FAQs

Q: What specifically must companies have implemented by August 2026?

By the main deadline of August 2026, companies must have inventoried, evaluated and documented their AI applications. This includes in particular an AI inventory with risk classification (low, transparent, high, inadmissible), defined roles and responsibilities (e.g. according to the RACI model), an approval process for new AI use cases, Policies for data access, logging, documentation and incident management, Proof of AI literacy (basic skills in dealing with AI). The first partial obligations will already apply from 2025 - such as transparency for general-purpose AI (e.g. GPT models).

Q: What exactly are passkeys and how do they differ from passwords or classic MFA?

Passkeys are based on the FIDO2 standard ("Fast IDentity Online") and completely replace the traditional password. In contrast to conventional multi-factor authentication (MFA) , passkeys are phishing-resistant because no password or code is transmitted. Instead, a public and a private cryptographic key are used - the private key remains securely on the user's device (e.g. smartphone or laptop). Microsoft integrates Passkeys directly into Entra ID (formerly Azure AD) and thus enables login via Face ID, fingerprint or device PIN - securely, quickly and without a password. Info from FIDO Allicance about this: Passkeys

Q: What responsibility does the management have for NIS2 implementation?

NIS2 clearly shifts responsibility to management level: Managing directors and board members must ensure that information security is organizationally anchored and adequately funded. Delegation to the IT department alone is no longer sufficient - management remains liable if measures are not taken. In concrete terms, this means Information security is becoming a top priority. Documented policies and responsibilities are needed. Verifiable training for management and employees is mandatory. This responsibility is also made clear in the BSI's training material for managing directors .

Q: What are the risks of not implementing NIS2?

The directive provides for significantly higher fines than before - up to €10 million or 2% of global annual turnover (whichever is higher). In addition, the personal liability of the management may apply if gross negligence is committed or supervisory duties are breached. Furthermore, there is a risk of reputational damage and exclusion from supply chains if customers or clients demand NIS2 evidence.

What specifically must companies have implemented by August 2026?

What exactly are passkeys and how do they differ from passwords or classic MFA?

What responsibility does the management have for NIS2 implementation?

What are the risks of not implementing NIS2?

Passkeys in Microsoft – These are your options

Update vs Upgrade – What’s the difference?

SOCIAL MEDIA

LEGAL

CONTACT