Alexander Aigner

Guidelines on Recommended Technical and Organizational Measures for the Development and Operation of AI Systems The Conference of Independent Data Protection Supervisory Authorities of the Federal and State Governments in Germany has published the "Guidelines on Recommended Technical and Organizational Measures for the Development and Operation of AI Systems" (Version 1.0, June 2025). This document provides guidance for manufacturers and developers of AI systems, ensuring compliance with data protection laws throughout the AI lifecycle. Key Points: - Detailed requirements for data protection in AI systems - Recommended technical and organizational measures - Lifecycle phases of AI systems: Design, Development, Implementation, and Operation - Glossary of essential terms and concepts It has been translated using DeepL. Please read it with care.

104

3 Kommentare

Invitation: #SBOM and #CSAF Matchingsystem for #Dependency-Track The Federal Office for Information Security (BSI) invites to a presentation of the project "Integration of CSAF in OWASP Dependency-Track" (CSAF SBOM Matchingsystem) by Fraunhofer AISEC (Fraunhofer Institute for Applied and Integrated Security). Aim of the project -> extend Dependency-Track -> possibility to match SBOMs against CSAF files -> ability to link a component (SBOM) to vulnerabilities during product lifecycle Find more information here: https://lnkd.in/eZ2qZPA8

100

7 Kommentare

NIS2, ISO 27001, GDPR, same game? Not quite. Why NIS2 is not just another compliance checklist.👇 Most frameworks are about what to protect. NIS2 is about what must keep working — no matter what. Let’s break it down: - NIS2 A European directive designed to protect critical functions (Healthcare, Energy, Water, Public administration, Food supply) in society. 👉 Not about personal data. 👉 Not just about IT. 👉 It’s about organizational resilience — and leadership responsibility. - ISO 27001 A structured, certifiable standard to build a risk-based security management system. 👉 Strong on governance, repeatable processes, and continuous improvement. - GDPR A legal regulation focused on protecting individuals’ personal data. 👉 Think consent, rights, and accountability for how data is handled. Here’s what sets NIS2 apart 👇 It's not a tech checklist. It’s a cultural stress test. It’s not a legal formality. It’s a governance challenge. It’s not IT's job. It’s the leaders accountability. Too often, NIS2 gets delegated: - IT focuses on patching systems. - Legal debates liability. - InfoSec buries itself in frameworks. And yet no one connects the dots. No one holds the narrative. No one asks: what happens when it breaks? NIS2 is asking leaders: What are your real digital dependencies? Can your business survive a cyber incident without chaos? Do you train for recovery, not just for control? The directive doesn’t care about perfect documentation. It cares about reflexes when the pressure hits. Compliance? That’s the byproduct. The real value is resilience, trust, and competitive edge. Live NIS2 , don’t just “tick” it. It’s not a law for lawyers. It’s a call for leadership. Follow for more on security, risk & compliance 🙂 . Repost to help others navigate the landscape.

73

❓ What kind of Cyber Resilience Act guidance will the EU Commission publish - and when? ❓ One complaint I frequently hear about the CRA is that it's "too vague". The default answer to many questions, "the EU Commission plans to publish more guidance", is understandably a source of frustration for manufacturers who want to begin their CRA compliance journey NOW. Because changing product strategies, characteristics, and development all take time, so December 2027 isn't that far off... So, what guidance will actually be published - and, most importantly, when? During the first meeting of the CRA Expert group, the EU Commission brought a bit more clarity to that question. The minutes are public, and I'll share the link in the comments, but here's the destillate: The creation of some additional guidance is mandated in the CRA (article 26), so this will definitely happen: 💡 scope: guidance will help determine when remote data processing solutions and free and open-source software is in scope of the CRA, and probably do the same for some more edge cases. Also, a delegated act will define the important and critical products. 💡 support periods: the support period is the period during which free security updates must be provided, and manufacturers can determine the length of the period themselves. Guidance will indicate reasonable support periods for specific product categories. 💡 interplay with other legislation: Guidance will help manufacturers navigate overlapping requirements with other EU acts, especially RED (which is pressing for many manufacturers since the RED deadline is Aug 1, 2025), DORA, AI Act, and machinery regulation. 💡 substantial modification: this matters because it's the only way the CRA may apply to legacy products - if they're subject to "substantial modification". Guidance will clarify what modification qualify as "substantial". In addition, the EU Commission has identified some more fields based on industry feedback where guidance may be needed: 💡 reporting obligations: which incidents exactly need to be reported and with how much detail? 💡 due diligence: manufacturers need to do "due diligence" regarding the product security in their supply chain - what exactly does that mean? 💡 risk assessment: risk assessments based on the intended purpose and reasonably foreseeable use of the product must be carried out for all CRA-affected products. This is uncharted territory for many product manufacturers, especially smaller ones. And what about the "when"? Well, for most documents, there is no specific due date. But the Commission has done a prioritization, and this indicates what will come out first - I'm guessing roughly "later this year": ⭐ all guidance around scope (important and critical products (due on 11 Dec 2025), remote data processing solutions and open source). ⭐ guidance around risk assessments.

174

24 Kommentare

❓ Which digital products will fall under the Cyber Resilience Act (CRA)? ❓ Are the definitions of "important" and "critical" products clear enough? These were key questions we’ve had since the CRA was adopted. Now, the European Commission has published draft Annexes to the Implementing Regulation, providing clearer classifications of important and critical products with digital elements. 🔹 Important Products (Annex I) include: --> Identity & Access Management: Biometric readers, authentication tools, privileged access management --> Security & Privacy Software: Password managers, VPNs, antivirus, SIEM systems --> Network & Communication: Routers, modems, network interfaces, operating systems --> Hardware Security: Microprocessors, microcontrollers, ASICs & FPGAs with security features --> Smart Devices: Home security systems, wearables, and IoT devices 🔹 Critical Products (Annex II) include: --> Hardware Security Modules (HSMs) & Payment Terminals --> Smart Meter Gateways for energy infrastructures --> Smartcards & Secure Elements (TPMs, eSIMs, payment & access cards) #CyberSecurity #CyberResilienceAct #EURegulation #DigitalSecurity #CRA

39

4 Kommentare

🚨BIG: Healthy Relationships - generating Synthetic Data in light of the GDPR The word ‘synthetic’ comes from the Greek ‘syntithenai’ - which in turn means to ‘put together’ or ‘combine’. This etymology well matches the definition of synthetic data provided by the EDPS - European Data Protection Supervisor whereby this data is generated by means of a combining ‘original data and a model that is trained to reproduce the characteristics and structure of the original data’. #Synthetic #data is useful in all cases whereby a pattern can be inferred by analysing data, but using the original data would significantly impact upon the individual’s right to privacy and data protection under the #GDPR. 💡And what better use of synthetic data than in the #healthcare sector? Synthetic data presents great opportunities for pattern recognition purposed to developing new cures and treatments without all the compliance-related fuss that comes from processing #sensitive #data. That’s because synthetic data processing is merely subject to privacy assurance procedures, which evaluate whether data subjects can be identified. If not, the data does not fall within the scope of Article 4(1) of the GDPR! 🎙️ The Status of Synthetic Data: a surgical analysis of the GDPR In theory, synthetic data should not lead to identifying the natural person to whom the original data which composes it was related in the first place. This paper presents an in-depth evaluation of the provisions in the #GDPR - interpreting them in relation to the #AI #Act to determine if synthetic data is nothing #personal! 🔎 Method The paper identifies the legal provisions that apply to the processing of synthetic data in the #EU. Identifiability in synthetic data is crucial to determining whether its processing must comply with the #GDPR. Thus, the study sets up a Membership Inference Attack simulation to infer patient ID in the original dataset used for synthetic data generator #training from that data. 🚨 Personal data is ‘ill’-defined! The researchers find that the processing of synthetic data should not fall under the scope of the #GDPR. The reason why some aspects of the definition of personal data in Article 4(1) apply to this type of data depends on the absence of a ‘clear delineation between personal data and anonymous data in circumstances where additional information that can aid identification is accessible’. In line with the #CJEU consideration that full anonymity is simply infeasible, the paper argues for a privacy assurance process that considers the likely scenario of what identification information a potential attacker may have access to, rather than the mere existence of an original dataset. 👉🏼 When it comes to synthetic data, the benefits massively outflank the risks! The #GDPR must be interpreted in light of the positive impacts of data processing - not in fear of the remotest threats to privacy! CC: Peter Hense 🇺🇦🇮🇱 Sofia Palmieri Chiara Gallese

63

5 Kommentare

📺📲Smart TVs, now a fixture in European households, do far more than stream shows and films—they quietly generate constant flows of personal data, even when switched off. A joint investigation by Autoriteit Persoonsgegevens (Dutch DPA) The Italian Data Protection Authority Datenschutzstelle Liechtenstein and Hungarian DPA has exposed the hidden complexity of this ecosystem. Traffic analysis of three leading models showed that significant volumes of personal data - IP addresses, device identifiers, account and advertising IDs, usage metrics and more - are transmitted not only during installation and regular use, but also in stand-by mode and while the devices are off. These data streams feed multiple purposes: enabling services, identifying users, measuring consumption, delivering recommendations and fuelling targeted advertising. All devices investigated exhibited this behaviour, with transmissions directed to manufacturers, operating system providers, streaming platforms and third-party networks. The report highlights the opacity of the smart TV ecosystem, where numerous actors interact - manufacturers, OS developers, app providers, advertisers and data brokers. Legal roles are fragmented: manufacturers often present themselves as controllers only for narrow parts of processing, despite triggering wider data flows through agreements with partners. In practice, they shift responsibility onto third parties, leaving consumers with little clarity on who controls their data. Authorities also raised concerns about pre-installed applications, sometimes impossible to uninstall, which collect data regardless of whether consumers actively use them. In some cases apps were automatically installed without any choice, a practice that directly conflicts with data minimisation and informed consent principles. The investigation further confirmed that device makers not only profit from sales but also monetise user data, positioning the consumer simultaneously as customer and revenue source. The report concludes that smart TV ecosystems are structurally opaque, with blurred lines of controllership and systemic risks to transparency and accountability. dividual follow-up investigations, but the findings already illustrate the urgent need for stricter oversight, clearer allocation of responsibilities and stronger safeguards for data subjects in the era of connected devices #gdpr #rodo #privacy #iot

34

2 Kommentare

App permissions do not satisfy the requirements for valid consent for the purpose of GDPR because they lack sufficient detail and granularity - says CNIL - Commission Nationale de l'Informatique et des Libertés. US companies: The same logic applies regarding use of app permissions for "Do Not Sell" or consent for sensitive information (e.g. precise location, biometrics) under the US laws. You may need your own supplemental disclosure/consent if you cannot edit the permissions' text. Key points: 🔹 Permissions are only intended to give or block access to the protected resources and information of the mobile device, regardless of the purposes pursued by the publisher of the application. 🔹 You can use them when consent is not necessary (e.g. collection of location data to make a navigation app work) 🔹 When consent IS required, a simple request for permission is sufficient only in limited cases, for example, if the permission relates to a single processing, a single purpose and a single recipient of the data. 🔹 In most cases, it is necessary to use a consent management platform in addition to the permission request 🔹 CNIL recommends to OS vendors to give controllers flexibility re structuring permissions. 🔹 Controllers using both a CMP and a request for permission must present them in a way that is not confusing for the user. 🔹 Consent can be obtained either before or after the request for permission, but the user must understand what's going on. #dataprivacy #dataprotection #privacyFOMO pic by ChatGPT

83

1 Kommentar

𝗚𝗲𝗿𝗺𝗮𝗻𝘆'𝘀 𝗗𝗶𝗴𝗶𝘁𝗮𝗹 𝗦𝘂𝗿𝘃𝗲𝗶𝗹𝗹𝗮𝗻𝗰𝗲 𝗧𝗼𝗼𝗹𝗸𝗶𝘁 𝘐𝘯𝘤𝘳𝘦𝘢𝘴𝘦𝘥 𝘜𝘴𝘢𝘨𝘦 𝘰𝘧 𝘵𝘩𝘦 𝘚𝘵𝘢𝘢𝘵𝘴𝘵𝘳𝘰𝘫𝘢𝘯𝘦𝘳 State surveillance software, or "Staatstrojaner", functions similarly to conventional malware, enabling unauthorized access to a target's device to monitor communications and extract data. In #Germany, the Federal Office for the Protection of the Constitution (#BfV) has increasingly utilized such tools to intercept encrypted communications, such as those on WhatsApp or Telegram, by deploying spyware directly onto its civilians' devices. This approach allows for real-time surveillance and retrospective analysis of chat histories. The legal framework for such operations was established in June 2021, permitting intelligence agencies to conduct "Quellen-Telekommunikationsüberwachung". This method captures communications at the source, either before encryption or after decryption, thereby circumventing traditional encryption barriers. According to CypSec Group's analysis, the BfV employed this technique against over 6.000 civilians in 2024, facilitating the automated monitoring of their communications. Law enforcement agencies have also adopted these tools under the provisions of the Code of Criminal Procedure since 2017. Unlike intelligence services, police are authorized to perform "Online-Durchsuchung" (online searches), granting them broader access to stored data, including documents, images, and other files. However, the deployment of such software remains relatively infrequent, with official statistics reporting 49 instances of source telecommunications surveillance and six online searches in 2022. The deployment of state surveillance software raises significant cybersecurity and ethical concerns. These tools often exploit undisclosed vulnerabilities in software, which, if left unreported, can be used by malicious actors, thereby increasing the overall risk to digital infrastructure. These tools have been implicated in surveillance activities by intelligence agencies targeting journalists, activists, and political opponents, such as the Alternative für Deutschland (#AfD) Many instances have been documented where such tools have been repurposed by unauthorized parties to install additional malware, conduct unauthorized surveillance, or exfiltrate sensitive data. The lack of transparency and accountability in the deployment undermines public trust and poses challenges to democratic oversight. The inherent capabilities of such #spyware, including keylogging, screen capturing, and remote activation of microphones and cameras, amplify the potential for political and economic abuse. The increasing utilization of state surveillance software by German intelligence and law enforcement agencies thus severely undermine individual rights. #StateSurveillance #DigitalRights #PrivacyProtection

36

4 Kommentare

NIS2_ TECHNICAL IMPLEMENTATION GUIDANCE This document provides technical implementation guidance from the European Union Agency for Cybersecurity (ENISA), detailing cybersecurity risk management measures mandated by the NIS2 Directive for key sectors and digital infrastructure entities.

25

1 Kommentar

🔐Data Protection Impact Assessment (DPIA): A Proactive tool for Data Protection Compliance🔐 In today's digital age of data mining and Large Language Models, safeguarding sensitive personal data is not just a regulatory requirement but a fundamental responsibility. Data controllers and processors are tasked with conducting DPIAs as part of compliance with data protection laws. A DPIA is a process designed to help organizations identify and mitigate data protection risks and threats of a new project, system, product or data processing activity before implementation. By conducting a DPIA, data controllers achieve: ⚖ Legal compliance: conducting a DPIA is a data protection compliance requirement in the Kenya Data Protection Act of 2019. 🔍 Mitigation of Data Privacy Risks: DPIAs help organizations to analyze how personal data is handled while identifying potential risks and threats that the personal data is exposed to. Necessary safeguards are then implemented before implementation of the data processing activity. 💡 Transparency: customers, clients and stakeholders are informed about the level of data protection safeguards deployed by your organization thus maintaining their trust. 🔄 Culture of Privacy: Encourages proactive privacy practices within your organization and ensures all staff members understand the importance of data protection. Failure to conduct DPIA has been a stumbling block for the Government of Kenya in the roll out of digital identification system dubbed Maisha Namba. Non-compliance with the Data Protection( Civil Registration) Regulations 2020 in the roll out of Maisha numbers, ecosystem and cards —Haki na Sheria Initiative v Attorney General & 4 others ( Petition 196 of 2023) [2024] KEHC 10021 (KLR) (Constitutional and Human Rights)— was among the grounds relied on in seeking conservatory orders against rolling out of the Maisha Namba ecosystem. Despite the High Court dismissing the Application for conservatory orders, concerns on proper conducting of a DPIA were raised. A DPIA is thus not just about compliance – it’s about building trust with your stakeholders, protecting your organization from data breaches, and demonstrating your commitment to privacy. 🌐🔒 🛑What is a DPIA?  🛑How does one conduct a DPIA?  🛑When is a DPIA conducted?  🛑Why is a DPIA conducted?  I'm excited to share insights on DPIAs to create stronger and safer data protection practices in our increasingly digital world. #DPIA #DataProtection #DigitalPrivacy #DataCompliance #MaishaNamba

140

4 Kommentare

The new #EU Product Liability Directive #PLD, enforced in November 2024, introduces significant changes, including new requirements on #Cybersecurity. Notably, Article 7 2 (f) classifies #safety-relevant cybersecurity requirements as defects. This shift has profound implications for the automotive industry, particularly in the context of #ISO21434. ISO/SAE 21434 provides a comprehensive framework for managing cybersecurity risks in road vehicles, covering the entire #lifecycle from concept to decommissioning. With the new directive, manufacturers must ensure their cybersecurity measures meet these stringent requirements to avoid liability for defects. How will this directive impact the development and implementation of cybersecurity measures in the #automotive sector? What challenges do manufacturers face in aligning with both the PLD and ISO/SAE 21434 standard? Could this lead to increased innovation in automotive cybersecurity solutions? Let's discuss the future of automotive cybersecurity in light of these new regulation! https://lnkd.in/dmp2M3vq #AutomotiveCybersecurity #ISO21434 #ProductLiability #Innovation #CyberRiskManagement

37

6 Kommentare

3/3 EU Code of Practice for GPAI Models: Safety & Security Chapter The final chapter of the EU’s voluntary Code of Practice for General-Purpose AI (GPAI) models sets out systemic risk requirements for providers whose models meet the threshold under Articles 55–56 of the AI Act. 🔍 Now covering: Safety & Security Chapter ▶ Providers of GPAI models with systemic risk must adopt a Safety and Security Framework, covering the full model lifecycle — from development to deployment and post-market monitoring. ▶ The framework must include: • A process for identifying and analysing systemic risks • Risk-tiering and acceptance criteria • Justification for model release • Continuous assessment and updates ▶ Providers must implement safety mitigations (e.g. fine-tuning, content filters, staged access) and security measures (e.g. protections against unauthorized access or model theft), proportionate to model capabilities. ▶ Independent external evaluators must be granted structured access for risk testing. A Model Report summarizing risks, safeguards, and release rationale must be submitted to the AI Office. 📚 The AI Policy Newsletter: https://lnkd.in/eS8bHrvG 👩‍💻 The AI Policy Course: https://lnkd.in/e3rur4ff 🌐 Learn more about Duco: https://lnkd.in/dYjyKhBd

35