a scalable manner, and with minimal administrative overhead.

This description is based on the internationally established cloud computing definition from the National Institute of Standards and Technology (NIST) from 2011. The regulator has largely adopted the terminology used there and merely supplemented it with elements intended to include decentralized processing models such as edge computing. The explanatory notes to the Regulation (Recital 81) explicitly mention the three common service models – IaaS, PaaS, and SaaS. Furthermore, the definition is technology-neutral, meaning that newer concepts – such as data-driven services or AI-based offerings – can in principle also fall under the term.

Upon closer examination, it becomes clear that drawing the line in practice is anything but trivial. This is because the definition combines around 17 individual characteristics, many of which are open to interpretation. Furthermore, the various language versions of the Regulation are not entirely consistent with one another.

III. Where the distinction becomes difficult: The example of complex software services

For traditional infrastructure offerings – such as virtual servers, storage capacity, or database instances – there is little doubt that they fall under the definition of data processing services. These services directly provide customers with technical resources that they can scale up or down as needed. This constitutes the core business of the major cloud platforms, and the legislature clearly had these offerings in mind when designing the switching regime.

The situation is less clear-cut for software services that, while provided via the Internet, derive their actual value not from computing power but from the specific functions they perform. A cloud-based accounting program, a human resources management system, or industry-specific planning software naturally utilize scalable computing resources in the background. However, the customer does not purchase storage or processor time, but rather a business solution. They configure payroll rules or inventory management processes—not server instances.

The crucial question is therefore: Is it sufficient for classification as a data processing service that a service is based on cloud infrastructure in the background? Or must the customer themselves have access to the underlying resources? If one follows the framework and purpose of the regulation, there is a reasonable case for the second interpretation: The text of the law requires that the service “enables” access to computing resources – which implies more than the provider’s mere internal use of such resources.

A look at the NIST framework also supports this assessment: It distinguishes between the infrastructure layer, where resources are directly provided, and the application layer, where ready-made software is consumed without resource control. The more a service maps operational processes, is configuration-intensive, and requires individual customization, the further it moves away from the type of data processing service that the regulation has in mind.

In practice, this means: A provider that exclusively provides server capacities or platform services clearly falls under Chapter VI. By contrast, a provider of highly specialized industry-specific software, whose value lies in the business logic rather than in the provision of technical resources, has several good reasons for considering itself outside the scope of the regulation. Between these two extremes, of course, there are numerous hybrid forms for which a blanket answer is not possible. Therefore, a specific analysis of the actual services offered and their concrete structure is always required.

IV. Deadlines and Contract Terms When Switching Providers

1. The Process of Switching Under Art. 25 DA

The Regulation provides for a phased switching process. First, the customer must notify the provider of their intention to switch. For this purpose, Art. 25(2)(d) DA provides for a maximum notice period of two months, which must be specified as an upper limit in the contract. Following the expiration of this period, a mandatory maximum transitional period of generally 30 calendar days begins, during which the actual data migration is to take place. During this phase, the provider must continue to provide the service and assist the customer with the switch.

2. A Linguistic Issue with Practical Consequences

In the German version of the Regulation, the two-month period was originally referred to as a “Kündigungsfrist.” This was misleading, as the contract does not end upon the expiration of this period. In fact, it merely marks the starting point of the switching process – the contract is only considered terminated once the switch has actually been completed or the transition period expires. Consequently, the act of notifying a data processing service provider of the intention to switch does not constitute a contractual right in the strict sense. A formal notice of termination is therefore not required in this context.

The consolidated version of the Data Act now uses the more accurate term “Ankündigungsfrist.”

3. Reality Check: 30 Days for a Migration?

The 30-day transition period is realistic for simple services, but quickly reaches its limits in complex environments. If large amounts of data must be migrated, interfaces adapted, and business processes mapped in a new environment, one month is likely to be insufficient in many cases. The regulation takes this into account by allowing the provider to apply for an extension of up to seven months if they can demonstrate technical infeasibility (Art. 25(4) DA). However, it remains unclear whether and how this proof can be provided in practice.

V. What applies to existing contracts?

One of the most controversial issues regarding Chapter VI concerned whether contracts concluded before the Regulation took effect on September 12, 2025, would be covered. The Regulation itself does not provide a clear answer to this. Article 50 of the Data Act (DA), which specifies the effective dates for each chapter, simply contains no explicit provision for Chapter VI – unlike, for example, the provisions on unfair contract terms, for which the legislature has provided a clear transitional provision.

However, the Federal Network Agency – which was designated as the supervisory authority by the Data Act Implementation Act (DADG) passed by the Bundestag on March 26, 2026 – clarifies this and states unequivocally in the FAQ section on the DA: The provisions of Chapter VI of the DA apply to both existing and new contracts.

VI. Digital Omnibus

1. The Proposal for Article 31(1a) of the DA-E

In November 2025, the European Commission also proposed amendments to the Data Act as part of its Digital Omnibus Package. For the issue discussed here, one new exemption is particularly relevant: According to the proposed Article 31(1a) DA-E, services whose functionality has been predominantly tailored to a customer’s individual requirements are to be exempted from most switching obligations – but only if the relevant contract was concluded before September 12, 2025.

This proposal is revealing in two respects. On the one hand, it confirms that the switching regime primarily targets standardized, widely available infrastructure and platform offerings and not individually configured specialized applications. On the other hand, it also raises new questions: When exactly is the “majority of the functions” of a service customized for a specific customer? And why should the exception apply only to existing contracts, when the demarcation problem also exists for new contracts? Ultimately, the proposal addresses the issue of temporal applicability but leaves the fundamental question of demarcation unanswered.

VII. Conclusion and Recommendations

The regulations on cloud switching in Chapter VI of the Data Act pursue a clear objective: customers should no longer be trapped in closed systems. In practical implementation, however, it becomes apparent that key questions remain unresolved – above all, the scope of the term “data processing service.”

For companies that offer or use cloud services, this gives rise to specific requirements for action: Providers should analyze their product portfolio to determine which services could be classified as data processing services. In doing so, the marketing label matters less than the question of whether the customer gains access to technical resources or uses a ready-made application functionality. Existing contracts must be reviewed for compliance with the requirements of Article 25 of the Data Act and amended as necessary.

Given the uncertainties that still exist, it is advisable to closely monitor further developments: The EU Commission’s FAQs on the Data Act, the standard contractual clauses for cloud migration, the administrative practices of the Federal Network Agency, and the progress of the Digital Omnibus will play a key role in clarifying the currently unresolved issues in the coming months.

With the political agreement, the legislative process has entered its final phase. In early March, the provisionally final drafts of the new Regulation (“Draft Regulation”) and the new Directive (“Draft Directive”) were published. No material changes are expected at this stage and companies should therefore begin preparing for the foreseeable changes now.

I. Regulatory Protection Periods: Data Exclusivity and Market Protection

The regulation of protection periods was among the most controversial aspects of the reform. After long negotiations, the Commission, Parliament and Council agreed on a base data exclusivity period of eight (8) years (Art. 80(1) Draft Directive), thereby maintaining the current level of protection. During this period, competitors may not rely on the pre-clinical and clinical study data and other documentation of the marketing authorisation holder in order to obtain a marketing authorisation through the simplified procedure. An extension of this data exclusivity period is generally not contemplated. The sole exception is a one-year extension through the Transferable Exclusivity Voucher – on which more below.

Following data exclusivity, a one (1) year market protection period will apply going forward, one year less than under the current regime (Art. 80(2) Draft Directive). During this period, competing products such as generics and biosimilars whose marketing authorisations reference the data of the reference medicinal product may not be marketed. Market protection may be extended by twelve (12) months if the medicinal product falls within one of the following four categories:

A further one-year extension of market protection is available where the marketing authorisation holder obtains, during the data exclusivity period, an authorisation for one or more additional therapeutic indications for which a significant clinical benefit compared to existing therapies has been demonstrated (Art. 81(2a) Draft Directive). This extension may expressly be granted only once. The maximum duration of market protection is capped at two (2) years, unless an extension for an additional indication is granted (Art. 81(2b) Draft Directive). In that case, a total of three (3) years of market protection is possible. The overall protection period is thus limited to a total of eleven (11) years, in line with the current legal position. From the perspective of research-based pharmaceutical companies, it is a positive development that the originally proposed significant reduction of data exclusivity has been taken off the table and the baseline protection of eight years has been preserved. At the same time, planning uncertainty for pharmaceutical companies is increasing: the complex conditions attached to the market protection extension options are only partially within a company’s control.

It should also be noted that market protection may cease to apply in individual Member States where the marketing authorisation holder has failed to comply with a request from the relevant Member State to make the medicinal product available in sufficient quantities in that country (Art. 56a Draft Directive, on this in more detail under VI.).

Unsurprisingly, the concept of so-called drug repurposing has also been included in the final version of the new Directive. Under this provision, medicinal products authorised for a new therapeutic indication are granted a one-time data exclusivity period of four (4) years (Art. 84 Draft Directive), provided that no data exclusivity previously existed for the product or the initial authorisation was granted at least 25 years ago. This creates an incentive both for research involving known active substances and for the swift and cost-effective provision of new medicinal products.

II. Bolar Exemption

The reform clarifies and broadens the so-called Bolar exemption in order to enable generic manufacturers to enter the market immediately upon expiry of patent protection. The agreement clarifies that neither patents nor rights arising from a supplementary protection certificate are infringed where studies, trials and other activities necessary for obtaining a marketing authorisation are conducted (Art. 85(1) Draft Directive). The scope extends to health technology assessments (HTA), pricing and reimbursement decisions, as well as public procurement procedures. In addition, it has been clarified that intellectual property rights of the reference medicinal product do not constitute a valid ground for refusing, revoking or suspending decisions taken within the scope of the Bolar exemption (Art. 85(2) Draft Directive).

This new provision is likely to contribute to the harmonisation of the Bolar exemption across the EU. At the same time, concerns have been raised regarding potential adverse effects on the competitiveness of the European pharmaceutical industry.

III. Orphan Drugs

A central objective of the reform is to promote research and development of medicinal products for rare diseases – so-called orphan drugs. The concept of “high unmet medical need”, originally proposed by the Commission but subsequently deleted, has been reintroduced under the new designation “breakthrough orphan medicinal product”. Under Art. 70 of the Draft Regulation, this category encompasses drugs whose use results in a clinically relevant reduction in disease morbidity or mortality in the relevant patient population, provided that no authorised medicinal product for the rare condition in question exists in the Union.

Market exclusivity is governed on a differentiated basis: for standard orphan drugs, an exclusivity period of nine (9) years is provided for, whereas breakthrough orphan drugs will enjoy an extended exclusivity period of eleven (11) years. Where the authorisation is based on bibliographical data, market exclusivity is limited to four (4) years.

In addition, market exclusivity may be extended twice by twelve (12) months each. The prerequisite is that the marketing authorisation holder obtains, at least two years before the expiry of the exclusivity period, an authorisation for one or more new therapeutic indications for a different rare disease. This provision represents a significant departure from the existing legal framework, under which market exclusivity could be obtained separately and in full for each therapeutic indication for a rare disease.

IV. Antimicrobials

To effectively face the growing threat of antimicrobial resistance, the reform introduces an innovative voucher system: the so-called Transferable Exclusivity Vouchers (TEVs). These vouchers extend data exclusivity for a priority antimicrobial by twelve months (Art. 40 Draft Regulation). The system is designed with flexibility: companies may apply the TEV either to the priority antimicrobial itself or to another centrally authorised medicinal product of the same marketing authorisation holder. Moreover, transfer to third parties is possible. Where the TEV is used for a different medicinal product, it may be exercised in the fifth or sixth year of the base data exclusivity period. This represents an expansion compared to the original proposal, which provided for use only in the fifth year. However, a so-called blockbuster restriction applies. Vouchers may not be used for medicinal products whose gross annual turnover in the EU exceeds EUR 490 million within the first four years following authorisation. As this constitutes a novel incentive mechanism, the system is initially limited to 15 years. The Commission may issue a maximum of five vouchers during this period (Art. 43 Draft Regulation).

In addition, the reform confirms the subscription model (“Netflix” model) introduced by Parliament as a voluntary procurement mechanism for antimicrobials (Art. 43a Draft Regulation). Member States may jointly enter into multi-year subscription contracts under which remuneration is delinked from sales volumes. The company receives an agreed regular payment irrespective of prescription and sales figures and in return undertakes to ensure a continuous and sufficient supply of defined quantities.

Furthermore, the reform strengthens stewardship measures. A mandatory prescription requirement for antimicrobial agents is to apply EU-wide (Art. 51 Draft Directive). Marketing authorisation applications for antimicrobials must include a stewardship plan (Art. 17 Draft Directive) and the risk of antimicrobial resistance must be taken into account in the environmental risk assessment (Art. 22(4) Draft Directive).

This package of measures is intended to provide predictable revenues for the refinancing of research and development of antimicrobials. At the same time, it promotes a restrained, needs-based use of new antimicrobials, thereby aiming to contain the development of resistance.

V. Acceleration and Digitalisation

The reform contains important elements aimed at accelerating and modernising procedures. As a result of the trilogue negotiations, the standard review and authorisation period under the centralised procedure at the EMA will be shortened from the current 210 to 180 days – the Commission’s draft proposal has prevailed on this point. Industry has welcomed this acceleration of the approval processes.

Also to be viewed positively are the introduction of regulatory sandboxes and the further digitalisation of procedures. Applications must in future be submitted uniformly in electronic form and package leaflets must be made available in digital format. To reduce administrative burden, marketing authorisations are in principle to be granted for an unlimited duration. The EMA may derogate from this on safety grounds.

VI. New Obligations: Security of Supply and Shortage Management

The supply obligations introduced by the Council have become part of the reform and may affect centrally authorised medicinal products (Art. 5a Draft Regulation). Member States may request a marketing authorisation holder to make its medicinal product available on the respective market in sufficient quantities. To this end, they may either use their own procedure or rely on the mechanism under the new Art. 56a Draft Directive. Marketing authorisation holders concerned are generally obliged to comply with such a request, unless exceptional, unforeseeable or demonstrably uncontrollable circumstances exist. Non-compliance does not, for the time being, entail financial sanctions, contrary to earlier proposals by Parliament. An evaluation by the Commission in four years’ time is to determine whether sanctioning mechanisms for this obligation should be introduced.

Where data exclusivity or market exclusivity exists for a medicinal product, Art. 56a Draft Directive additionally provides the following consequences: if a marketing authorisation holder fails to comply with a Member State’s request within three years, the market protection under Art. 80(2) Draft Directive and, in the case of orphan drugs, the extension of market exclusivity for new therapeutic indications, shall not apply in that Member State. Generics and biosimilars may then be placed on the market in that Member State, even though market protection continues to apply in other Member States. To ensure that the end of market protection in one Member State is not abused to effectively circumvent protection in other Member States, wholesaler and distance sale distributors are prohibited from placing such medicinal products on markets where the protection of the originator product is still in force (Art. 166(5) Draft Directive). Additionally, under certain conditions, marketing authorisation applications for generics and biosimilars may be validated and assessed as early as six years after the commencement of data exclusivity for the reference medicinal product. The authorisation itself, however, may only be granted upon expiry of the full eight-year protection period.

The obligations relating to the prevention of supply shortages are being expanded. A general obligation to prepare Shortage Prevention Plans (SPPs) applicable to all medicinal products has not been adopted. However, such an obligation applies to all prescription-only medicinal products (Art. 117 Draft Regulation). Companies must report imminent shortages at least six months in advance (Art. 116 Draft Regulation). For small and medium-sized companies in particular, this is likely to entail a significant additional burden.

VII. Next Steps

On 18 March, the Committee on Public Health (SANT) in Parliament voted positively on the outcome of the trilogue negotiations. This paves the way for translation of the legislative texts into all Union languages and formal endorsement by the Council and Parliament, which could take place as early as this autumn.

The new Regulation enters into force 20 days after publication in the Official Journal of the EU, with application commencing generally 24 months after entry into force. Immediate application or a shorter transitional period is foreseen only for a limited number of exceptions, including the provisions on orphan drugs, TEVs and regulatory sandboxes. The new Directive is subject to a transposition period of 24 months. In addition, delegated acts and guidelines are expected. These will have a significant influence on whether the reform ultimately achieves the objectives it pursues.

1. Add-Ons as a serial process – The essential starting perspective

What fundamentally distinguishes buy-and-build and roll-up strategies from conventional one-off M&A is not the individual transaction, but the logic behind it. Add-ons are not standalone deals strung together in sequence; they are components of a serial process that must be conceived and structured as such from the outset.

This shift in perspective has far-reaching practical consequences. Decisions that can be made case by case in a one-off transaction must, in a serial model, be anticipated structurally in advance. Which documentation do we use? Which purchase price mechanics are standardisable? Where do we allow flexibility, and where do we not? How does the negotiation run – not just in the first deal, but perhaps in the seventh add-on? The real efficiency gains do not come from optimising the first transaction. They come from building a model that is just as robust at the tenth transaction as it was at the beginning.

From a legal perspective, this means every process decision should be evaluated for its repeatability. What looks like a pragmatic exception today can become a structural liability later.

2. LoI / Term sheet: A steering instrument, not a formality

One of the most consistently underestimated elements in buy-and-build processes is the letter of intent or term sheet. In conventional single transactions, it is often treated (wrongly) as a non-binding opening move: a document that captures rough parameters without committing much. In a serial model, this view is far too narrow.

In the buy-and-build context, the LoI / term sheet serves multiple functions simultaneously. It is an acquisition tool, a trust anchor for the seller, a structuring document, and the pacemaker for everything that follows. A well-crafted term sheet locks in the deal's essential parameters tightly enough that the subsequent documentation is no longer perceived as negotiating territory, but as the implementation of a framework both parties have already agreed.

In practice, it has proved effective to keep the term sheet standardised, clear, and – particularly when dealing with mid-market sellers without M&A experience – genuinely easy to understand. In terms of substance, it should go well beyond a vague price range and already map out the key economic and structural parameters: valuation and purchase price structure, cash component and any rollover equity, vendor loan, core governance assumptions, and the timeline to closing. The message this sends does not need to be stated bluntly to land: we have agreed the key parameters together – everything else follows from the group’s standard framework and process, for reasons that are straightforward to explain.

3. Transaction structure

One decision that is occasionally taken too late in practice is the choice of transaction structure.

In buy-and-build strategies, the default is a full acquisition by way of share deal. The asset deal remains an option but is reserved for clearly defined situations – where the target carries material legacy liabilities that cannot be otherwise managed structurally, or where regulatory requirements compel a different approach. What matters most is not which structure is chosen, but that the decision is made consciously, early, and consistently – and not revisited mid-process. A structural change after due diligence has begun creates additional work, confusion on the seller side, and consumes negotiating capital that would be better deployed elsewhere.

In certain sectors, such as healthcare businesses involving MVZ structures or particular regulated professional service structures, pre-structuring on the seller side may be necessary before the transaction itself can be completed: changes in legal form, carve-outs, or restructuring of existing entities. These points need to be identified early, addressed cleanly in the contracts, and – depending on who carries out the pre-structuring – priced in with appropriate implications for timeline and cost allocation.

4. Due diligence with proportionality

Due diligence in a serial model follows a different logic than in a one-off transaction. The guiding question is not: what can we review? It is: what is material enough, from an economic and liability perspective, to justify the effort for everyone involved?

A risk-conscious approach with a clearly defined scope has consistently proved far more efficient than attempting to inventory everything comprehensively. Extensive DD reports can be appropriate – for internal investment committees, third-party financing, or atypical risk profiles. In many add-on situations, however, a structured, decision-relevant summary of the key risk areas is sufficient.

An important conceptual distinction is that between due diligence as a risk assessment tool and post-merger integration as the operational follow-on step. What can be harmonised efficiently and group-wide after closing (data protection documentation, internal policies, standard contracts, IT processes) does not need to be fully resolved before signing. The DD establishes whether known or latent risks are price-relevant or give rise to liability; the PMI ensures the actual state is brought in line with the target state. Drawing this distinction consistently saves considerable effort and keeps the focus where it belongs.

A concrete efficiency gain can also be achieved by linking the data room to the warranty structure. Where aggregated lists are requested for DD purposes anyway – leases, employees, insurance policies, material customer and supplier contracts – these can serve directly as the basis for the contractual warranties, without duplicating the work.

5. Documentation as a scaling lever

The principle is straightforward: in the buy-and-build context, the buyer provides the documentation. This is not a question of leverage, but a question of efficiency, and experienced sell-side advisers will rarely be surprised by this.

This foundational decision implies a far-reaching design principle: the documentation must be modular, standardised, and built for repetition from the outset. This encompasses template SPAs and APAs, standardised articles of association and rules of procedure / governance rules, service contract templates, and clear, simple mechanics for purchase price components, liability, and rollover equity.

Two design principles have proved particularly effective. First, variables should appear at as few and as clearly defined points in the document as possible. Purchase price, parties, reference dates – these parameters are set once and referenced by definition across all downstream documents. Defining the purchase price and its calculation basis independently in three places across three schedules creates errors and unnecessary coordination overhead. Second, the documentation should be structured so that it is in principle automation-ready. At high transaction volumes, the use of structured data templates – where parties, ownership interests, and core parameters are entered once and populate all relevant documents – can yield a significant efficiency gain. This is not appropriate for every strategy, but the documentation should at least be designed so that the option remains open.

For economically and psychologically sensitive points – rollover equity, purchase price calculation, non-competes, bonuses – an additional principle applies: simplicity is king. Complex, lengthy documentation on these topics slow negotiations, create uncertainty, and generate friction that persists well beyond closing. Addressing these points clearly, comprehensibly, and in a way that can be explained in plain terms wins not only speed, but also acceptance.

6. Seller psychology as a success factor

Buy-and-build strategies frequently encounter sellers who are not seasoned M&A professionals – entrepreneurs selling the business they have built over a lifetime, often without legal counsel or with advisers who lack specific transaction experience. For this audience, a professionally assembled, scale-oriented transaction package can feel daunting at first encounter. The questions that arise are less legal than human: What am I giving up? What am I committing to? Do I actually understand what is happening here?

This reaction is normal and predictable – which means it should be anticipated in the process plan, not left to improvisation. Buyers and their advisers play an active explanatory role in this situation: structures must be explained, not merely delivered. Rollover equity concepts must be written so that they are intelligible without a legal background. Guides or FAQ documents addressing recurring questions can meaningfully reduce friction in the negotiation.

Seller psychology is not a soft side issue in this context – it is a hard efficiency factor. Sellers who feel understood and fairly treated move faster, cooperate more readily, and prove more reliable counterparties, including after closing.

7. Rollover equity: economic, timing and emotional dimensions

Rollover equity is a central but often underestimated element of the overall process. It serves not only to partially finance the purchase price and incentivise performance, but also fundamentally shapes how sellers see their role after closing. A seller who is a co-shareholder in the platform from day one thinks differently about group interests, willingness to cooperate, and exit orientation. Depending on the specific model chosen for the overall transaction, participation can be structured at different levels of the group, potentially using different instruments across multiple tiers and a range of legal constructs. Here too, the same principle applies: structural complexity should be the exception; the most efficient path is the goal.

In designing rollover equity, the tax interests of the sellers – typically their primary concern alongside purchase price structure – should be taken into account wherever possible. For sellers, this is one of the most tangible and therefore most central negotiation points.

Beyond incentivisation, rollover equity frequently determines the deal timeline in practice – and does so in an objective, readily explicable way. Capital increases at holding level typically occur only at a small number of points during the year and are based on fair market value at the relevant date. A seller who wishes to participate at an earlier, lower valuation must have the transaction completed by a certain deadline. Later entry occurs at correspondingly higher valuations. This logic is not a pressure tactic – it is a structural reality, and it imposes discipline without requiring any explicit negotiating manoeuvre.

8. Standard and exception – decided deliberately, not drifted into

Standardisation does not mean rigidity. In virtually every add-on, there will be points that require or justify a departure from the standard. That is neither unusual nor problematic – provided the departure is the result of a conscious decision, and not of a lack of process discipline or a negotiation that has taken on a life of its own.

A distinction between negotiable and non-negotiable elements (communicated clearly and early) has proved its worth in practice. As the transaction track record grows, recurring patterns of deviation can be identified and absorbed into the standard: as optional modules or defined ranges of flexibility that are handed to the deal team and advisers as a toolkit to work with autonomously. This creates genuine scalability: advisers can act faster and more independently, without waiting for case-by-case decisions.

9. Fine-tuning after the first transactions

Few transaction models offer better conditions for continuous improvement than buy-and-build. After just a handful of add-ons, clear patterns emerge: which DD topics recur consistently, where the most stubborn negotiation points arise, which clauses generate discussion that could have been avoided.

Structured fine-tuning – realistically first undertaken after the third add-on, then repeated at regular intervals – pays direct dividends in efficiency and quality. The matrix of typical negotiation points, standard positions, and pre-agreed margins of flexibility, developed jointly with advisers, is not a bureaucratic instrument. It is a practical tool that accelerates transactions and ensures consistency.

10. What follows

Individual add-on transactions are the operational backbone of every buy-and-build and roll-up strategy – and with a scalable, standardised process in place, the essential foundations for lasting success are established. This foundational series concludes here.

Deeper analysis of selected topics – competition law considerations, sector-specific particularities, add-ons by strategic acquirers, and VC-driven platforms – will follow in the coming weeks as focused articles on this page.

The team at HEUKING is always available for your questions or direct discussion.

This part goes deeper on the platform itself as the starting point of the strategy. While individual add-on transactions tend to attract most of the public attention, execution requires putting first things first: one of the most significant success factors is a clean, purposeful design of the platform. It is not merely an acquisition vehicle – it is the legal, economic, and organisational pivot around which everything else turns.

Practice shows this clearly: the more carefully and forward-looking the platform is designed, the greater the scalability of the strategy, the lower the friction in subsequent add-ons, and the more resilient the model is to regulatory, financing, and other challenges down the line.

1. A deliberate starting point, not a by-product of the first transaction

A purposeful platform design depends materially on the specific economic and operational strategy, as well as any applicable regulatory requirements. These factors must drive the design and can in some cases call for highly individual configurations.

From a legal perspective, however, every such structure should be designed – in the interest of scalability – to meet at least the following criteria:

it should

• accommodate add-ons, including potentially different types, without creating structural breaks;

• anticipate financing requirements and individual deal conditions efficiently and adequately;

• provide for rollover equity and incentivisation mechanisms;

• consolidate governance processes efficiently; and

• enable a clean, tax-efficient exit.

2. Base model as a key strategic decision

One of the most consequential early decisions is selecting the base model that fits the particular strategy. In our experience, different platform structures have established themselves in practice depending on the industry, the intended degree of integration, and the investor model.

a. Holding-centric models with a high degree of autonomy

In roll-ups targeting fragmented markets, a pure holding structure is often the preferred approach, under which the add-ons – typically numerous – remain legally independent entities. These models generally place significant emphasis on retaining all or selected sellers and managers, with operational intervention reserved for selective purposes: shared services functions, or group-wide standards on chosen matters.

This model frequently enables high acquisition velocity, seller willingness to share risk through deferred or contingent consideration, and lower operational integration hurdles. The challenges, beyond managing the tension between autonomy and group interest, can include limited levers for direct intervention and an elevated need for coordination at governance level.

b. Integrated platform models

At the other end of the spectrum sit integrated models, in which autonomous operation by add-on companies is deliberately limited and structural consolidation – through mergers, for instance – typically follows quickly. These models are usually built around a core operating platform company, the nucleus, to which add-ons are attached.

The challenges here include greater integration complexity and, at times, stronger reservations from employees, management, and sellers of the target companies. The advantages lie in a leaner group structure with a stronger unified identity, faster realisation of operational synergies, and clear leadership and decision-making hierarchies.

c. Hybrid models

In practice, investors most often opt for hybrid models tailored to the specific target industry and its particular complexities: add-ons that initially remain legally independent, combined with the stepwise operational integration of selected functions – procurement, IT, legal, HR – potentially followed by structural consolidation over time.

3. Governance

As the number of add-ons grows, the need for clear governance structures increases proportionally. At a conceptual level, governance must follow from the chosen base model and then requires further elaboration: where decisions are made and who makes them.

Typical governance elements include:

• a clear allocation of authority between the investor, the holding or platform management, and the add-on managing directors;

• defined approval processes and reserved matters – for acquisitions, investments, management changes;

• and uniform reporting systems and KPIs.

In practice, these are implemented primarily through constitutional documents (such as articles of association), rules of procedure for the managing directors – ideally standardised across the group – and, where appropriate, shareholder agreements. Here too, the same principle applies: what works smoothly with three add-ons can quickly become dysfunctional and obstructive at ten or more. Part 3 of this series will therefore focus specifically on standardised template documentation – including the governance documentation that, depending on the base model, significantly touches on seller interests – designed to enable the efficient negotiation and execution of individual add-ons.

4. Group infrastructure

Particularly in light of operational and tax requirements, corporate groups generally require a suite of intra-group agreements. These should be tailored to the specific needs of the group and typically include a master services agreement, a group-wide data protection agreement, a cash pooling arrangement, and – where applicable – profit and loss transfer agreements.

5. Rollover equity, management equity programmes and role design

A central element of many strategies is the rollover equity participation of sellers and managers in the platform. This serves not only to partially finance the purchase price but, more importantly, to provide long-term incentivisation and commitment – for all or selected sellers and managers – to the platform group. The dynamic shifts decisively when sellers are aligned from day one with maximising the group's success and, by extension, its exit value.

For rollover equity to deliver its intended effect without creating unnecessary complexity, it should:

• enable a tax-efficient entry – often via a rollover mechanism – and exit;

• be structurally embedded cleanly in the platform and scalable;

• be substantially limited to economic participation, with governance rights clearly demarcated; and

• be drafted and communicated in a way that is straightforward to understand.

The focus on efficient handling matters here too. While rollover equity documentation must address many interrelated aspects carefully, overly lengthy and complex documentation has in our experience a tendency to slow negotiations considerably and, at times, to create difficulties beyond the negotiation table itself.

6. What follows in this series

With a sound platform structure in place, the essential prerequisites for efficient scaling are established.

There are equally important legal success factors in the execution of the individual add-on transactions themselves – and that is where the final part of this series turns. Part 3 addresses add-on transactions in the buy-and-build and roll-up context: efficient scaling through standardisation and sound judgement, covering due diligence scoping, learnings on transaction documentation, managing deal-by-deal particularities, and more.

Extraordinary events with direct impacts on the stability of supply chains have occurred regularly in recent times (the COVID-19 pandemic, the Suez Canal blockage, the war in Ukraine, attacks on merchant ships in the Red Sea). Most recently, trade conflicts involving export restrictions and new and changing tariffs have put additional pressure on companies; the escalation in the Middle East has now been added to the mix. Those with long-term supply contracts or who rely on raw materials or intermediate products are feeling this particularly acutely right now.

Fixed-price contracts are reaching their limits – price adjustment mechanisms can help

Many companies established their supply relationships still during a period of stable trade conditions – with fixed prices, fixed delivery quantities, and fixed deadlines. This approach offers planning security; at the same time, it can become a cost and liability trap in the face of sharply fluctuating prices for raw materials or intermediate products and challenging global transport routes.

When, for example, the customs situation changes significantly – as recently occurred with new U.S. import tariffs on European goods—the question arises for both buyers and suppliers: Who bears the additional costs? In contracts, the standard legal answer is initially: the party to whom the contract assigns the burden, which often stems from rather inconspicuous transport clauses such as the ICC Incoterms. An pass-through of such additional costs is usually not provided for—nor is it readily possible.

The same applies to massive price increases in the procurement of raw materials and intermediate goods, as well as the creeping erosion of remuneration due to rising inflation. Here, price adjustment mechanisms can offer security or at least some relief. While they are widespread in international transport law, there are several hurdles in national legal systems that must be taken into account. At least outside the consumer sector, international standards can also help here. A commission of the International Chamber of Commerce is currently drafting relevant proposals – with my involvement.

Force Majeure: A Powerful Term, Narrow Limits

The first instinct of many contracting parties in a crisis situation is to invoke the force majeure clause – the legal doctrine of force majeure. The logic is obvious: if external events make contract performance economically unfeasible, surely one can be released from it?

It’s not quite that simple. Classically, force majeure requires that an event was unforeseeable, originated externally, and makes contract performance objectively impossible – not merely more expensive or complicated. This is precisely where the problem lies with tariffs: A tariff generally does not make a delivery impossible. It makes it more expensive. That is not sufficient for a classic case of force majeure in most legal systems.

Added to this is the question of foreseeability. Anyone entering into a supply contract today, for example, can hardly argue that they did not have trade conflicts between the U.S. and the EU on their radar. (Arbitration) courts dealing with such cases will scrutinize such arguments critically.

Hardship clauses: The underestimated tool

More effective – and often underestimated in practice – are so-called hardship clauses. They apply not in cases of impossibility, but in cases of severe economic unreasonableness: when the underlying conditions of a contract have changed so fundamentally that adhering to the original terms becomes unreasonable for one party (see § 313 BGB).

A well-drafted hardship clause can trigger an obligation to renegotiate and, in extreme cases, even enable a contractual adjustment through the courts or arbitration. This is not a free pass – but a legitimate tool that should be taken seriously in the current situation.

The decisive factor here is what was contractually agreed upon. Many standard contracts of German companies contain no hardship provisions or only rudimentary ones. Contracts in an international context are often better equipped in this regard.

What companies should do now

The current situation is a good opportunity to review existing supply contracts and templates for future contracts to ensure they are crisis-proof. Specifically, it is advisable to examine the following points:

1. Review existing contracts

• Are the purchase or sale prices fixed, or are adjustments permitted?
• Are customs risks particularly relevant – for example, for goods from the U.S. or China? Which party bears these risks?
• Do the contracts contain a force majeure clause, and how is it worded?
• Is there a hardship clause that might allow for an adjustment?

2. Draft new contracts to be future-proof

Anyone entering into new contracts today should keep the current uncertainties in mind when drafting them.

• Are fixed-price commitments appropriate, or can price adjustment clauses help?
• How broadly should a force majeure clause be defined? Is a force majeure clause suitable for covering the relevant risk?
• Clearly defined hardship provisions can help minimize risks – not only in international contracts.
• Aligning with international standards often facilitates the acceptance of proposals in international transactions.

Conclusion and Outlook

Contract law has long been characterized by stability, predictability, and the principle of pacta sunt servanda: contracts must be honored. The new geopolitical realities challenge this principle. However, contracts generally cannot be terminated at will in the event of unforeseen complications. Companies are therefore well advised to understand their contractual foundations – and to proactively shape them for the future before an emergency arises.

Although German courts have consistently taken a strict view of environmental advertising in the past – particularly regarding claims of “climate neutrality” or “CO2 offsetting” – as the confectionery manufacturer Katjes experienced in the landmark 2024 Federal Court of Justice (BGH) ruling, in which its advertising using the term “climate-neutral” was prohibited as misleading because the claim was not explained in a sufficiently understandable manner.

With the aforementioned amendment to the UWG, this standard is now being further tightened and codified into specific legal provisions.

Scope of Application and Implementation Effort

Important for practice: The new unfair competition regulations from the EmpCo Directive apply exclusively in the B2C sector, i. e., in the relationship between businesses and consumers. In B2B transactions, the previous general standards of the UWG remain in effect. Nevertheless, the scope of application is significant, as it covers all business practices – that is, any act, omission, or communication directly related to the advertising, sale, or delivery of a product to consumers.

The implementation costs for the business sector will therefore be considerable. The draft bill estimates annual compliance costs of approximately 52 million euros, as well as one-time transition costs of approximately 355 million euros. A one-time cost of approximately 178 million euros is estimated for the review and adaptation of product information alone. Companies should therefore begin reviewing their environmental claims at an early stage.

Categories of Environmental Practices

The amendment to the UWG introduces several categories of environmental claims, each of which is subject to its own set of regulations.
Specifically, this applies, among other things, to:

• “general environmental claims,” which, due to a lack of specificity on the same medium, pose a particular risk of misleading consumers;
• “sustainability labels,” which in the future must be based on a certification system or be established by the government;
• “future environmental performance,” i. e., statements regarding environmental performance not yet achieved that are linked to a robust implementation plan;
• statements regarding “offsetting of greenhouse gas emissions,” which will always be prohibited in the future when product-specific.

This article focuses on general environmental claims:

General environmental claims – vague and high-risk

A central regulatory objective of the EmpCo Directive is so-called “general environmental claims,” whereby “general” is to be understood as “non-specific” or “vague” in contrast to “specific environmental claims.” The draft bill for the UWG amendment defines a general environmental claim as

“an environmental claim made in writing or orally, including via audiovisual media, that is not contained in a sustainability label and for which the specification of the environmental claim is not clearly and prominently stated on the same medium.”

The key point, therefore, is that the claim is either not explained at all or, in any case, not explained in more detail on the same medium.

The explanatory memorandum to the UWG amendment cites – with reference to the recitals of the EmpCo Directive – various examples of general environmental claims, such as:

• “environmentally friendly,”
• “environmentally friendly,”
• “green,”
• “nature-friendly,”
• “ecological”,
• “environmentally sound”,
• “climate-friendly”,
• “environmentally compatible,”
• “CO2-friendly”,
• “energy-efficient”,
• “biodegradable” and
• “bio-based.”

Similar phrases are also covered, provided they suggest outstanding environmental performance or create a corresponding impression. According to the legislative rationale, these are typically short, catchy terms that, taken on their own, have no verifiable meaning based on objective criteria, but are particularly memorable to consumers due to their slogan-like nature. Brand names, company names, or company logos containing environmental terms may also be classified as general environmental claims.

The regulation of such general environmental claims is particularly strict. Consequently, general environmental claims will in the future be included in the so-called “UWG blacklist,” a list of commercial practices that the legislature deems unlawful without further ado.

Accordingly, general environmental claims directed at consumers are always prohibited if the business operator cannot demonstrate an underlying so-called “recognized outstanding environmental performance.”

This somewhat cumbersome phrase, “recognized outstanding environmental performance,” is defined as follows:

“an environmental performance in accordance with

a) Regulation (EC) No. 66/2010 (EU Ecolabel),
b) national or regional environmental labeling schemes in accordance with DIN EN ISO 14024 Type I, June 2018 edition, which are officially recognized in the Member States of the European Union, or
c) environmental best practices under other applicable Union law.”

As examples, the legislative rationale specifically mentions products certified with the EU Ecolabel, the German government’s “Blue Angel” label, or the Scandinavian “Nordic Swan” label.

In practice, this means: Anyone who wishes to continue advertising with general environmental claims must be able to prove that their product lawfully bears one of the aforementioned recognized environmental labels or meets the requirements for top environmental performance under EU law. If this proof cannot be provided, the claim is unfair per se and thus risks being subject to a warning letter with costs.

“Specific environmental claims” as a panacea?

However, the strict regulation of general environmental claims by no means implies that companies will have to refrain from any environmental advertising in the future.

The draft bill offers a clear solution: the use of specified, i. e., specific environmental claims. The key distinguishing criterion between a general and a specific environmental claim is whether the specification of the claim is clearly and prominently stated on the same medium. An environmental claim that is sufficiently explained and specified on the same medium – such as on the same product packaging, in the same television or radio commercial, or on the same online sales interface – is sufficiently explained and specified does not, under the legal framework, fall under the term “general environmental claim” and is therefore not subject to the per se prohibition of the blacklist provision.

The legislative rationale illustrates this distinction with the following illustrative example from the recitals of the EmpCo Directive (see figure).

The decisive difference lies in the fact that the statement on the right has verifiable, concrete content that enables the consumer to understand the environmental aspect, the relevant stage of the life cycle, and the specific claimed effect.

The requirements regarding the degree of specificity depend on the medium. The legislative rationale explicitly clarifies that the requirements also depend on the characteristics of the medium, such as the space available on the product packaging or the time available for a commercial. Thus, a detailed scientific explanation is not required in every case—but the core message must be concretely articulated in a comprehensible manner within the same medium. Merely providing a QR code through which further information can be accessed, however, is likely to be legally problematic on a regular basis.

Yet even if a specific environmental claim is less strictly regulated than a general environmental claim, it is – unsurprisingly – still not in a legal vacuum. This is because specific environmental claims are simply subject to the general requirements of the Unfair Competition Act (UWG) regarding all advertising claims: the specific environmental claim must therefore be factually accurate and must not mislead the recipient.

Finally, it is also always impermissible to make false claims regarding the scope of an environmental claim. This is the case, for example, when the claim applies only to a part of the product but is used in advertising for the entire product. In this case, a statement that would otherwise be classified as a specific environmental claim may nevertheless be impermissible in and of itself.

In addition, specific environmental claims must also comply with broader legal requirements, such as those regarding future and the prohibition of product-related CO2 offset claims.

Recommendations and Outlook

The effective date of the UWG amendment on September 27, 2026, is drawing nearer. Companies that advertise using environmental claims should promptly subject their entire product communication – from packaging and labels to online presence and advertising campaigns – to a comprehensive review and adapt it as necessary. Since no transition period is provided for products already on the market, existing products must also comply with the new requirements as of the effective date.

It is to be expected that once the new legal framework takes effect, competitors and, in particular, consumer protection organizations will strictly monitor compliance with the new regulations and issue costly warnings in cases of non-compliance.

In upcoming articles, we will take a closer look at further aspects of the EmpCo Directive – in particular, the practical requirements for sustainability labels, the new guidelines for claims regarding future environmental performance, and the implications of the ban on CO2 offset claims.

This provides ample reason to take a structured look from a legal practitioner’s perspective. In this segment more than most, recurring patterns, clear success factors, and standardisable solutions can be identified – provided the buy-and-build or roll-up strategy is conceived not as a transaction-driven exercise "on the fly", but with sufficient lead time, clear objectives, and the involvement of specialist advisers from the outset, then executed with discipline.

This three-part series therefore examines the recurring structures, key decisions, and practical solutions from a legal perspective, offering a compact overview of the critical success factors across the full lifecycle of a buy-and-build strategy.

1. What Buy-and-Build and Roll-Ups actually are – definition and mechanics

The terms buy-and-build and roll-up are frequently used interchangeably, particularly in the Anglo-American market. Both describe the systematic construction of a corporate group or platform through a series of coordinated acquisitions – add-ons or bolt-ons. The defining feature is this: even the first transaction is not conceived as a standalone deal, but as the starting point of a repeatable, scalable model designed from day one for continuation and serial acquisitions.

Where the market does draw a distinction, it tends to run as follows:

• Roll-ups in the narrower sense typically involve acquiring a large number of broadly comparable market participants in rapid succession – usually in regionally or functionally fragmented markets – with the platform often emerging as a pure holding structure.

• Buy-and-build in the narrower sense, by contrast, describes models where a defining core business is first acquired as the platform nucleus, with further add-ons then attached to it deliberately over time.

What both approaches share is that they are – in keeping with the classic PE model – typically exit-oriented, with holding periods of around three to seven years. Alongside these, longer-horizon models also exist: evergreen structures and cashflow compounders that nonetheless regularly provide exit options for individual investors, shareholders, or management.

One structural question that must always be answered for the specific model at hand is how tightly the operational and organisational integration of the group companies is to be designed. Some models pursue rapid and comprehensive integration; others deliberately preserve greater entrepreneurial autonomy for the acquired businesses. This foundational decision has direct consequences for structure, governance, contract design, and post-merger integration.

The economic logic of buy-and-build and roll-up strategies – touched on here only briefly – rests on several elements:

• accelerated inorganic growth;

• operational synergies and efficiency gains across products, processes, procurement, IT, HR, and legal functions;

• targeted market consolidation and market share gains; and

• valuation effects at group level – what the market calls multiple arbitrage.

The goal is to generate value creation that materially exceeds the mere sum of individual targets. For sellers, this also means the ability to achieve significantly higher purchase prices – typically expressed as EBITDA multiples – than a conventional trade sale within their own industry would yield.

The typical target sectors are those with fragmented markets characterised by small and mid-sized participants, often regional in footprint and not optimally scaled operationally. Examples range from IT and software services to healthcare-adjacent businesses, trades and craft services, and regulated professional service structures.

In 2025, the roll-up strategy has also made a significant mark on the venture capital and start-up world. A number of investors – General Catalyst and 8VC among them – have been acquiring mature, labour-intensive services businesses at scale, spanning customer services, legal services, accounting, and IT services, as well as start-ups, with the primary aim of fundamentally transforming service delivery through the platform-wide deployment of artificial intelligence. The goal is an AI-native platform that achieves margin structures that remain out of reach for conventional software vendors. In doing so, these strategies borrow heavily from the private equity playbook, and in these segments the boundaries between venture capital and private equity are increasingly blurring.

2. Success factors from a legal perspective

The emphasis on repetition and scalability is precisely what sets buy-and-build and roll-up strategies fundamentally apart from individual one-off transactions. The real challenge lies not in the first acquisition, but in building a model that is legally, organisationally, and operationally robust over the long term. A number of central success factors have emerged – each of which will be explored in greater depth in the subsequent parts of this series.

A clear platform structure that is sound from a regulatory, tax, and operational perspective – before the first add-on

Before the first bolt-on is executed, the structure on which the entire group will be built long-term should already be settled. This includes in particular the holding structure, the long-term financing logic, and the integration into the governance mechanisms of the financial investor. Equally important is how the structure connects with further elements: potential future seller rollover equity, possible co-investments by strategic partners such as industry experts, and incentive programmes for the operational team and, where relevant, key employees of add-on targets.

In regulated business areas, the central preliminary question is how to create a structure that is legally permissible on the longest possible horizon – ideally one already designed with headroom to adapt if the regulatory environment tightens.

Scalable acquisition documentation – including any rollover equity, earn-out, or bonus components – in place before the first add-on

Repetition is the core of these strategies. Accordingly, key transaction documents should be conceived early, modularly, and with a sense of proportion. It is therefore virtually essential – departing from the default logic of individual transactions – that the buyer rather than the seller provides the documentation, and that the buyer picks the notary, ideally one already familiar with the structure.

This encompasses:

• standardised term sheets, SPA/APA frameworks, and foundation documents – articles of association, shareholder agreements, service contracts – built with a modular structure and optional schedules;

• clear mechanics around liability and purchase price; and

• a robust, clearly communicable, and practically implementable framework for rollover equity, earn-outs, and management incentivisation.

The focus should be on creating a documentation package that is easy to understand for sellers – who are often first-time participants in such processes – adapted to the specific industry and its particular challenges, and stripped back to the essentials. The goal is not maximum rigidity, but a solid framework that forms the foundation for efficient add-ons. It is particularly important to involve the acquirer – typically the financial investor – substantively in designing the template documentation, for instance through workshops, so that sector-specific and target-group-specific factors are built in from the start.

Consistent, standardised execution of add-ons with efficient timelines and clear process discipline

Building on that documentation, the transaction strategy should then be executed as consistently as possible. This is supported by a pragmatically scoped due diligence focused on core concerns, together with clear roadmaps, timelines, and defined responsibilities.

The advantages of a well-prepared, repetition-oriented approach should be exploited systematically. This includes making the bulk of the pre-drafted documentation available to sellers at an early stage. It is also typically understandable – and accepted – by sellers that a business model designed for numerous parallel and efficient transactions cannot accommodate the renegotiation of every individual point or the creation of unnecessary complexity. Certain structures and processes are simply non-negotiable – an effect that grows stronger with each successive transaction and an expanding track record. The trade-off, as a rule, is a purchase price multiple meaningfully above what a trade sale in the same industry would deliver.

That said, deviations from the standard will arise in virtually every deal and will sometimes be warranted. The decision to deviate should always be made consciously, as a deliberate exception – not out of a lack of process discipline or negotiating inertia. Over time, it often becomes possible to define a "standardised" range of flexibility for certain points and hand that to the deal team and advisers to work with autonomously.

Fine-tuning after the first transactions

Few deal settings offer the same opportunity as these strategies to draw concrete conclusions and apply them to future add-ons. Ongoing attention should be paid to refining the due diligence scope, the individual transaction documents, and the communication and negotiation processes – continuously raising efficiency. It is particularly worthwhile to compile with advisers a running list of typical negotiation points and the corresponding parameters and solutions, enabling them to act autonomously and efficiently. Realistically, a first round of this kind of fine-tuning can take place after the third add-on – but it should then be repeated at planned intervals thereafter.

3. What follows in this series

Buy-and-build and roll-up strategies offer substantial opportunity and are successfully executed in practice across a wide range of contexts. What ultimately matters, however, is approaching execution in a structured and disciplined manner – with clear guardrails, scalable frameworks, and a realistic view of the people and organisations involved.

The remaining parts of this series explore these themes in depth.

• Part 2 addresses the platform as foundation – covering possible base structures, central governance decisions, and their implications for scalability and control.

• Part 3 examines the efficient execution of add-on transactions – including due diligence scoping, learnings on transaction documentation, managing deal-by-deal particularities, and the dynamics of negotiation.
  

Obligation to disclose major holdings of voting rights

Under the German Securities Trading Act (WpHG), anyone who reaches, exceeds or falls below 3%, 5%, 10%, 15%, 20%, 25%, 30%, 50% or 75% of the voting rights in a company whose shares are admitted to trading on an organised market (such as the regulated market on a German stock exchange), must notify the company and BaFin and publish this notification. This is intended to ensure that the company and the capital market are informed at an early stage of a stakebuilding and a potentially imminent takeover bid. To prevent circumvention (also known as ‘creeping in’), voting rights from shares owned by other persons are attributed to the person subject to the disclosure obligation on the basis of detailed attribution criteria.

Mandatory offer following acquisition of control

The acquisition of a major holding of voting rights also triggers certain obligations of the acquirer of control over a listed company as set out in the German Securities Acquisition and Takeover Act (WpÜG). This so-called bidder must immediately disclose the holding of 30% or more of the voting rights and offer to purchase the shares of the company’s other shareholders in return for adequate consideration (so-called mandatory offer). Voting rights held by other persons are also attributed to the bidder. In this context, the criteria for attribution (usefully) correspond to those applicable to voting rights notifications under the WpHG.

Acting in Concert

The attribution criterion of a so-called ‘acting in concert’ is of particular significance. Under German law, the voting rights of persons with whom a shareholder subject to the notification requirement or a bidder coordinates his conduct with respect to a listed company on the basis of an agreement or otherwise are attributed to that shareholder or bidder. Agreements in individual cases are exempted. According to the wording of the law, acting in concert requires an agreement on the exercise of voting rights or collaboration with the aim of bringing about a lasting and significant change in the company’s business strategy in any other way.

European law requirements

The requirements of different European directives apply to the obligation to disclose major holdings of voting rights and to mandatory offers. Voting rights disclosures are regulated in the Transparency Directive, mandatory offers in the Takeover Directive. In Germany, these have been implemented into national law in the WpHG and the WpÜG.

The ECJ ruling of 12 February 2026

According to the ECJ ruling, a provision of member state law resulting in the attribution of voting rights where the holders of voting rights coordinate their conduct in relation to the issuer in a manner other than on the basis of an ‘agreement’ concluded between them is contrary to European law. An exception applies to attribution directly related to takeover bids, mergers and other transactions affecting the ownership structure or control of companies. This is because such far-reaching attribution of voting rights is not only not provided for in the Transparency Directive. Member States are in fact expressly prohibited from imposing stricter rules on voting rights disclosure than those laid down in the Transparency Directive. There are only a few exceptions to this principle of maximum harmonisation, for example in relation to additional notification thresholds, stricter substantive requirements for voting rights notifications or – as set out by the ECJ – in direct connection with takeover bids and comparable corporate transactions.

The BaFin supervisory notice of 20 March 2026

BaFin subsequently announced on 20 March 2026 that, with immediate effect, it would only apply the aggregation of voting rights in relation to voting rights disclosure obligations in the cases provided for in the Transparency Directive. Specifically, this means:

1. Voting rights will only be attributed on the basis of an ‘acting in concert’ if the holders of voting rights coordinate on the consensual exercise of voting rights on the basis of an agreement that obliges the parties to pursue a common policy regarding the management of the issuer in question over the long term. So far BaFin has understood the term ‘agreement’ to encompass any form of contract under civil law. It must be legally binding, but the specific form is not relevant. A verbal agreement is therefore sufficient if the parties wish to be bound by it.
2. BaFin will no longer apply further attribution criteria not provided for in the Transparency Directive. In this regard, BaFin cites

• Section 34(1) sentence 1 no. 3 WpHG (voting rights arising from shares transferred as collateral) and
• Section 34(1), sentence 1, no. 5 WpHG (voting rights arising from shares that may be acquired on the basis of a declaration of intent – so-called ‘option in rem’).

The supervisory practice set out in Module 2 of BaFin’s Issuer’s Guide and the BaFin FAQs therefore no longer applies in this respect.

By contrast, the supervisory practice regarding the attribution of voting rights in connection with the acquisition of control pursuant to Sections 29, 30 of the WpÜG and a mandatory offer to be made thereafter remains unchanged. This means that the previous grounds for attribution, including the previous broader concept of ‘acting in concert’, continue to apply here without change.

Consequences

As a result of the ECJ ruling of 12 February 2026, the relevant statutory provisions on the attribution of voting rights under the WpHG are no longer applicable until further notice. Therefoe, some of the circumstances under which holdings are aggregated for voting rights notification requirements under the WpHG and for the acquisition of control under the WpÜG now differ. This presents increased challenges for investors subject to notification requirements and for issuers.

The BaFin supervisory notice applies “until an amendment in line with European law” is made to the attribution provisions. A corresponding adjustment of the voting rights notification obligations by the German legislator should be adopted as soon as possible in order to eliminate the complexity resulting from the ECJ ruling. A corresponding adjustment of the attribution criteria under the WpÜG should also restore alignment between the provisions governing voting rights notifications and the acquisition of control. The Takeover Directive does not preclude this, as it merely provides for the linking of the control triggering a mandatory offer to a voting rights threshold, whilst leaving the specific level and method of calculation to the national law of the EU Member States.

Further information:

• BaFin supervisory notice of 20 March 2026 (only available in German)
• ECJ judgment of 12 February 2026 in Case C-864/24
• Transparency Directive: Directive 2004/109/EC of 15 December 2004, OJ L 390, 31 December 2004, p. 38 (Transparency Directive); amended in particular by Directive 2013/50/EU of 22 October 2013, OJ L 294, 6.11.2013, p. 13 (Transparency Directive Amendment Directive).
• Regarding the Takeover Directive: Directive 2004/25/EC of the European Parliament and of the Council of 21 April 2004 on takeover bids, OJ L 142, 30.4.2004, p. 12.

Internationally structured corporate groups frequently employ cross-entity matrix structures in which executives of a foreign group company exercise supervisory functions vis-à-vis employees of a German subsidiary – not uncommonly exclusively by videoconference from abroad.

In practice, the question frequently arises as to whether and when the deployment of foreign group executives constitutes a co-determination-relevant "hiring" (Einstellung) within the meaning of Section 99(1) sentence 1 of the German Works Constitution Act (Betriebsverfassungsgesetz, BetrVG), thereby triggering the works council's right of consent. In a recent decision, the Federal Labour Court (BAG) has, for the first time, addressed a cross-entity and simultaneously cross-border matrix organisation and has specified the requirements for a hiring under works constitution law in this context.

Facts of the Case

The employer manufactures and distributes mass spectrometers and employs approximately 500 employees at its sole establishment in Germany. The company is part of a US-based corporate group which operates cross-entity matrix structures.

Four individuals were active in the German establishment who did not have an employment relationship with the employer but were employed by a group company domiciled abroad. They performed their duties for the employer's establishment exclusively by way of videoconferences. In relation to certain employees of the employer, they held supervisory functions and the right to issue instructions.

The works council took the view that the engagement of these four individuals constituted hirings within the meaning of Section 99 (1) sentence 1 BetrVG by virtue of their integration into the establishment, and applied for the judicial reversal of the personnel measures. The employer objected, arguing that the requisite right to issue instructions was lacking, as was sufficient collaboration between the four individuals and the employees working in the establishment.

The Labour Court of Bremen-Bremerhaven initially ruled in favour of the works council, and the Higher Labour Court (Landesarbeitsgericht, LAG) of Bremen also dismissed the employer's appeal.

Decision

The BAG overturned the decision of the LAG and remanded the case for a new hearing and decision. The key findings of the BAG can be summarised as follows:

First, the BAG confirmed that the scope of application of the BetrVG is open. Pursuant to the territoriality principle, Sections 99 et seq. BetrVG apply to all domestic establishments, irrespective of the employer's registered office, the registered office of the group parent company, or the legal system applicable to the individual employment relationship. The only relevant question is whether the person concerned is integrated into the establishment located in Germany.

At its core, however, the BAG held that the LAG had incorrectly assumed that, for the integration of executives employed by another group company (so-called matrix managers), it was irrelevant whether they themselves were subject to the instructions of the establishment owner (Betriebsinhaber). The BAG made unequivocally clear: a hiring within the meaning of Section 99(1) sentence 1 BetrVG always requires that the person concerned performs work subject to instructions and that the establishment owner holds at least a partial right to issue instructions – typical of an employment relationship – with respect to the content, place and time of the activity. This applies expressly also to executives in matrix structures.

The requisite personnel authority (Personalhoheit) of the establishment owner cannot be substituted merely by appointing intra-group executives as supervisors of the employees already belonging to the establishment.

Furthermore, the BAG criticised the LAG for having failed to make sufficient findings regarding the joint realisation of the establishment's operational purpose (arbeitstechnischer Betriebszweck). The mere finding that an executive holds a "right to issue professional instructions" (fachliches Weisungsrecht) is insufficient, as this is not a defined legal term and does not, in itself, establish whether the executive is in fact involved in the operational tasks and work processes of the establishment. Specifically, the executives must regularly collaborate with the employees working in the establishment in order to carry out the tasks assigned to them, thereby actually exercising their professional instructional authority. Conducting target agreement discussions or mere coordination of leave alone does not, in itself, permit the conclusion that the individual is integrated into the establishment.

At the same time, the BAG provided the LAG with several important guidelines for the new proceedings: for the question of integration, it is generally irrelevant how frequently or to what temporal extent the activities carried out in furtherance of the establishment's purpose take place. Neither quantitative nor qualitative minimum requirements can be derived from the statute. Likewise, it is not necessary for the person concerned to perform their work on the premises of the establishment or to be physically present to any minimum extent. The fact that the four executives reside abroad and work from there does not, in principle, preclude a hiring. Finally, simultaneous integration into multiple establishments is possible, as the BetrVG contains no provision that would preclude this.

Practical Implications

The decision is of far-reaching significance for the day-to-day advisory practice of internationally structured corporate groups with matrix organisations.

It is now established that the principles of works constitution law regarding integration also apply to matrix executives based abroad who are employed by a foreign group company. Employers deploying intra-group executives in a German establishment should therefore carefully assess whether and to what extent the German company, as the establishment owner, holds the employer-typical right to issue instructions vis-à-vis these executives that is required for integration.

Where the German subsidiary lacks at least partial personnel authority – which is frequently the case in practice where the management level of the German company is hierarchically positioned below the foreign executives – a co-determination-relevant hiring is precluded on this ground alone. The mere coexistence of employee groups of different group companies within a single establishment does not, in itself, give rise to a co-determination right of the works council under Section 99 BetrVG.

On the other hand, the BAG deliberately sets a low threshold for affirming integration: neither a minimum temporal extent of the activity nor physical presence in the establishment is required. Even an activity carried out exclusively by videoconference from abroad may constitute a hiring, provided the remaining requirements are met.

The decisive factor remains the overall assessment of all circumstances of the individual case, focusing on the specific involvement in the operational tasks and work processes of the establishment.

Questions that remain open after the decision include, among others, what degree of subordination to instructions is sufficient in the individual case and whether, in addition to the right to issue professional instructions, the establishment owner must also hold a disciplinary right to issue instructions vis-à-vis the executive.

Employers with matrix structures should closely monitor the further development of case law and review their intra-group personnel organisation in light of these new principles.

In its decision of December 2, 2025 (Ref. 9 AZB 3/25), the Federal Labour Court ruled that a plaintiff serving as the general director of a municipal theatre is an employee within the meaning of Section 5 (1) sentence 1 of the German Labour Court Act (ArbGG) and Section 611a of the Civil Code (BGB). Despite extensive artistic freedom in shaping the repertoire, casting roles, and assigning directing duties, the Federal Labour Court affirmed the plaintiff’s employee status, as the artistic director’s contract, in conjunction with the municipal theatre’s bylaws and rules of procedure, established comprehensive subordination to instructions and external control. A decisive factor was that the mayor, as the superior, exercised process-oriented legal supervision and, in the event of a conflict, had comprehensive powers of intervention that could override the decisions of the general artistic director.

A. Facts of the Case

The parties are in dispute over the admissibility of legal action before the Labour Courts in the context of an unfair dismissal proceeding.

The plaintiff worked as General Director (1st Artistic Director) of a theatre operated as an independent agency of the defendant city for a period of five years on the basis of a “Director’s Contract” concluded on July 7, 2021. He was responsible, in particular, for independently designing the program, casting roles, and assigning directing and conducting duties. In addition, the plaintiff – in agreement with the administrative director – was responsible for concluding and terminating contracts, in particular permanent employment and service contracts, as well as for concluding, renewing, or not renewing fixed-term employment or service contracts. The plaintiff received a gross monthly salary of €15,000.00 plus an annual bonus amounting to 60% of a gross monthly salary.

The artistic director’s contract provided that, while the plaintiff was subject to the legal supervision of the mayor as his employer, he was not subject to the mayor’s technical supervision with respect to artistic decisions. The plaintiff was required to report and obtain approval for secondary employment and to submit a certificate of incapacity for work before the end of the third day of incapacity. He was entitled to continued pay in the event of illness for up to six weeks, as well as to 45 calendar days of paid vacation annually, which had to be reported to the legal entity and was generally to be taken during the theatre’s vacation period. However, he was not required to document his daily working hours. The plaintiff was also not required to use the office provided to him.

Together with the Administrative Director, the General Director formed the theatre’s two-person management team. The in-house operating bylaws and rules of procedure referenced in the contract governed the organization of the theatre, the duties of the management team, and the powers of the management committee and the mayor as the employer in detail.

The defendant city terminated the contractual relationship with the plaintiff without notice by letter dated August 1, 2024. The plaintiff subsequently filed an action for unfair dismissal with the Erfurt Labour Court and asserted a claim for continued employment.

The defendant challenged the admissibility of the legal action before the Labour Courts and moved for referral to the Regional Court on the grounds that the plaintiff was not an employee within the meaning of Section 5 (1) sentence 1 of the German Labour Court Act (ArbGG) and Section 611a of the German Civil Code (BGB), but had been working under a freelance contract.

The Erfurt Labour Court (see decision of Oct. 30, 2024 – 5 Ca 1430/24) and – subsequently, on appeal – the Thuringia Regional Labour Court (decision of Jan. 27, 2025 – 2 Ta 81/24) affirmed the plaintiff’s status as an employee and the jurisdiction of the Labour Courts.
With the admitted appeal, the defendant continued to pursue before the Federal Labour Court the referral of the legal dispute to the Regional Court that it sought.

B. Reasons for the Decision of the Federal Labour Court

The Federal Labour Court dismissed the appeal as unfounded, classifying the plaintiff, who was employed as a general director, as an employee within the meaning of Section 5 (1) sentence 1 of the German Labour Court Act (ArbGG) and Section 611a of the German Civil Code (BGB), and consequently affirming the jurisdiction of the Labour Courts.

In the opinion of the Federal Labour Court, the present case concerns a civil dispute between an employee and an employer arising from an employment relationship, such that, pursuant to Section 2 (1) No. 3 lit. a) of the German Labour Court Act (ArbGG), the Labour Courts have jurisdiction.

I. Not a “sic non” case

The Federal Labour Court first confirmed the Regional Labour Court’s view that this is not a so-called “sic non” case, in which the claim can only be well-founded if the legal relationship is classified as an employment relationship, such that the mere assertion of this legal claim opens the legal avenue to the Labour Courts. Since the validity of the extraordinary termination would also have to be reviewed under the standard of Section 626 of the German Civil Code (BGB) even within the context of a contract for services, the success of the main claim does not depend on the plaintiff’s status as an employee. The mere legal assertion of being an employee is therefore insufficient to establish the jurisdiction of the Labour Courts.

II. No Application of Section 5 (1) Sentence 3 of the German Labour Court Act (ArbGG)

In the opinion of the Federal Labour Court, the plaintiff is also not a legal representative of the defendant city within the meaning of Section 5 (1) sentence 3 of the German Labour Court Act (ArbGG). As the first plant manager and a member of the management of the municipal enterprise, he did not represent the city as a legal entity, but merely in matters concerning the municipal enterprise established by it, subject to the instructions of the mayor as the city’s actual legal representative.

III. Definition of “employee” under Section 5 (1) sentence 1 of the German Labour Court Act (ArbGG), 611a of the German Civil Code (BGB)

In assessing whether the plaintiff is an employee within the meaning of Section 5 (1) sentence 1 of the German Labour Court Act (ArbGG), the Federal Labour Court based its decision on the definition of an employee codified in Section 611a of the German Civil Code (BGB). According to this provision, an employee is a person who, on the basis of a contract under private law, is obligated to perform work subject to instructions and external control in a relationship of personal dependence in the service of another. The right to issue instructions may concern the content, performance, time, and place of the work. A person is subject to instructions if they cannot, in essence, freely organize their work or determine their working hours. The degree of personal dependence also depends on the nature of the respective activity. To determine whether an employment contract exists, an overall assessment of all circumstances must be made. If the actual performance of the contractual relationship indicates that it is an employment relationship, the designation in the contract is irrelevant.

The Federal Labour Court clarified that the right to issue instructions under an employment contract is characterized by being person-specific and process-oriented – in contrast to the task-specific and results-oriented instructions given to a self-employed person. To determine whether an employment relationship exists, a comprehensive assessment of all circumstances must be made, taking into account constitutional considerations, in particular the freedom of the arts under Art. 5 (3) of the Basic Law (see BAG 30 Nov. 2021 – 9 AZR 145/21, NZA 2022, 623, para. 36 et seq.). An employment relationship can only be assumed if the circumstances indicating personal dependence are given sufficient weight within the required comprehensive assessment or if they characterize the legal relationship (see BAG Dec. 1, 2020 – 9 AZR 102/20, NZA 2021, 552). If the actual performance of the contractual relationship indicates that it is an employment relationship, the designation in the contract is irrelevant (see BAG 17 Dec. 2024 – 9 AZR 26/24, NZA 2025, 1243, para. 20 et seq.).

IV. Subordination to Instructions Despite Artistic Freedoms

Despite the far-reaching freedoms in the artistic sphere, the Federal Labour Court affirmed the plaintiff’s obligation to follow instructions. The artistic director’s contract provided for comprehensive legal supervision by the mayor as the superior, which could extend not only to work results but also to procedural processes. The right to issue instructions was thus also process-oriented. The rules of procedure provided for a comprehensive right of intervention by the mayor in the event that the general director and the administrative director, as the responsible heads of the institution, could not reach an agreement, including in matters left to their independent discretion. In the event of a conflict, the mayor could therefore fully override the general director’s decision.

V. External Control Through Organizational Integration

The Federal Labour Court further found that the plaintiff’s work was subject to external control due to his integration into the theatre’s organization, which was strongly oriented toward the division of Labour. The theatre’s management structure provided for close cooperation between the General Director and the Administrative Director, as well as oversight by the Mayor and the Theatre Committee, whose decisions could override those of the General Director in the event of a conflict. The administrative director, too, could ensure in all areas that the mayor’s decision superseded that of the general director. In addition, close cooperation and coordination with the theatre’s works committee was required, as the committee could demand information from the theatre management at any time regarding the conduct of business and the status of the municipal enterprise. The obligation to report and obtain approval for secondary employment, as well as the requirement to submit a certificate of incapacity for work starting on the third day of illness, further underscored the integration into the operational organization.

VI. Overall Assessment

In its comprehensive assessment, the Federal Labour Court concluded that the mayor’s authority to issue instructions and the degree of external control resulting from the plaintiff’s close integration into the theatre’s work organization carry significant weight and do not allow the work to appear essentially independent. In contrast, factors that would suggest a freelance relationship – such as the freedom to organize one’s own working hours and the lack of a specified workplace – take a back seat. The distinctive feature of the case lies in the fact that, in the event of a conflict, the administrative director could secure decisions from other bodies in all areas of responsibility, significantly restricting the artistic director’s freedom. Even the freedom of the arts under Article 5(3) of the Basic Law and a potentially stricter standard of review cannot, in the opinion of the Federal Labour Court, alter this, since the nature of the work, due to the contractual arrangement, does not prove to be so independent that the legal relationship could be regarded as a freelance arrangement. The Federal Labour Court emphasized that the specific nature of the General Director’s work does not have a decisive influence on the classification of the legal relationship, since the work can be performed, depending on its structure, both within the framework of an employment relationship and within the framework of a freelance service relationship.

Since the interpretation of the contract (pursuant to Sections 133 and 157 of the German Civil Code) already establishes the existence of an employment relationship, the question of the actual performance of the contract is irrelevant in the present case.

C. Practical Note

The decision makes clear that the classification of a worker as an employee or an independent contractor does not depend on the contractual designation or the nature of the work, but solely on the specific factual structure of the contractual relationship. The decisive factor is whether the employer’s right to issue instructions is structured in a manner that is more personal and process-oriented – and thus typical of an employee – or more task-oriented and results-oriented.

Contracts that – as in the present case – provide for comprehensive legal supervision as well as far-reaching rights of intervention by the employer and integrate the worker into a highly division of labour-oriented organizational structure regularly lead to a finding of employee status – even if there are far-reaching freedoms in the core artistic area. Nor can the freedom of the arts under Article 5 (3) of the German Basic Law (GG) compensate for de facto integration typical of an employee.

The decision is likely to have a ripple effect beyond the specific case on comparable situations in the cultural and creative industries – such as managerial positions at other cultural institutions, festival directors, or museum directors in similarly division-of-Labour-based organizational structures. Legal entities of cultural institutions should review their existing organizational structures and, if necessary, adapt them to avoid the unintended classification of a contractual relationship as an employment relationship – or consciously accept the consequences of an employment relationship, in particular the applicability of the Unfair Dismissal Protection Act, the Continued Remuneration Act, and other protective provisions under Labour law.

For companies, this increasingly raises the question of the direction in which European digital law is evolving and whether the announced relief will actually materialize or whether new uncertainties will arise. The following overview highlights current developments regarding the Data and AI Omnibus and assesses their practical relevance.

I. Background and Objectives

The European Commission’s omnibus initiatives are set against the backdrop of increasingly complex and fragmented digital regulation. In recent years, key legislative acts – including the GDPR, the Data Governance Act, the Data Act, and the AI Regulation – have been developed and adopted, in some cases in parallel, without their interactions being consistently coordinated. As a result, companies are frequently confronted with overlapping obligations, unclear demarcation issues, and increased compliance burdens.

Against this backdrop, the Commission’s omnibus proposals aim to selectively adapt existing regulations, better align them with one another, and improve their practical applicability. The focus is particularly on reducing bureaucratic burdens and promoting innovation, especially in the areas of data-driven business models and artificial intelligence. At the same time, it is clear that the planned adjustments are not merely technical in nature but concern key policy decisions in European digital law.

II. Data Omnibus

The proposal for a “Digital Omnibus” represents the first concrete intervention in the regulatory framework of the GDPR since its entry into force. The goal is to modernize the regulation in specific areas, integrate it more closely with related regulations – particularly the Data Act and the AI Regulation – and, at the same time, reduce practical implementation challenges.

1. Planned Changes

In terms of content, the planned changes focus primarily on three areas: First, the central concept of “personal data” is clarified, with future provisions placing greater emphasis on concrete identifiability by the respective data recipient . Second, it is clarified that the processing of personal data for the training, testing, and validation of AI systems may, in principle, be based on a legitimate interest. Third, a limited exception is introduced for the processing of special categories of personal data in the AI context, provided that such processing is unavoidable and not targeted.

Accompanying adjustments are planned, such as clarifying specific definitions (e. g., health data), easing transparency and reporting obligations, and further harmonizing procedural requirements in conjunction with other digital legislation.

2. Current Status

The Digital Omnibus is currently still undergoing the legislative process at the EU level. The Commission’s proposal from November 2025 is currently being debated in the European Parliament and the Council. In parallel, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) submitted a joint opinion in February 2026 that is significantly shaping the further legislative process.

While the supervisory authorities expressly support the goal of simplifying and harmonizing the digital legal framework, they simultaneously voice significant criticism of key elements of the proposal. The focus is particularly on the planned amendment to the definition of “personal data.”

The Commission bases this adjustment primarily on a recent ruling by the ECJ (Case C-413/23 P – EDPS v. SRB). In this decision, the Court clarified that data is not considered personal data for a specific recipient if that recipient cannot identify the data subject using “means reasonably available to them.” At the same time, however, the ECJ emphasizes that data can regain its personal character as soon as it reaches a recipient who has the means to identify the data subject.

This is precisely where the criticism begins: The Omnibus Proposal addresses this case law only selectively and, in the view of the EDPB and EDPS, goes significantly beyond it. In particular, the proposed clarification that data should not be considered personal merely because another recipient could identify it contradicts the CJEU’s case law.

The supervisory authorities see this as a significant threat to the level of protection afforded by data protection law. The proposed redefinition would noticeably narrow the scope of the GDPR and could incentivize companies to deliberately structure data processing in such a way that it formally falls outside the scope of the regulation. Furthermore, new difficulties in defining boundaries would arise, leading not to greater legal certainty, but to less.

Further points of criticism relate in particular to:

• Pseudonymization: The planned option to determine, through implementing acts, when pseudonymized data no longer qualifies as personal data is viewed as contrary to the system, as this affects the core area of data protection law.
• AI-specific exemptions: While it is acknowledged that practical challenges exist, for example, in the training of AI systems, the proposed blanket exemptions (e. g., regarding legitimate interests or sensitive data) are deemed too vague and potentially threatening to fundamental rights.
• Protection of fundamental rights: Overall, the proposal is criticized for going beyond a mere “technical simplification” in some respects and potentially resulting in substantial changes to the level of protection provided by the GDPR.

As a result, the interim assessment is therefore ambivalent: While individual simplifications—such as regarding reporting obligations or in the research sector - are viewed predominantly positively, the encroachments on core concepts of data protection law in particular raise significant concerns. Against this backdrop, extensive revisions are still to be expected in the further legislative process.

III. AI Omnibus

1. Planned Changes

In terms of content, the planned changes in the AI Omnibus focus primarily on three areas. First, overlaps between the AI Regulation and other regulatory frameworks – particularly the GDPR – are to be reduced, and questions of demarcation are to be clarified. Second, simplifications are envisaged for the development and deployment of AI systems, for example regarding the handling of training data and risk-based requirements. Third, the proposals aim to simplify compliance and conformity procedures, particularly through standardization and reduced documentation requirements. Additionally, closer integration with existing sector-specific regulations and supervisory structures is planned.

2. Current Status

The AI Omnibus is also currently undergoing the legislative process. Following the publication of the Commission’s proposals in November 2025, the Member States have already agreed on a common Council position; in the European Parliament, the lead committees (IMCO and LIBE) have adopted a compromise text. The plenary vote is imminent, after which trilogue negotiations are set to begin.

In terms of content, the discussion remains highly contentious. At the center of the debate is, in particular, the question of whether and to what extent certain sectors should be exempted from key requirements of the AI Regulation. The Parliament’s proposal aims to remove parts of the scope of application – particularly in the area of already regulated product sectors – from the direct application of the AI Act or to transfer them to other regulatory mechanisms.

However, it is precisely these approaches that have drawn significant criticism. For one thing, representatives of the certification and standardization industry warn of a structural weakening of the risk-based approach of the AI Regulation. In particular, postponing or removing key provisions in Annex I could result in large portions of industrial AI systems no longer being directly subject to the requirements of the AI Act. This would undermine the uniform regulation sought thus far and lead to a fragmentation of the legal framework.

On the other hand, there are fears that the proposed changes will lead not to less, but to more bureaucracy and legal uncertainty. If requirements were increasingly shifted to sector-specific regulations in the future, these would first have to be specified through additional legislative acts. This would delay the implementation process and further complicate the regulatory landscape.

Significant risks are also seen with regard to standardization: ongoing work on harmonized AI standards could be partially undermined or would need to be adapted, which would lead to further delays. Additionally, there is a risk of losing expertise if key application areas fall outside the scope of the regulation.

Finally, there is no unified political stance either. While parts of Parliament and industry welcome the proposed exemptions as a necessary step to avoid double regulation, other voices – including national governments – warn against lowering the level of protection and weakening the horizontal structure of the AI Regulation.

IV. Impact on Practice

The current drafts of the Data and AI Omnibus should be understood less as deregulation and more as a realignment and, in some cases, a shift in existing regulatory priorities. The practical effects are particularly evident in the following areas:

1. Increasing relevance of classification decisions in data protection

The proposed realignment of the concept of personal data shifts a significant portion of compliance to the upstream qualification decision. For companies, this means that in the future, it will be necessary to examine and document even more rigorously whether and for whom a personal reference actually exists.

In practice, this does not lead to a blanket reduction in burden, but rather to higher requirements for data classification, technical access controls, and documentation. Particularly in the case of data processing involving a division of labor (e. g., cloud, platforms, AI training), it will be crucial to determine which actors have the means to re-identify individuals. Companies should therefore map their data flows in granular detail and clearly separate the respective perspectives of individual processing units.

2. More leeway in AI training

The explicit inclusion of legitimate interest for AI training points to greater flexibility in the future. At the same time, the focus is shifting toward the qualitative nature of the balancing of interests.

In practice, this means that companies cannot rely on a “blanket” legal basis but must comprehensively justify and safeguard their training processes. This includes, in particular, transparent definitions of purpose, technical safeguards (e. g., against data leaks or regurgitation), as well as robust arguments regarding the benefits and foreseeability of the processing. The requirements for internal documentation and governance are thus likely to increase, even if consent processes could be reduced in the future.

3. Risk of Fragmented AI Regulation Due to Sectoral Exemptions

The sectoral exemptions discussed in the AI Omnibus have potentially significant practical implications. Should entire industries be excluded from the direct scope of the AI Regulation, this would disrupt the previously uniform legal framework.

Companies would then face the challenge of having to account for different regulatory frameworks simultaneously, depending on whether an AI system falls under the AI Act or under sector-specific product law. Rather than simplifying matters, this could lead to additional coordination needs between compliance, product, and regulatory teams.

V. Conclusion and Outlook

The omnibus initiatives clearly demonstrate that European digital law is in a phase of realignment. The aim of simplifying existing regulations and better aligning them with one another faces fundamental conflicts of interest – particularly between promoting innovation and maintaining high standards of protection.

In the case of both the Data and AI Omnibus initiatives, it is already clear at this stage of the proceedings that key proposals are politically contentious and may undergo significant changes in the further legislative process. In particular, the discussion regarding the personal nature of data in data protection as well as sectoral exemptions within the scope of the AI Regulation is likely to shape further negotiations.

In practice, this means that no fundamental relief is to be expected in the short term. Rather, a transitional phase is to be anticipated in which regulatory guidelines are only just emerging. In the long term, however, the omnibus initiatives could contribute to a clearer structure and better integration of European digital law.

This article was created in collaboration with our student employee Emily Bernklau.

In a press release, marking the publication of the new General Export Authorization 48 (GEA 48), the Federal Minister for Economic Affairs Katherina Reiche stated:

“Iran's indiscriminate attacks on the Gulf states have created an urgent need for military equipment there, particularly for air defense. At the same time, Ukraine's need for military support, especially for air defense, remains as urgent as ever. With the new, temporary GEA 48, we are adapting our arms export control procedures for the export of urgently needed military equipment to these countries to meet the new requirements. In doing so, we are ensuring swift and unbureaucratic exports to strengthen their defense systems and are thus sending a signal of solidarity.”

GEA 48 has been in force since March 20, 2026, and is valid for six months until 15 September 2026.

What is a General Export Authorization (GEA)?

General Export Authorizations are a type of export license that have the same legal effect as individual licenses but do not require a prior application to the Federal Office for Economic Affairs and Export Control (BAFA). Instead, they are issued by BAFA, publicly announced and henceforth apply to all exports and transfers that meet the conditions specified in the respective GEA.

As a result, exporters can carry out transactions covered by a GEA immediately, ensuring both speed and planning certainty for the duration of the authorization.

Scope of the GEA 48

GEA 48 defines its scope of application with reference to the types of goods it covers, their intended use, and the authorized recipients and destinations.

Authorized Goods

GEA 48 applies to the export and transfer with subsequent export of goods listed in Part I Section A of the Export List, provided that such goods are supplied by a domestic exporter and are intended for use in air and maritime defense.

Further, the authorization only applies where the goods are supplied to recipients who (i) belong to the armed forces of an authorized destination country or (ii) act as a contracting authority in the defense sector and make the purchase exclusively for use by those armed forces. In individual cases, deliveries to other recipients may also be carried out under GEA 48.

Certain categories of sensitive military goods and technologies are excluded from the scope of GEA 48. This also includes goods classified as war weapons, unless the exporter or shipper has obtained a license under the War Weapons Control Act for the specific export or transfer.

Permitted Destinations

GEA 48 applies to exports to Bahrain, Qatar, Kuwait, Oman, Saudi Arabia, the United Arab Emirates, and Ukraine, as well as to transfers within the European Union, provided that the transferor is aware that the goods will subsequently be exported to one of the aforementioned destinations for defense purposes covered by GEA 48.

Key Compliance Requirements

GEA 48 is subject to a number of detailed ancillary provisions set out by BAFA. These include, in particular, the following obligations:

• Registration: Exporters intending to rely on GEA 48 must register as users with BAFA via the ELAN-K2 portal prior to the first export or transfer, or within 30 days thereafter.
• Reporting Obligations: Exports and transfers carried out under the authorization must be reported to BAFA on a monthly basis via the ELAN-K2 portal.
• Record-Keeping requirements: Exporters and transferors must retain all documentation relating to the use of the GEA 48 for at least three years following the end of the calendar year in which the export or transfer took place.

Key Grounds for Exclusion

GEA 48 sets forth a number of grounds for exclusion, under which the authorization cannot be relied upon. These include, among others, exports followed by re-export to unauthorized destinations, cases where the goods are intended to support Russia’s war of aggression, as well as circumstances where BAFA requires individual licensing.

Practical Implications and Navigating Requirements with HEUKING

GEA 48 provides significant procedural relief by enabling faster exports in situations where defense equipment is urgently required. In particular, it facilitates deliveries to Ukraine and selected Gulf states without the delays associated with individual licensing procedures, thereby offering greater flexibility and planning certainty for exporters operating in this space.

At the same time, the strict licensing conditions and detailed compliance requirements applicable to the GEA 48 should not be underestimated. Companies should assess, at an early stage, whether their goods actually fall within the scope of GEA 48 and ensure that its requirements are properly implemented. In the event of a violation, the GEA 48 may be revoked, and regulatory and criminal penalties may apply. To prevent this, thorough assessment and robust internal compliance processes are essential.

We regularly advise clients on the application of export control laws and on the implementation of internal processes to ensure compliance with German and European export control requirements. In addition, we assist you with registration and reporting obligations and provide support in situations where compliance issues have arisen. Furthermore, we advise on transaction-specific risks associated with the export of goods, enabling you to make optimal use of the GEAs published by BAFA within the framework of your export process.

The FRiG serves to implement various EU directives and, in particular, makes far-reaching amendments to the German Capital Investment Code (hereinafter “KAGB”). A particular focus of the FRiG in this context is the introduction of requirements for lending by AIFs and the mandatory selection of, in principle, two “liquidity management instruments” for open-ended investment funds.

However, beyond merely implementing new EU requirements, the FRiG also introduces additional amendments to the KAGB that are, at least in part, welcome from the perspective of the investment industry. These include, in particular, the long-awaited introduction of closed-end funds in contractual form in the public fund sector – a development the industry has long advocated for – and the newly introduced dilatory defense under Section 93 (3a) of the KAGB, as amended.

Selected amendments to the KAGB resulting from the FRiG are outlined below.

Stricter requirements for KVG managing directors; Section 23 No. 2a KAGB (as amended)

Pursuant to Section 23 No. 2a of the KAGB (as amended) a capital management company must be denied authorization if there are facts indicating that the two required managing directors are not employed on a full-time basis (i. e., at least 40 hours per week) by the respective capital management company. Furthermore, the two required KVG managing directors must in the future be resident in the European Union.

In practice, KVG managing directors have often worked for and been employed by other companies – particularly group companies – and continue to do so. This necessarily required the affected managing director to divide their working hours among these entities. Even though the issue of the availability of KVG managing directors – at least in cases of very heavy workloads – has been discussed by the Federal Financial Supervisory Authority (hereinafter “BaFin”) in its supervisory practice in the past, the mandatory requirement of full-time employment for KVG managing directors is new.

However, the legislative rationale for the FRiG leaves a small loophole regarding the full-time requirement. According to this, in corporate group structures, it may occur in practice that there is partial overlap in the identities of the managing directors. The example cited here is a situation where, for instance, two capital management companies belong to a corporate group. According to the legislative rationale for the FRiG, such a scenario may continue to be considered permissible following a review of the individual case. Outside of group-related situations, however, the legislative rationale for the FRiG does not provide for the possibility of a deviating decision on a case-by-case basis.

Whether a third or additional managing director must then also be employed on a full-time basis cannot be unequivocally determined from Section 23 No. 2a of the KAGB (as amended). In discussions with industry associations, BaFin has expressed the view that in situations where there are more than two managing directors, departments may also be managed on a part-time basis. The combined workload of all managing directors must amount to two full-time equivalents (i. e., a cumulative total of 80 hours per week).

Furthermore, according to BaFin statements, grandfathering provisions are to apply to those capital management companies that do not have two managing directors residing in the EU prior to the entry into force of the FRiG on April 16, 2026. However, should changes occur in the management after April 16, 2026, the new requirements regarding the residence of the managing directors must be observed.

Lending by AIF Capital Management Companies; Section 29a et seq. KAGB (as amended)

In particular, the newly added Section 29a KAGB (as amended) and Section 29b KAGB (as amended) serve to establish uniform regulations within the EU for AIFs and their capital management companies that grant loans. In this context, the focus is, among other things, on maximum credit limits for certain borrowers such as financial firms (see Section 29a (3) KAGB, as amended) and the prohibition on granting loans to certain market participants, such as the AIF’s depositary (see Section 29a (7) KAGB, as amended).

However, certain provisions of the KAGB regarding the regulation of lending apply only to the category of “lending AIFs” newly introduced into the KAGB. “Lending AIFs” are, pursuant to Section 1(19) No. 24d of the KAGB (as amended), AIFs whose investment strategy consists primarily of granting loans or whose granted loans reach a nominal value amounting to at least 50 % of the AIF’s net asset value. Not every AIF that grants loans is therefore automatically a “lending AIF” within the meaning of the KAGB.

For example, the provision of Section 30 (3a) of the KAGB, as amended, applies only to lending AIFs. Accordingly, an AIF capital management company must ensure that the lending AIFs it manages are closed-end funds. Notwithstanding this, a lending AIF may be an open-ended fund provided that the AIF capital management company managing it can demonstrate to BaFin that the AIF’s liquidity risk management system is consistent with the investment strategy and redemption policy of the AIF capital management company.

Furthermore, with regard to open-ended lending AIFs, a leverage cap of 175 % applies pursuant to Section 29a (5) of the KAGB (as amended), and for closed-end AIFs, a cap of 300 % of the ratio of the AIF’s risk – calculated using the so-called “commitment method” – to its net asset value.

Pursuant to Section 29b (1) of the KAGB , as amended, capital management companies must make withholdings if a loan granted by an AIF is subsequently transferred to third parties. Accordingly, an AIF capital management company must ensure that an AIF it manages withholds 5 % of the nominal value of the relevant loans. This percentage is retained until maturity for loans with a term of up to eight years. For other loans, the aforementioned percentage must be retained for at least eight years. Exceptions to this are regulated in Section 29b (2) of the KAGB (as amended), such as in connection with the dissolution of a fund.

The granting of loans by AIFs to consumers within the meaning of Section 13 of the German Civil Code (BGB) is generally prohibited by the newly added Section 16a of the KAGB (as amended), as was already the case under the provision of Section 285 (2) No. 2 of the KAGB (as previously in force), which was repealed by the FRiG.

In this context, the FRiG also expands the definition of collective asset management in Section 1 (19) No. 24 of the KAGB to include the granting of loans by AIFs and the management of securitization special-purpose entities.

For the application of the provisions of Section 29a of the KAGB (as amended) and Section 30 (3a) of the KAGB (as amended) to existing funds that grant loans, the transitional provision of Section 367 of the KAGB (as amended) must be observed. For example, in the case of lending AIFs that were established before April 15, 2024, and that do not raise additional capital after April 15, 2024, it is assumed that they comply with the maximum leverage limits pursuant to Section 29a (5) of the KAGB, as amended.

Selection of Liquidity Management Instruments for Open-Ended Investment Funds; Section 30a KAGB (as amended)

The FRiG provides for the insertion of Section 30a KAGB (as amended) into the KAGB, which concerns the selection of liquidity management instruments (hereinafter also “LMTs”) for the management of open-ended investment funds. Accordingly, a capital management company must select at least two suitable LMTs from a specified list for each open-ended investment fund it manages. Notwithstanding this, in the case of money market funds, it is possible to select only one suitable LMT; see Section 30a (3) of the KAGB, as amended.

According to the statutory definition in Section 1 (19) No. 25a of the KAGB (as amended), LMTs include (i) the suspension of unit issuance, subscriptions, repurchases and redemptions (ii) redemption restrictions (iii) the extension of redemption periods (iv) the redemption fee (v) swing pricing (vi) dual pricing, (vii) a dilution protection fee, (viii) distribution of assets in kind, and (ix) the spin-off of illiquid investments.

Consequently, all open-ended investment funds – including existing funds – must have at least two operational LMTs in place by April 16, 2026, and must also stipulate this in their investment terms and conditions.

Section 366 (1) of the KAGB, as amended, provides for certain exemptions regarding the necessary adjustment of the investment terms for existing funds. In this regard, for UCITS or domestic open-ended public AIFs, the application for approval of the amended investment terms may, in addition to editorial changes, include only those changes to the investment terms that are necessary to comply with the requirements of the version of the KAGB effective as of April 16, 2026. In this case, certain requirements for amending the investment terms do not apply, meaning, for example, that investors do not have to be offered the option to redeem their shares in this context.

The investment terms and the information pursuant to Section 307 (1) and (2) of the KAGB for domestic open-ended special AIFs must also be adapted to the version of the KAGB effective as of April 16, 2026, by April 16, 2026. From a thematic perspective, this will focus in particular on the possibilities and conditions for the use of the selected liquidity management instruments.

According to BaFin statements, the implementation of detailed strategies and procedures for the activation and deactivation of the selected liquidity management instruments pursuant to Section 30a (2) sentence 2 of the KAGB (as amended) implies that the management company must inform investors of such activation or deactivation (e. g., via a website).

Right of defense under Section 93 (3a) of the KAGB (as amended)

A new paragraph 3a is inserted into Section 93 of the KAGB, granting capital management companies a temporary right to refuse performance in the management of funds in contractual form. Pursuant to Section 93 (3a) of the KAGB (as amended), the capital management company in question may refuse to fulfill obligations arising from legal transactions conducted on behalf of the investors of a fund in contractual form for as long and to the extent that the capital management company cannot satisfy its obligations from the fund in contractual form. Although attempts have regularly been made to date to negotiate a corresponding right of defense for the capital management company in individual contracts, this could not be enforced in all cases in practice.

The new defense option under Section 93 (3a) of the KAGB (as amended) is structured as a so-called “dilatory defense,” which only temporarily suspends the enforcement of the claim and leaves the existence of the claim unaffected. The defense can therefore only be raised as long as the special fund’s liquidity is actually insufficient, for example, because the sale of a property has not yet been completed.

From its character as a dilatory defense, it follows in legal doctrine that this defense must be raised by the capital management company at least by implication and, for example, will not be considered ex officio by the adjudicating court in a lawsuit. If a capital management company successfully invokes the defense under Section 93 (3a) of the KAGB (as amended) in a lawsuit, the claim is dismissed only as currently unfounded and may be brought again once the defense no longer applies – i. e., once the fund in contractual form regains its solvency.

Furthermore, a payment made in ignorance of the dilatory defense under Section 93 (3a) of the KAGB (as amended) cannot be reclaimed under Section 813 of the BGB because it is not a permanent defense. Before making such a payment, a capital management company is therefore advised to actively examine whether the defense under Section 93 (3a) of the KAGB (as amended) can be raised. Once payment has been made, the capital management company is barred from seeking reimbursement on the grounds of the fund’s illiquidity.

However, under Section 93 (3a) of the KAGB (as amended), this defense has no deferral effect and no impact on the occurrence of default or on the realization of collateral that the capital management company has provided for a liability of the fund in contractual form. For example, the defense under Section 93 (3a) of the KAGB, as amended, does not prevent the accrual of default interest pursuant to Section 288 of the BGB.

According to the legislative history of the FRiG, the new provision of Section 93 (3a) of the KAGB, as amended, is intended to achieve equal treatment of creditors of funds in contractual form without legal personality with creditors of investment companies. Under current law, there is a difference in the liability of capital management companies depending on whether the funds they manage are investment companies with legal personality or funds in contractual form without legal personality. In the case of investment companies, the capital management company is not liable with its own assets, whereas in the case of funds in contractual form, under current law, the capital management company is liable with its own assets if the liabilities cannot be covered by the claim for reimbursement of expenses under Section 93 (3) of the KAGB against the special fund. In particular, this difference in the liability regime had frequently led, in the area of special AIFs, to the investment company being preferred over the fund in contractual form during fund setup.

Section 93 (3a) of the KAGB, as amended, is also intended to facilitate the financing of funds in contractual form, as banks can thereby treat the special fund as the debtor for the purposes of the European Capital Requirements Regulation (CRR), which typically has significantly better capital adequacy than the capital management company.

Winding-up by the Capital Management Company upon termination of the management of a fund in contractual form; Section 99 (1) of the KAGB (as amended)

Under Section 99 (1) of the KAGB (previous version), capital management companies are entitled to terminate the management of a fund in contractual form by giving six months’ notice through publication in the Federal Gazette and additionally in the annual report or semi-annual report. For special funds, a shorter notice period may also be agreed upon in the investment terms and conditions. Following termination, the fund in contractual form must be liquidated by the custodian in accordance with the current legal situation.

Section 99 (1) of the KAGB is being significantly amended by the FRiG. Under the new provisions, the requirement to observe a specified notice period is eliminated. From the date of notification of termination (or, in the case of special AIFs, from the date of notification to investors), the capital management company – and no longer the depositary – will be obligated to liquidate the fund in contractual form. The capital management company’s obligation to manage the fund in contractual form does not end until the capital management company has fully liquidated the fund in contractual form. Furthermore, it is clarified that investment limits no longer need to be observed during liquidation, which is consistent with current management practice.

The above provisions apply mutatis mutandis to closed-end investment limited partnerships pursuant to Section 154 (1) sentence 5 of the KAGB.

Contract amendment mechanism pursuant to Section 163 (5) of the KAGB, as amended

A new paragraph 5 is inserted into Section 163 of the KAGB, which concerns the approval of investment terms for open-ended public investment funds. Under Section 163 (5) of the KAGB (as amended), existing contracts (such as investor agreements) between the capital management company and the investors will be automatically adjusted to reflect changes to the investment terms approved after the conclusion of the contract and which have become part of the contract, provided that such changes to the investment terms are necessary to implement new mandatory legal or regulatory requirements. This is currently likely to apply in particular to the liquidity management instruments required as of April 16, 2026.

According to the legislative rationale, this special provision is intended to enable the unbureaucratic and legally certain adaptation of existing contracts to new statutory or regulatory requirements. If the capital management company plans other changes to its investment terms that are not necessary to comply with statutory or regulatory requirements, the general provisions of contract law regarding contract amendments apply to such changes. For such changes to become part of the contract, an amendment agreement must be concluded with the investors or an existing contract amendment clause must be utilized.

The capital management company is merely required to inform investors of the automatic contract amendment pursuant to Section 163 (5) of the KAGB (as amended), without any specific information medium or deadline being prescribed by law in this regard.

Expansion of investment opportunities from closed-end public AIFs to open-end AIFs, Section 261 (1) No. 5 and No. 6 of the KAGB (as amended)

Section 261 (1) No. 5 and No. 6 of the previous version of the KAGB provided that closed-end public AIFs with a fund-of-funds strategy could invest in other closed-end AIFs. Investment in open-end AIFs was not permitted. From a liquidity management perspective, this was difficult to justify given the fundamental possibility of redeeming shares in open-end AIFs.

Section 261 (1) No. 5 and No. 6 of the KAGB (as amended) contain no restriction to closed-end AIFs. Closed-end public funds-of-funds may therefore also invest in open-end AIFs in the future. According to the legislative rationale for the FRiG, this is intended to increase the competitiveness of German closed-end public AIFs. This will not reduce the level of investor protection, as open-ended AIFs are also regulated and supervised products. We agree with this assessment.

Conclusion

From the industry’s perspective, the FRiG introduces several welcome changes to the KAGB. These include, in particular, the long-awaited introduction of closed-end funds in contractual form for the public fund sector. In particular, in conjunction with the newly introduced dilatory defense under Section 93 (3a) of the KAGB (as amended), capital management companies should assess whether they wish to consider launching funds in the form of closed-end funds in contractual form in the future.

The new automatic statutory contract amendment mechanism under Section 163 (5) of the KAGB (as amended) also simplifies the process of incorporating statutory or regulatory changes into contractual documents and is very much welcomed by the industry.

On the other hand, it cannot be denied that the FRiG will also entail additional bureaucratic burdens for the industry. For example, the requirement for at least two full-time KVG managing directors will not make recruiting staff any easier for smaller capital management companies – especially in times of a shortage of qualified managers.

The statutory requirements for works council compensation are clearly formulated in their basic principles. In practice, however, their application is often associated with considerable uncertainties. This is especially true in light of recent case law and the associated civil and criminal law risks for decision-makers within the company.

Employers therefore face the challenge of making compensation decisions that comply with both the voluntary service principle (in conjunction with the principle of compensation for lost earnings) and the prohibition against preferential or disadvantageous treatment. Below, we present some proven practices that have been established in advisory work as suitable for supporting a legally compliant approach to works council compensation.

I. Early and Structured Determination of the Relevant Comparison Group

A key starting point for a legally compliant compensation structure is the accurate determination of the comparison group. As discussed in the first two articles of this series, this group serves as the relevant reference framework for the development of compensation under Section 37(4) of the German Works Constitution Act (Betriebsverfassungsgesetz).

In practice, it is advisable to systematically establish the comparison group at the time the works council member takes office and to document the relevant considerations in a traceable manner. This includes, in particular, a brief description of the selected comparison persons, their roles, and their relevant qualifications (both professional and personal).

Such documentation not only facilitates subsequent adjustment decisions but also helps to present the reasoning clearly in the event of later inquiries or reviews. Particularly in cases of long-standing works council mandates, it can otherwise be difficult to reliably reconstruct the original considerations regarding comparability.

At the same time, employers should be aware that a comparison group, once established, may not be changed without due cause. A new comparison group may only be formed if there is an objective reason for doing so.

It should also be noted that under Section 37(4) sentences 4 and 5 of the German Works Constitution Act, a procedure for determining comparable employees may be established through a works agreement (Betriebsvereinbarung). Such an arrangement can help make the selection of comparison persons more transparent and traceable, thereby avoiding future disputes. However, this does not relieve the employer of the duty to carefully assess in each individual case which employees are actually comparable.

II. Regular Review of Compensation Development

The compensation of works council members is not a static matter. Section 37(4) of the German Works Constitution Act provides for a dynamic approach, under which works council members participate in the customary development of compensation within the company for comparable employees.

Employers are therefore well advised to regularly review whether the compensation within the relevant comparison group has changed and whether adjustments are necessary. In practice, it is helpful to link this review to existing HR processes, such as annual compensation rounds or other regular salary reviews.

In addition, attention should be paid to whether specific development opportunities have arisen within the company that could be relevant to the hypothetical career progression of the works council member. As outlined in the second article of this series, the prohibition against disadvantageous treatment under Section 78 sentence 2 of the German Works Constitution Act, in conjunction with Section 611a(2) of the German Civil Code (Bürgerliches Gesetzbuch), may give rise to an independent entitlement to compensation adjustment if the works council member would have attained a certain position had they not taken on their role.

A regular review of relevant developments helps to identify emerging adjustment issues at an early stage and address them appropriately.

III. Transparent Decision-Making Processes and Careful Documentation

A recurring risk in connection with works council compensation often lies less in the substantive decision itself than in inadequate documentation and traceability. Employers should therefore ensure that key decisions regarding works council member compensation are made transparently and documented thoroughly.

This applies in particular to:

• the formation and, where applicable, adjustment of comparison groups
• the customary compensation development within the comparison group
• the hypothetical career development of the works council member, particularly with regard to hypothetical promotion decisions
• decisions regarding variable compensation components and their derivation
• the treatment of overtime and compensatory time off

The documentation does not need to be particularly extensive. What matters is that the key substantive considerations are recorded and that the documents show the basis on which a particular compensation decision was made.

Such documentation can be especially important if compensation decisions are reviewed at a later date or if questions arise about possible preferential or disadvantageous treatment.

IV. Clear Internal Responsibilities and Structured Decision-Making Processes

In many companies, uncertainties regarding works council compensation arise not primarily due to unclear legal requirements, but rather due to a lack of internal structures. It is therefore advisable to define clear responsibilities for matters relating to works council compensation.

In practice, it is often helpful to centralize these matters within the HR department and to involve employment law expertise early on when needed.

Furthermore, it may be useful to develop standardized internal procedures for typical situations, such as documenting established comparison groups, regularly reviewing compensation developments, or handling overtime worked by works council members.

Structured processes help to ensure that compensation decisions are made consistently and reduce the risk of individual errors.

V. Raising Awareness Among Decision-Makers in the Company

Another key aspect is raising awareness among those individuals in the company who are involved in compensation decisions. The compensation of works council members is subject to specific legal requirements. Unlike with other employees, the voluntary service principle under Section 37(1) of the German Works Constitution Act and the prohibition against preferential or disadvantageous treatment under Section 78 sentence 2 of the German Works Constitution Act must be strictly observed.

Against this background, it is advisable to regularly raise awareness among managers and HR staff regarding these specific considerations. This can be achieved through internal guidelines, training sessions, or early involvement of the relevant specialist department.

Such awareness-raising helps to identify and avoid potential risks in advance.

VI. Particular Caution with Individual Special Arrangements

Finally, practice shows that individually tailored special arrangements in connection with works council member compensation can be associated with heightened risks.

These include individually agreed compensation components, flat-rate bonuses, or other arrangements that cannot be readily derived from the development of the comparison group or from the general compensation structures of the company.

Such arrangements can quickly give the impression of impermissible preferential treatment within the meaning of Section 78 sentence 2 of the German Works Constitution Act. Employers should therefore generally ensure that compensation decisions are aligned with objective and traceable criteria.

This applies not only in the context of employment court proceedings but also in view of potential civil or criminal law issues (e. g., breach of fiduciary duty under Section 266 of the German Criminal Code [Strafgesetzbuch]).

Conclusion

The legally compliant design of works council compensation does not require a complex special framework, but it does require structured and transparent decision-making processes.

Employers are well advised to carefully establish comparison groups, regularly review compensation developments, and document key decisions in a traceable manner. Clear responsibilities and awareness among the relevant decision-makers also contribute to reducing legal risks.

Those who follow these principles create a solid foundation for a compensation structure that meets both the legal requirements and the practical needs of the company.

This concludes our publication series on legally compliant works council compensation. We hope that the legal principles and practical guidance presented have provided you with helpful orientation for dealing with this complex topic.

Should you have any questions or require advice on specific cases, we are of course always happy to assist.

Furthermore, the BGH clarifies that the determination of whether knowledge and skills are being imparted asynchronously always depends on the specific case.

Facts

The most recent proceedings were based on the following facts:

The defendant offers online mentoring programs without authorization under Section 12(1), sentence 1 of the Distance Learning Act (FernUSG). The plaintiff entered into a so-called “Business Class Coaching Agreement” with the defendant. According to the defendant, this Business Class mentoring is a highly professional and very personalized mentoring program designed to help establish one’s own business.

The plaintiff was required to pay EUR 16,000.00 for the seven-month duration of the coaching.

The goal of the program was to establish her own online business in the field of coaching. Under the terms of the contract, the plaintiff gained access to instructional videos and workbooks on the online platform and participated in weekly live calls with the defendant or the experts it had engaged. In addition, a “live customer event” took place over a weekend in Baden-Baden. Employees of the defendant even managed the plaintiff’s Facebook page and handled the brand design.

The Legal Dispute

The parties now argued before the Federal Court of Justice (BGH), among other things, whether the purpose of the coaching program was to impart knowledge and skills or merely to provide support for professional development.

The central issue – as in all coaching cases – was the nullity of the contract pursuant to § 7(1) of the Distance Selling Act (FernUSG).

The plaintiff was successful before the Ulm Regional Court. However, the Stuttgart Higher Regional Court dismissed the claim in its entirety, holding that the contract was not void under Section 7(1) of the Distance Selling Act. In the Federal Court of Justice’s recent decision, however, the plaintiff prevailed.

Previous Case Law of the Federal Court of Justice

The ruling aligns with the BGH’s line of case law regarding the applicability of the FernUSG. As early as February 5, 2026 (III ZR 137/25), the BGH clarified the central and controversial question of when a geographical separation exists under Section 1(1)(1) of the FernUSG. We previously reported on this in our IP, Media & Technology Update No. 137. Furthermore, last year (judgment of June 12, 2025 – III ZR 109/24), the BGH affirmed the applicability of the FernUSG to the B2B sector as well, thereby increasing the relevance of this new area of law. As previously outlined in our IP, Media & Technology Update No. 123, this topic is of great significance.

Key finding of the ruling: A right to ask questions suffices as a learning assessment

In its latest ruling, the Federal Court of Justice (BGH) had to address, in particular, the question of when contractually agreed monitoring of learning progress exists pursuant to § 1(1)(2) FernUSG.

The fact that the plaintiff may be a start-up entrepreneur and thus an entrepreneur within the meaning of § 14 BGB could be left open here. As outlined above, the FernUSG also applies to entrepreneurs. The BGH has now reiterated this in its ruling.

The Higher Regional Court, however, based its dismissal of the claim on the absence of monitoring of learning progress: the mere possibility of asking questions was insufficient. Active monitoring by the defendant provider had not been agreed upon.

The Federal Court of Justice expressly disagreed with this narrow interpretation and clarified that individual exam assignments or other specific learning assessments are not required for this element of the offense. The Senate has previously ruled that it is sufficient if the learner is entitled under the contract to receive individual monitoring, for example through oral questions on the material covered in an accompanying class session. Most recently, the court reaffirmed this precedent on January 15, 2026 (III ZR 80/25).

The individual case remains decisive

Although the Federal Court of Justice (BGH) corrected the Higher Regional Court’s legal opinion, it could not ultimately rule in favor of the plaintiff. This is because the appellate court had left open whether the contract was aimed at the transfer of knowledge and skills at all – or whether it was rather a matter of individual consulting and support in building a business. The Federal Court of Justice (BGH) could not determine which specific services were to be provided by the defendant. In particular, it was unclear what was meant by “mentoring” in this context and what specific knowledge was to be imparted. For this reason, the Higher Regional Court (OLG) will have to clarify in detail the nature, content, and focus of the contract concluded between the parties in the new appeal proceedings.

In summary, whether so-called business coaching or mentoring services fall under the Distance Selling Act must be assessed by examining the specific scope of services agreed upon in each individual case, with the focus of the contract being decisive.

The other party to the contract may bear a secondary burden of proof regarding the agreed-upon content, format, and manner of delivery.

Furthermore, the Higher Regional Court did not sufficiently determine the exact proportion of synchronous and asynchronous instructional components (live calls vs. videos) in this case. The Federal Court of Justice refers in this regard to its ruling of February 5, 2026 (III ZR 137/25), Update IP, Media & Technology No. 137.

What does this ruling mean for those affected?

The Federal Court of Justice (BGH) continues to consistently interpret the criterion of monitoring learning success broadly. With its latest ruling, the BGH has now reaffirmed its case law within a span of less than two months. It can therefore be assumed that the BGH will not take a more restrictive approach anytime soon.

This provides legal certainty, but also shows that contract drafting in the online coaching and mentoring sector remains a key factor for the applicability of the FernUSG: On the one hand, affected coaching providers must ensure, upon concluding a contract, that they agree on a right to ask questions with the learner. Furthermore, in legal disputes involving the FernUSG, it continues to depend on whether the focus of the coaching was on knowledge transfer or on personal counseling. This leaves room for further argumentation.

I. What is digital compliance?

Digital compliance refers to adherence to the legal requirements arising from the use of digital technologies, the processing of data, and the operation of IT-supported business processes. In corporate practice, the term thus encompasses a range of different regulatory requirements, ranging from data protection law and IT security requirements to specific regulations for digital services and data ecosystems. While large companies have often established specialized compliance structures for this purpose, in small and medium-sized enterprises (SMEs) such requirements are frequently perceived primarily as an IT or data protection issue. In reality, however, it is an organizational management task that must be integrated into the company’s compliance and risk management framework.

1. GDPR Requirements

Compliance with the General Data Protection Regulation (GDPR) remains a central component of digital compliance. It governs the conditions for processing personal data and thus affects virtually all of a company’s digital business processes – from human resources management and customer relations to the use of digital platforms or cloud-based IT infrastructures. Companies must not only observe individual substantive requirements but also establish a structured data protection management system that ensures organizational compliance with legal requirements.

The starting point for any data protection assessment is the question of the lawfulness of data processing. According to Article 6 of the GDPR, the processing of personal data is only permissible if there is a corresponding legal basis, such as the consent of the data subject, the performance of a contract, legal obligations, or the legitimate interests of the company. These requirements must be assessed and documented for each processing operation. At the same time, Article 5 of the GDPR requires companies to adhere to fundamental data protection principles – in particular purpose limitation, data minimization, transparency, and the integrity of data processing.

An essential component of compliance management is the obligation to provide information to data subjects. In accordance with Articles 13 and 14 of the GDPR, companies must provide comprehensive privacy notices, for example, to employees, job applicants, customers, or suppliers. This information must include, among other things, the purpose of the processing, the respective legal basis, potential recipients of the data, the retention period, and the rights of data subjects. Transparent information is of particular practical importance, especially in the context of employment or within the framework of digital application processes.

Furthermore, the GDPR requires companies to maintain extensive documentation. Pursuant to Article 30 of the GDPR, a record of processing activities must be maintained, in which all relevant data processing activities within the company are recorded. This record regularly serves as the basis for internal data protection audits as well as for potential inspections by supervisory authorities. In addition, technical and organizational measures must be implemented in accordance with Article 32 of the GDPR to ensure an appropriate level of protection for personal data. These include, for example, access and authorization policies, encryption, backup systems, or internal security guidelines.

Special requirements apply to processing operations that may pose a high risk to the rights and freedoms of data subjects. In such cases, a data protection impact assessment must be conducted in accordance with Article 35 of the GDPR. This may be the case, for example, when using new technologies, when processing large amounts of sensitive data, or when systematically monitoring individuals. The aim of the impact assessment is to identify potential risks at an early stage and to define appropriate protective measures. With the increasing use of AI, data protection impact assessments are also gaining in importance.

Finally, the GDPR also requires organizational measures to raise employee awareness. Data protection training, internal guidelines, and clear responsibilities within the company are essential elements of effective data protection management. This aspect is often underestimated, particularly in small and medium-sized enterprises, even though many data protection violations in practice can be attributed to organizational shortcomings or a lack of awareness regarding the handling of personal data.

2. Other Digital Law Requirements

In addition to data protection law, the regulatory framework for digital business processes is increasingly shaped by other EU legal requirements. In recent years, the European Union has adopted a multitude of new legal acts regulating the use of digital technologies, data handling, and IT security requirements in companies. Digital compliance is therefore no longer limited to data protection issues but encompasses a broad spectrum of requirements under European digital law.

Of particular practical significance is the Regulation on Artificial Intelligence (AI Regulation) (see our latest article). It establishes a uniform EU-wide legal framework for the development, distribution, and use of AI systems. The regulation follows a risk-based approach: While certain AI applications are completely prohibited, so-called high-risk AI systems are subject to extensive requirements, for example regarding risk management, data quality, documentation obligations, transparency, and human oversight. Companies that develop, distribute, or use AI systems in their business processes must therefore assess whether their applications fall under the relevant categories and what compliance obligations arise from this. Current adaptation considerations at the European level, some of which are being discussed under the banner of an “AI Omnibus,” also aim to clarify the practical implementation of individual requirements and make them more manageable for companies (we reported).

Another key component of European digital law is the NIS 2 Directive, which significantly expands cybersecurity requirements in security-relevant sectors (see topic page). Compared to the previous legal framework, the scope of affected companies has been significantly broadened and now includes numerous small and medium-sized enterprises across various industries. The directive requires companies, in particular, to implement comprehensive risk management measures in the area of IT security, to establish incident reporting structures, and to secure digital supply chains. At the same time, it explicitly emphasizes the responsibility of management, which is accountable for implementing and monitoring cybersecurity measures.

The Data Act, which regulates access to and the use of data in the European data economy, will also gain importance for many companies (we reported). Among other things, the regulation aims to facilitate access to data from connected products and digital services and to improve the ability to switch between cloud providers. Companies will therefore need to pay closer attention in the future to the data access and sharing obligations arising from the use of data-driven products or platforms and to the contractual adjustments that will be required.

For the financial sector, the Digital Operational Resilience Act (DORA) further specifies the requirements for IT risk management (see topic page). Banks, insurance companies, and other financial firms will be required to establish comprehensive ICT risk management, conduct regular security tests, and systematically monitor their dependencies on third-party IT service providers, particularly cloud providers. Here, too, the focus is shifting more strongly toward management’s responsibility.

The Cyber Resilience Act (CRA) is also of particular importance in this context (see topic page). The regulation establishes, for the first time, a uniform European legal framework for the cybersecurity of products with digital elements, thereby addressing in particular manufacturers, importers, and distributors of such products. Companies are required to incorporate security requirements as early as the development phase (“security by design”), systematically monitor vulnerabilities, and provide security updates throughout the entire product lifecycle. In addition, there are comprehensive documentation, reporting, and compliance obligations. Indirectly, increased requirements also arise for companies that merely use such products, for example, in the selection of suppliers, contract drafting, and within the framework of IT risk management.

Furthermore, other European initiatives are gaining relevance. Sector-specific data spaces such as the European Health Data Space (EHDS) are creating new frameworks for accessing and using sensitive data (we reported). The planned European digital identity (EUDI wallet) will bring new requirements for authentication and identity infrastructures (we reported). In addition, the E-Evidence Regulation aims to facilitate cross-border access to electronic evidence by law enforcement authorities, which creates additional requirements for handling official data access requests (we reported).

These regulatory developments are closely linked to the growing discussion surrounding corporate digital sovereignty (we reported). This refers to the ability to manage digital infrastructures, data flows, and IT dependencies in such a way that legal requirements are met and strategic risks are controlled. In particular, the widespread use of global cloud and platform providers raises questions regarding data access from third countries, technical dependencies, or limited options for switching providers. Numerous European digital laws, such as the NIS 2 Directive or the Data Act, therefore also aim to strengthen interoperability, reduce dependencies, and give companies more control over their digital resources. In practice, digital sovereignty is thus increasingly becoming an integral part of corporate digital compliance and risk strategies (see our event on April 21, 2026, on the topic of digital sovereignty).

II. Personal Liability of Management

The implementation of digital compliance affects not only organizational processes within the company but also the personal responsibility of management. Under Section 43(1) of the German Limited Liability Companies Act (GmbHG), managing directors of a limited liability company (GmbH) are obligated to exercise the due care of a prudent businessman. This includes, in particular, the duty to organize the company in such a way that legal requirements are complied with and legal risks can be adequately controlled. For members of the executive board of a stock corporation, this organizational duty is further specified by Section 91(2) of the German Stock Corporation Act (AktG), which requires the establishment of a monitoring system for the early detection of developments that could jeopardize the company’s continued existence. For publicly traded companies, Section 91(3) of the German Stock Corporation Act (AktG) further requires an appropriate and effective internal control and risk management system.

If digital legal requirements – such as those related to data protection, IT security, or the use of new technologies – are not adequately addressed within the company, this can therefore also have liability consequences. If management violates its organizational duties and the company suffers damages as a result – such as fines, claims for damages, or significant economic disadvantages – personal liability toward the company may generally be considered.

A practical liability risk arises in particular when breaches of duty only become apparent in retrospect. It is not uncommon for data protection violations, IT security incidents, or regulatory shortcomings to come to light only during regulatory audits, internal investigations, or in the context of a change in management. When a managing director leaves the company, compliance structures are frequently reviewed or reassessed. If it turns out that key requirements – such as those related to data protection or IT security measures – have not been implemented for an extended period, the company may generally consider holding the former managing director liable.

In addition, regulatory enforcement of digital regulations is gaining momentum. Data protection supervisory authorities have been conducting regular audits for years, and more intensive oversight is also expected in the area of cybersecurity regulation. With the implementation of new European digital legislation, corresponding control structures will be further expanded. Initial hearings and audit procedures already indicate that authorities are beginning to scrutinize the practical implementation of digital compliance requirements in companies more closely. This increases the pressure on management to establish appropriate structures early on and in a transparent manner.

III. Implementation Steps

Implementing digital compliance often presents practical challenges for small and medium-sized enterprises. Unlike large corporations, many companies have neither their own compliance departments nor extensive personnel or financial resources. Nevertheless, this does not mean that comprehensive and cost-intensive projects are necessary to achieve an adequate minimum level of digital compliance. Rather, what is crucial is a structured and pragmatic approach that focuses on the essential legal requirements.

1. Defining Roles and Responsibilities

A first step is to define clear responsibilities for digital compliance issues within the company. In practice, it is often the case that issues related to data protection, IT security, or the use of new technologies are spread across different departments and are therefore not systematically coordinated. Simply appointing a responsible contact person or consolidating relevant topics into a central function can help identify risks early on and implement regulatory requirements in a structured manner. At the same time, the issue should also be taken seriously at the executive level. It is no coincidence that the saying “data protection is a top priority” has been around for years.

2. Inventory of Digital Processes

Once responsibilities have been defined, a structured inventory should be conducted first. Companies should identify which digital systems, cloud services, or data-driven applications are in use and what types of data are being processed. This transparency forms the basis for assessing which specific regulatory requirements are relevant – such as those from the GDPR, the AI Regulation, or IT and security guidelines. In many cases, this reveals that only a limited portion of the existing systems actually triggers complex compliance requirements.

3. Establishing Minimum Documentation and Basic Structures

A key component of digital compliance is robust foundational documentation. This includes, in particular, privacy notices for different groups of individuals, a record of processing activities, and basic internal guidelines for handling data and digital systems. Such structures do not necessarily have to be extensive or highly complex. Even clear and comprehensible documentation of core processes can make a significant contribution to meeting regulatory requirements and remaining capable of acting during regulatory audits.

4. Raising Employee Awareness

Moreover, many compliance risks in everyday business operations do not arise from complex legal issues, but rather from a lack of awareness regarding the handling of data and digital applications. Regular training on data protection, IT security, or the use of new technologies can already make a significant contribution to risk minimization. Especially in small and medium-sized enterprises, such training measures can often be implemented with manageable effort and integrated into existing internal communication or training structures.

5. Prioritizing and pragmatically addressing risks

Ultimately, it makes sense for small and medium-sized enterprises to take a risk-based approach to digital compliance. Not every company is equally affected by all digital regulatory initiatives. While the AI Regulation, for example, is relevant only for certain applications, other requirements affect only specific industries or company sizes. A structured prioritization of the issues that are actually relevant makes it possible to allocate resources in a targeted manner while achieving an appropriate level of compliance.

IV. Conclusion and Outlook

Digital business processes are now subject to a growing number of regulatory requirements that go far beyond traditional data protection. For medium-sized companies, this means that digital compliance is increasingly becoming an integral part of proper corporate governance and is also coming more into focus for management from a liability perspective.

At the same time, practical experience shows that a robust minimum level of digital compliance can be achieved with manageable organizational measures. A structured approach is crucial, one that identifies key digital risks, establishes clear responsibilities, and implements fundamental documentation and organizational obligations.

In light of new European digital legislation such as the AI Regulation, NIS-2, or the Data Act, it is also reasonable to assume that regulatory requirements will continue to increase in the coming years. For medium-sized companies, it is therefore advisable to establish digital compliance early on as an integral part of the corporate organization and to gradually expand the corresponding structures.

This article was created in collaboration with our student employee Emily Bernklau.

The decision addresses two key practical issues: First, under what conditions data controllers may reject a request for access based on abuse or excessiveness. Second, whether and under what conditions a claim for damages under Article 82 of the GDPR may arise from a refusal or insufficient provision of information. Thus, the judgment concerns the practical handling of strategically motivated requests from data subjects as well as the scope of liability risk under the GDPR.

Facts

The proceedings were based on a legal dispute between the optical company Brillen Rottler and a private individual. In March 2023, the individual had subscribed to a newsletter via the company’s website and thereby consented to the processing of her personal data. Thirteen days later, the individual made a request for access under Article 15 GDPR to the company. Brillen Rottler rejected the request within the prescribed time limit, citing the abusive or excessive nature of the request. Subsequently, the data subject not only pursued the right of access but also asserted a claim for non-material damage under Article 82 of the GDPR in the amount of 1,000 euros.

Brillen Rottler justified its position by arguing that publicly available sources showed that the defendant systematically provoked alleged data protection infringements to base claims for damages on them. The Arnsberg Local Court stayed the proceedings and referred several questions to the CJEU for a preliminary ruling. The focus was particularly on whether a first-time request for access could already constitute an abuse of rights, what significance should be attached to the data subject’s motivation to seek damages, and whether Article 82 of the GDPR necessarily requires the processing of personal data.

The Core Issues of the Case

The CJEU essentially had to rule on the following points: First, whether an initial request for access can under any circumstances be classified as excessive or abusive within the meaning of Article 12(5) of the GDPR. Second, whether the data subject’s intention to use the request for access to prepare a subsequent claim for damages can justify a refusal. Third, whether publicly available information regarding a corresponding pattern of behaviour by the data subject is sufficient for this purpose. Fourth, whether a violation of the right of access itself can give rise to a claim for damages under Article 82 of the GDPR and whether “processing” within the meaning of Article 4(2) of the GDPR is required for this. Finally, the question arose as to whether a mere loss of control or uncertainty regarding the handling of personal data already constitutes non-material damage.

Key Findings of the CJEU

On the defense of abuse of rights

The CJEU clarifies that even an initial request for access may, in certain circumstances, be regarded as “excessive” within the meaning of Article 12(5) GDPR and may therefore be abusive. What is decisive in this regard is not merely the formal exercise of the right of access, but the purpose for which that right is exercised. A request may be refused where the controller demonstrates that it was not made in order to obtain awareness of the processing of personal data and to verify its lawfulness, but solely in order to artificially create the conditions for a claim for damages.

On the motivation of the data subject

The Court places particular emphasis on the objective pursued by the access request. The mere fact that a data subject intends to assert a claim for damages at a later stage is not, in itself, sufficient. What is decisive, rather, is whether the right of access is being used for a purpose contrary to its function. According to the judgment, a request is abusive where it is not aimed at reviewing the data processing but serves solely to generate a claim scenario.

Regarding publicly available information about a pattern of conduct

The CJEU acknowledges that publicly available information indicating a systematic course of conduct on the part of the data subject may be taken into account when assessing whether a request is abusive. In this context, it may be relevant whether the data subject has, in a manner apparent to the public, repeatedly submitted requests for access to various controllers and subsequently linked such requests to claims for damages. While such circumstances may not necessarily be sufficient in isolation, they may constitute a significant indication of an abusive intention.

Regarding Art. 82 GDPR

At the same time, the Court confirms that a claim for damages under Article 82 GDPR is not limited to classic cases of unlawful data processing. In principle, an infringement of the right of access may also give rise to material or non-material damage and thus found a claim under Article 82 GDPR. In doing so, the CJEU underlines that the procedural safeguards provided for by the GDPR may also be relevant from a liability perspective.

On non-material damage

The Court also makes it equally clear that Article 82 GDPR does not provide for automatic compensation for every infringement of the law. The data subject must demonstrate that he or she has in fact suffered material or non-material damage. In addition, a claim is excluded where the data subject’s own conduct constitutes the decisive cause of the alleged damage. This is significant in practice, because it means that neither the mere rejection of an access request nor the mere invocation of a loss of control will automatically give rise to a claim for damages.

Implications for practice

The decision is relevant for companies in two key respects. On the one hand, it strengthens controllers in dealing with clearly strategically motivated access requests. The CJEU recognises that data subject rights cannot be instrumentalised independently of their protective purpose. On the other hand, the Court does not lower the threshold for refusing such requests but instead makes refusal contingent upon substantiated proof of abusive intent. A hasty reliance on Article 12(5) GDPR therefore remains risky.

The judgment is equally significant from a liability perspective. Companies cannot assume that infringements of the right of access fall outside the scope of Article 82 GDPR. Anyone who wrongfully refuses or inadequately responds to an access request remains exposed to civil liability. That risk is, however, limited by the requirement that the data subject must plead and prove actual damage, and by the fact that the data subject’s own conduct may exclude liability where it constitutes the decisive cause of the alleged damage.

What companies should do now

First, companies should review their processes for handling access requests to ensure that atypical or strategically motivated requests can be properly identified and documented. Following the judgment, the defence of abuse is available, but it requires a sufficiently robust factual basis.

Second, publicly available indications of a systematic course of conduct on the part of an applicant should not be relied upon in a blanket manner, but should instead be assessed in a structured way in light of the specific circumstances of the individual case. This requires reliable documentation showing why the request in question does not serve the purpose of reviewing the data processing, but rather the artificial preparation of claims for damages.

Third, controllers should in future align refusals of access requests more closely with their liability assessment under Article 82 GDPR. This is because an infringement of the right of access may, in principle, also be relevant for damages purposes.

Fourth, it is advisable to refine internal escalation and approval processes for cases involving suspected abuse. Decisions to refuse access in whole or in part should be legally reviewed, clearly documented, and prepared in a manner capable of withstanding scrutiny in subsequent litigation.

Conclusion

With Brillen Rottler, the CJEU brings the interests of data subjects and controllers into a new balance. The Court continues to protect the right of access as a central transparency instrument of the GDPR, while at the same time making clear that it must not be misused to artificially generate claims for damages. For companies, this is an important signal: abusive requests can be resisted, but only on the basis of a carefully established and well-documented case. At the same time, the judgment makes equally clear that errors in handling access requests may continue to have liability consequences.

The focus of the decision is particularly relevant in practice: the company had transferred data from more than 10.5 million members of a bonus or loyalty programme to a social media platform for targeted advertising without ensuring a sound legal basis for doing so. The decision was adopted in a consistency procedure involving 16 other supervisory authorities.

Facts

According to the CNIL's findings, between late 2018 and February 2024, the company transferred personal data of members of its loyalty programme to an unnamed social media platform, in particular email addresses and telephone numbers. The platform matched these identifiers with its users and, in the event of a match, displayed personalized advertisements promoting the company's products.

Even though, according to the CNIL, only around 1.6 million data records could be assigned to a social media account and subsequently received advertising, the CNIL already considered the transfer of data from over 10.5 million individuals to be an independent, unlawful processing operation.

Key statements by the CNIL

1. No effective consent for disclosure to social media

The CNIL criticized that the consent of loyalty programme members was only directed at receiving advertising via text message and email. According to the CNIL, there was no separate, informed consent for the transfer of identifiers to third parties for advertising purposes. This meant that the necessary legal basis was lacking.

2. Platform consent does not replace consent from the advertising company

The company argued that social media users had given their consent by accepting the platform's privacy policy. The CNIL clearly rejected this for two reasons:

• Not all data subjects whose data was transferred had a social media account at all.
• Even for users, any consent only referred to processing by the platform in its own context and not to the upstream data transfer by the company.

This distinction is central to common advertising setups. Advertising companies that transfer data to social media must establish and document the legal basis for doing so themselves.

3. DPIA obligation for large-volume, cross-company linking

The CNIL classified the targeting as high-risk, particularly due to the large amounts of data and the cross-linking between companies. A required data protection impact assessment was missing.

4. Information obligations under Art. 13 GDPR

The CNIL criticized incomplete information, including a lack of clear assignment of processing activities to their perspective legal bases and information on storage periods. In addition, it objected that information on data transfers to the US was not up to date, as reference was still made to the EU-US Privacy Shield, even though this had already been declared invalid at the time.

5. Security deficiencies in passwords

The CNIL considered the password requirements to be insufficient. In addition, the storage was deemed unsuitable because it made passwords more vulnerable.

6. Cookie violations after ePrivacy implementation

According to the CNIL's findings, the company set several non-essential cookies before a consent decision was made and did not reliably delete certain cookies even after they were rejected.

7. Remedial action does not protect against sanctions

The CNIL acknowledged that the company had made extensive remedial improvements during the proceedings, including terminating transmissions, adjusting cookies, updating information, and switching to stronger password hashing. Nevertheless, substantial fines were imposed.

Implications for practice

The decision addresses a pattern that is very common in consumer goods, retail, and loyalty ecosystems: CRM and loyalty programme data are provided to social media as identifiers in order to match existing customers on the platform and then serve advertising. It is precisely at this interface that the greatest compliance risks regularly lie.

The CNIL makes it clear that obtaining general marketing consent or referring to platform documentation is not sufficient for legality. Data transfer to social media is a separate processing step that requires a separate legal basis, robust transparency, and a risk-adequate governance setup.

What companies should do now

Separate and clarify consent design: Consent for direct marketing via email or SMS does not automatically constitute consent for the transfer of identifiers to social media. Anyone who wants to base this transfer on consent needs separate, clear, and verifiable consent that describes the data flow to the platform and the purpose of the matching in a comprehensible manner.

Fully document social media data flow: Technical design, data categories involved, matching logic, recipients, third-country references, and storage periods must be consistently reflected in directories, information obligations, and internal approvals.

DPIA check for targeting and matching use cases: In the case of large-volume inventories and cross-company links, it is necessary to check at an early stage whether a data protection impact assessment is required.

Update and operationalize information texts: Data protection notices should describe the specific processing in such a way that data subjects understand what is happening. This includes clear legal basis assignment, storage periods, and current information on third-country transfers, where relevant.

Ensure cookie compliance from a technical perspective: Non-essential cookies may only be set after effective consent has been given. Refusals must also be enforced from a technical perspective, including deletion mechanisms and regular tests.

Do not neglect security basics: Password requirements and secure storage remain standard points of attack. Even though the decision focuses on marketing, the case shows that supervisory authorities regularly review the entire compliance setup in such proceedings.

Conclusion

The CNIL decision is a clear message to companies with loyalty and CRM-driven marketing: the transfer of customer identifiers to social media is not a minor issue, but a central compliance block with high potential for fines. Particularly important is the key message that neither general marketing consents nor the acceptance of platform policies can replace the company's own legal basis for the transfer. Ex-post corrections may mitigate follow-up measures, but they do not necessarily prevent severe sanctions for past actions.

a) identify, before and/or during treatment, patients who are most likely to benefit from the corresponding medicinal product; or
b) identify, before and/or during treatment, patients likely to be at increased risk of serious adverse reactions as a result of treatment with the corresponding medicinal product (Art. 2 no. 7 IVDR).

In practice, CDx and the corresponding medicinal product are precisely coordinated with one another. CDx are regularly incorporated into the clinical trial of the medicinal product under Regulation (EU) 536/2014 ("CTR") or even developed in parallel. Unlike in other jurisdictions, however, the development and authorisation procedures are regulated separately, which poses considerable challenges for CDx manufacturers and sponsors of clinical trials. As early as 2024, efforts to harmonise these procedures at the European level were initiated through the COMBINE programme. On 16 December 2025, the European Commission published two proposals aimed at strengthening the European biotechnology sector („EU Biotech Act“) and amending Regulation (EU) 2017/745 on medical devices and the IVDR („MDR/IVDR Revision“; see our article Revision of the MDR and IVDR: European Commission Presents Reform Proposal for Simplification), which also contain significant changes affecting the development and approval of CDx.

I. Current Regulatory Framework

In the EU, the development and approval of CDx is carried out separately from the corresponding medicinal product. Demonstration of compliance with the general safety and performance requirements for the CDx, i.e. confirmation of analytical performance or clinical performance, takes place by means of so-called performance studies (Art. 57 et seq. IVDR). CDx performance studies require, in particular, authorisation from the competent authority and invariably involve the relevant ethics committees. Exceptions exist only for performance studies using left-over specimens (e.g. residual material from other studies, provided this is covered by the subject's informed consent).

In order to affix the CE marking under the IVDR, a conformity assessment involving a Notified Body is necessary, as CDx fall into at least the second-highest risk class C (Annex VIII rule 3 lit. f) IVDR; MDCG 2020-16 rev.4, p. 22). The Notified Body must also obtain a scientific opinion on the suitability of the CDx from the national medicines authority or the EMA. A link to the corresponding medicinal product is established only to the extent that the International Nonproprietary Name (INN) is listed in the CDx's instructions for use.

In many cases, only parallel development of the CDx and the medicinal product is possible. However, there is no uniform procedure for combined studies involving (not yet authorised) CDx used as assays in clinical trials of medicinal products due to the different regulatory frameworks and competences. Clinical trials for the medicinal product and the CDx may be conducted simultaneously, but they proceed through two separate regulatory processes, typically involving different sponsors. Sponsors have so far been dependent on a patchwork of individual member state regulations (MDCG 2022-10, question 10).

II. Revision of the IVDR

New Definition of CDx

The Commission's proposal first includes a clarifying expansion of the CDx definition. As it has already been the practice, in vitro diagnostic medical devices shall now also expressly qualify as CDx where they are intended for the safe and effective use of multiple medicinal products (Art. 2 no. 7 IVDR). Accordingly, the Commission's proposal provides that, as an alternative to the INN of the corresponding medicinal product, the relevant class of corresponding medicinal products may also be indicated in the CDx's instructions for use (Annex I Sec. 20.4.1 lit. c) viii) IVDR). Products used for monitoring treatment with a medicinal product in order to ensure that the concentration of the relevant substances in the human body remains within the therapeutic window (so-called complementary diagnostics, e.g. blood glucose monitoring) shall, however, continue not to be qualified as CDx.

Facilitation of CDx Performance Studies

Furthermore, the Commission's proposal provides for simplifications in respect of CDx performance studies that do not entail any additional risks for subjects. Performance studies involving only routine blood sampling from non-vulnerable study participants shall no longer be subject to the additional requirements under Art. 58 to 76 IVDR and, in particular, shall no longer require authorisation from the competent authority. For such performance studies, only notification obligations vis-à-vis the authorities and the general requirements in conjunction with the respective national law shall apply. For CDx performance studies using exclusively left-over specimens, even this notification obligation of the sponsor is to be dispensed with (Art. 58 para. 1 lit. c), 2 IVDR; Recital (50) MDR/IVDR Revision).

Primacy of Pharmaceutical Law for Combined Studies

Moreover, the Commission's proposal sets the course for a genuine co-development of CDx and the corresponding medicinal products. For the first time, the Commission's proposal introduces the concept of a combined study. Combined studies are defined as clinical trials involving medicinal products within the meaning of the CTR that are combined with performance studies for in vitro diagnostic medical devices (including CDx) (Art. 2 no. 75 IVDR). Within the framework of these combined studies, sponsors of performance studies requiring authorisation shall have the option of a single application and assessment procedure. As an alternative to the current separate application process under the IVDR (in the affected member states) and the CTR (via the EU portal CTIS), sponsors shall be enabled to submit a single application for a combined study. In such cases, a primacy of pharmaceutical law shall apply, and a coordinated assessment shall take place exclusively in accordance with the provisions of the CTR (Art. 75a IVDR; Recital (43) MDR/IVDR Revision).

Consultation of Medicines Authorities

Finally, the Commission's proposal emphasises that the consultation of the medicines authority, as currently provided for, shall only be required for novel CDx. For established CDx, a renewed assessment is to be waived. In this context, the European Commission also clarifies that the medicines authority shall not repeat the medical device regulatory assessment carried out by the Notified Bodies (Art. 48 para. 10b IVDR, Annex IX Sec. 5.2 lit. c), g) IVDR respectively Annex X Sec. 3 lit. k) IVDR; Recital (49) MDR/IVDR Revision).

III. EU Biotech Act

Coordinated Assessment Procedure for Combined Studies

The EU Biotech Act establishes the legal prerequisites for implementing the unified assessment mechanism for combined studies. To this end, an identical definition of combined studies is to be codified in pharmaceutical law as well (Art. 2 no. 44 CTR). The Commission's proposal then sets out substantive details regarding the procedure for the coordinated assessment. The sponsor's single application is first to be transmitted via the EU portal to all affected member states. The assessment of the application is then carried out under the lead of a reporting member state and also encompasses the assessments of the competent authorities and the ethics committees. Objections raised by affected member states during and after the assessment are to be limited to specific grounds. The final decision on the authorisation of the combined study, however, is to remain with each affected member state individually. The European Commission is empowered to amend or supplement the relevant provisions of the CTR with regard to the conduct of combined studies by means of delegated acts (Art. 14c CTR; Recital (135) EU Biotech Act).

Combined Studies Involving AI

In the examination of human samples, analytical software is regularly employed which, depending on its intended purpose, may itself constitute a CDx. In practice, such software-based CDx increasingly utilise artificial intelligence. Examples include machine learning for the localisation of granular biomarkers, pattern recognition in identifying suitable or unsuitable patients, or linking vast datasets with patient data to create comprehensive suitability profiles. The Commission's proposal also provides for the described coordinated assessment for the authorisation of combined studies involving such AI-based CDx. Corresponding guidelines on the handling of AI are to be developed by the EMA, the newly established Clinical Trials Coordination and Advisory Group (CTAG), the MDCG and the Artificial Intelligence Board (Art. 27e para. 3, 4 CTR).

IV. Conclusion and Outlook

On a global scale, the market for personalised medicine and CDx is experiencing strong growth. In the EU, however, the rigid regulatory requirements for CDx manufacturers and sponsors of clinical trials have posed considerable challenges in recent years to the practical implementation of research and development projects. The simplifications introduced through the EU Biotech Act and the MDR/IVDR Revision are therefore welcome from an industry perspective. Nevertheless, both Commission proposals merely mark the beginning of the respective legislative processes. The opinions of the European Parliament and the Council are still pending. It remains to be seen how quickly the European legislator will be able to translate these plans into action.

I. Digital Omnibus: New deadlines for the AI Regulation

The European AI Regulation (AI Regulation) currently stipulates that key requirements for high-risk AI systems will become applicable from August 2, 2026. Particularly relevant are Sections 1 to 3 of Chapter III of the Regulation, which define the classification of AI systems as high-risk AI, the technical requirements, and the obligations of providers and operators. These provisions are of practical importance for many companies, for example when AI systems are used in human resources, credit decisions, or safety-related products.

Against this background, adjustments to the AI Regulation are currently being discussed at European level as part of the so-called Digital Omnibus Package. In addition to a general Digital Omnibus (we reported on this in Data Protection Update No. 221, No. 223, and No. 236), the Digital Omnibus on AI in particular contains proposed amendments specifically relating to the AI Regulation. The central consideration is to postpone the application of the regulations for high-risk AI.

The background to the discussion is primarily the currently limited practical feasibility of the requirements. Many of the requirements of the AI Regulation presuppose technical standards, certification procedures, and regulatory guidelines that are only partially available at present. Without these specifications, companies face considerable legal uncertainty in implementing the extensive compliance obligations for high-risk AI. The omnibus proposal therefore links the applicability of the relevant regulations to the availability of supporting guidelines and standards from the European Commission.

According to the current proposal, the rules for high-risk AI would only become applicable in the future after a corresponding decision by the European Commission, with staggered transition periods. For AI systems under Article 6(2) and Annex III of the AI Regulation (e.g., systems in the personnel or education sector), the obligations would take effect six months after such a decision, while for AI systems under Article 6(1) and Annex I (e.g., safety-related components of certain products), a twelve-month transition period is provided for. Irrespective of this, the proposal provides for absolute maximum deadlines: December 2, 2027, and August 2, 2028, respectively.

The legislative process is not yet complete. The omnibus package is on the agenda of the Committee of Permanent Representatives in the Council of the European Union for March 13, 2026, with a view to laying the groundwork for negotiations with the European Parliament. Formally, therefore, August 2, 2026, remains the date of application for the time being. However, in the political debate, a postponement of the deadlines is now considered likely.

II. AI and copyright

1. New case law from German courts

Parallel to regulatory developments, the copyright classification of AI applications is also becoming increasingly important. German courts are increasingly dealing with the question of how classic copyright protection mechanisms should be applied to content created or used in connection with AI systems. Initial rulings show that the use of AI does not negate the copyright protection of human works.

A recent example is a ruling by the Frankfurt Regional Court on December 17, 2025 (Ref. 2-06 O 301/25). The subject of the proceedings was a piece of music that had been created using generative AI from lyrics previously written by a natural person. The lyrics were written by a private author and set to music by a third party using an AI music generator. The song was then released through a music distributor and promoted on social media. The author of the lyrics subsequently asserted claims for injunctive relief.

The court clarified that the copyright protection of a text created by a human being does not lapse when it is integrated or edited into a new work, such as a piece of music, with the help of AI. The decisive factor is whether the original text continues to be a personal intellectual creation within the meaning of copyright law. The court affirmed this. Even though individual passages had been revised or reworded, the author's individual expression remained recognizable. The use of the text in the AI-generated song therefore constituted use of the protected work.

The court considered the distribution of the song to be an infringement of the lyricist's copyright, in particular the right of reproduction under Section 16 of the German Copyright Act (UrhG). Although the lyrics in the song had been partially altered, the basic structure and central passages had been retained. The distribution of the AI-generated piece of music could therefore be prohibited.

The decision is one of a series of recent cases in which German courts are beginning to apply copyright principles to AI constellations. For example, the Regional Court of Munich I had already ruled on copyright issues in connection with AI-generated content in its judgment of November 11, 2025 (Ref. 42 O 14139/24). There, too, it became clear that the decisive factor for copyright protection remains whether a human creative achievement is involved.

2. New EU initiatives for AI and copyright

At the European level, too, the copyright dimension of generative AI is increasingly coming into focus. On March 10, 2026, the European Parliament adopted a resolution on "Copyright and generative artificial intelligence – opportunities and challenges", which was largely based on an initiative by CDU MEP Axel Voss.

The resolution addresses the current uncertainties surrounding the interaction between generative AI and European copyright law. In the Parliament's view, the training of AI models with copyright-protected content, transparency regarding the training data used, and the remuneration of rights holders raise key legal questions. At the same time, it emphasizes that innovation in the field of AI and the protection of creative works should not be seen as opposites, but that both areas must be developed together.

In terms of content, Parliament advocates, among other things, greater transparency in the use of copyright-protected content for training AI systems. In the future, providers of generative AI should disclose which protected content has been used in training data sets. In addition, Parliament calls for the development of functioning licensing mechanisms to ensure fair remuneration for authors while enabling access to high-quality training data.

Another focus is on strengthening the position of rights holders, particularly those in the cultural and media industries. They should be given effective means of objecting to the use of their works for AI training purposes or of licensing such uses. In this context, the role of the European Union Intellectual Property Office (EUIPO) as a possible mediator for transparency and licensing mechanisms is also being discussed.

The resolution does not yet result in legally binding changes. Nevertheless, the initiative clarifies the political direction of further European regulation. The European Parliament expressly calls on the Commission to examine whether the existing copyright legal framework, in particular the rules on text and data mining, should be adapted or supplemented in view of the development of generative AI. It is therefore foreseeable that the copyright regulation of AI systems is likely to be further specified at EU level in the coming years.

III. National implementation of the AI Regulation: AI-MIG

In addition to developments at the European level, the national implementation of the AI Regulation is also progressing. Although the AI Regulation applies directly in all member states, supplementary national regulations are required, in particular to determine the competent authorities and to organize market surveillance and supervision. In Germany, this implementation is to be carried out by the planned AI Market Surveillance and Innovation Act (AI-MIG) (we reported).

The draft law essentially provides for the existing market surveillance structures for regulated products to be transferred to AI systems. In particular, it envisages a coordinating role for the Federal Network Agency, which is to act as a central point of contact for AI supervision issues and coordinate cooperation between the various specialist authorities. In addition, the respective competent supervisory authorities will remain responsible for certain areas of application, such as the financial sector. The aim of the law is to create an efficient supervisory structure while making the most of existing responsibilities.

The current draft of the law is on the agenda of the Bundesrat on March 11, 2026. In political and economic discussions, the project has so far been largely viewed as a necessary step toward the organizational implementation of European requirements. At the same time, isolated concerns have been expressed, for example regarding the complexity of the planned supervisory structure and the practical coordination between the authorities involved.

IV. International regulation: The Colorado AI Act

In addition to European regulation, specific legal frameworks for the use of AI systems are also increasingly emerging outside the European Union. One particularly noteworthy example is the Colorado AI Act, which was passed in May 2024 and is considered one of the first comprehensive AI regulations in the United States. The law will come into force gradually from June 30, 2026, and is aimed in particular at companies that develop or use AI systems that can have a significant impact on individuals.

Similar to the EU, the law focuses on so-called "high-risk artificial intelligence systems." These include, in particular, AI applications that are used in sensitive areas such as employment, lending, housing, healthcare, or education and can make automated decisions with potentially significant consequences for the individuals affected. The Colorado AI Act imposes a number of risk management and transparency obligations on developers and operators of such systems.

Among other things, companies must conduct risk assessments, analyze potential discriminatory effects, and implement appropriate risk mitigation measures. In addition, there are transparency obligations toward users and, in some cases, toward affected individuals, for example, when automated systems are used for decision support. The aim of the law is, in particular, to prevent algorithmic discrimination and ensure the responsible use of AI systems.

Compared to the European AI Regulation, the Colorado AI Act takes a more sector- and risk-oriented approach, but focuses primarily on avoiding discrimination risks and less on comprehensive technical requirements for AI systems. Nevertheless, the law shows that regulatory approaches to AI are also increasingly developing in the United States, albeit primarily at the individual state level so far.

V. Recommendations for action

The developments described above show that the legal framework for the use of AI is currently taking shape in several areas in parallel. Even though individual regulations are still in flux, concrete measures can already be derived that companies can use to reduce their legal risks when using AI.

1. Check AI systems early on for possible high-risk classifications

Against the backdrop of the AI Regulation, companies should analyze their existing or planned AI applications to determine whether they could potentially be classified as high-risk AI systems within the meaning of Art. 6 AI Regulation. This applies in particular to applications in the area of human resources, automated decision-making processes, or safety-related product contexts. Even if the application of the relevant obligations may be delayed due to the digital omnibus procedure currently under discussion, it is already to be expected that extensive requirements for risk management, documentation, and governance will take effect. Companies should therefore establish internal processes for classifying and evaluating AI systems at an early stage.

2. Review the use of copyright-protected content in AI applications

Recent case law from German courts and current initiatives at the EU level show that the handling of copyright-protected content in connection with AI systems is increasingly coming into focus. Companies should therefore review whether and to what extent protected content is processed when using generative AI for marketing, content creation, or software development, for example. This applies in particular to cases wh , texts, images, or music are fed into AI systems or processed by them. If necessary, appropriate rights of use or licenses should be obtained to avoid copyright risks.

3. Monitor the development of national and international AI regulation

In addition to the European AI Regulation, national supervisory structures and international regulatory models are also emerging. In Germany, the planned AI-MIG is currently creating the institutional framework for the supervision of AI systems. At the same time, other jurisdictions are developing their own regulatory approaches, such as the Colorado AI Act, particularly with regard to the risks of discrimination in AI-supported decisions. Companies that use or develop AI systems internationally should therefore align their compliance structures in such a way that the different regulatory requirements of various jurisdictions can be taken into account.

VI. Conclusion and outlook

The legal framework for the use of artificial intelligence is currently undergoing intensive development. In addition to the gradual implementation of the AI Regulation and possible adjustments within the framework of the Digital Omnibus procedure, initial guidelines are taking shape, particularly in copyright law, through case law and political initiatives at the European level. At the same time, national implementing laws such as the planned AI-MIG are creating the institutional basis for supervision and enforcement, while separate regulatory approaches are also increasingly emerging outside Europe.

For companies, this means that the legal framework for AI applications will continue to consolidate in the coming years. It is therefore to be expected that, in addition to new guidelines and technical standards, court decisions and further European legislative initiatives in particular will contribute significantly to the concretization of the framework. Companies are therefore well advised to continuously monitor regulatory developments and to align their internal processes with the foreseeable requirements at an early stage.

This article was created in collaboration with our student employee Emily Bernklau.