März 2026 Sicherheitsvorschriften: NIS2-Durchsetzung beginnt, DORA-Fristen nähern sich, DSGVO-Rekordbußgelder
Die NIS2-Richtlinie wird in den EU-Mitgliedstaaten durchgesetzt. DORA-Compliance-Frist rückt näher. DSGVO-Durchsetzung erreicht Rekordniveau mit 2,1 Mrd. € Bußgeldern. EU AI Act tritt in Anwendungsphase ein.
⚖️ NIS2 Directive: Enforcement Phase Begins
Compliance Deadline Passed — Enforcement Active
The NIS2 Directive transposition deadline passed in October 2024. EU member states are now actively enforcing cybersecurity requirements, with the first administrative penalties issued in Q1 2026. Organizations found non-compliant face fines up to €10 million or 2% of global annual turnover, whichever is higher.
NIS2 Scope & Requirements
The Network and Information Security Directive 2 (NIS2) significantly expands cybersecurity obligations across the European Union:
- Expanded sectors: Energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space, postal and courier services, waste management, manufacturing, food production, chemicals
- Supply chain: Organizations must assess and manage cybersecurity risks in their supply chains
- Incident reporting: 24-hour early warning, 72-hour incident notification, final report within one month
- Governance: Management body liability for cybersecurity failures
Recent Enforcement Actions
Germany issued its first NIS2 penalty in February 2026 to a mid-sized cloud service provider for failure to implement risk management measures and incident response procedures. Fine: €850,000.
France opened investigations into 14 entities across healthcare and digital infrastructure sectors for inadequate cybersecurity governance and missing incident reporting mechanisms.
Netherlands published compliance guidance requiring all essential and important entities to complete self-assessment by June 2026.
Action required: Organizations in scope must immediately implement NIS2 cybersecurity measures including risk management, incident response, business continuity, supply chain security, cryptography, access control, and vulnerability handling.
🏦 DORA: 9 Months Until Compliance Deadline
The Digital Operational Resilience Act (DORA) enters into force on January 17, 2025. Financial entities have less than 9 months remaining to achieve full compliance.
DORA Requirements Overview
| Pillar | Key Requirements |
|---|---|
| ICT Risk Management | Comprehensive framework covering identification, protection, detection, response, recovery, and learning capabilities |
| Incident Reporting | Major ICT incidents reported to supervisory authorities within strict timelines |
| Operational Resilience Testing | Regular testing including threat-led penetration testing (TLPT) for significant entities |
| Third-Party Risk | Management of ICT third-party providers with contractual arrangements ensuring oversight |
| Information Sharing | Participation in cyber threat intelligence sharing arrangements |
Who Must Comply?
- Credit institutions (banks)
- Payment institutions and e-money institutions
- Investment firms and crypto-asset service providers
- Insurance and reinsurance undertakings
- Pension funds
- Trading venues and central counterparties
- Trade repositories, central securities depositories
- Credit rating agencies
Critical ICT Third-Party Providers
DORA introduces a new oversight framework for critical ICT third-party service providers. Cloud providers, data center operators, and managed security service providers serving financial entities will face direct EU supervision and must register with the European Supervisory Authorities (ESAs).
Timeline pressure: Many financial institutions report significant gaps in DORA readiness, particularly around third-party risk management and operational resilience testing. Supervisory authorities are preparing for day-one enforcement.
🛡️ GDPR Enforcement: Record €2.1B in 2025 Fines
GDPR enforcement reached unprecedented levels in 2025, with EU data protection authorities issuing €2.1 billion in administrative fines — a 40% increase over 2024.
2025 Enforcement Trends
- Cross-border cases: 65% of major fines resulted from cooperation between multiple DPAs
- AI and automated decision-making: Significant focus on Article 22 compliance
- Data breach notifications: Increased penalties for late or incomplete breach reporting
- Transparency: Fines for unclear privacy policies and hidden data processing
- Children's data: Enhanced scrutiny of platforms and services targeting minors
Notable 2025 Enforcement Actions
€650M — Major social media platform (Ireland DPA)
Violations: Unlawful processing of personal data for behavioral advertising, inadequate legal basis, transparency failures
€425M — Global advertising technology company (France CNIL)
Violations: Real-time bidding data sharing without valid consent, inadequate data minimization
€380M — Healthcare AI platform (Germany)
Violations: Processing health data without adequate safeguards, automated decision-making without human oversight
Emerging Focus Areas for 2026
- AI and large language models: Data sources, training data rights, automated decision-making
- Cookie consent: Dark patterns, pre-ticked boxes, cookie walls
- Employee monitoring: Workplace surveillance, productivity tracking, biometric data
- International data transfers: Post-Schrems II compliance, adequacy decisions
🤖 EU AI Act: Application Phase Begins
The EU Artificial Intelligence Act entered into force in August 2024. Key provisions begin applying in phases through 2026-2027.
2026 Application Timeline
| Date | Provisions Applying |
|---|---|
| February 2026 | Prohibited AI practices (Article 5) |
| May 2026 | General-purpose AI model requirements (Chapter V) |
| August 2026 | High-risk AI system requirements (Chapter III) |
| August 2027 | Full application of all AI Act requirements |
Prohibited AI Practices (Now in Effect)
As of February 2026, the following AI systems are banned in the EU:
- Subliminal manipulation causing harm
- Exploitation of vulnerabilities (age, disability)
- Social scoring by public authorities
- Real-time remote biometric identification in public spaces (with limited exceptions for law enforcement)
- Emotion recognition in workplace and education (with exceptions)
High-Risk AI Systems Registration
Registration Opens Q2 2026
The EU AI Office will open registration for high-risk AI systems in Q2 2026. Providers must register systems before market placement. High-risk categories include: biometric identification, critical infrastructure, education/vocational training, employment, essential services, law enforcement, migration/border control, and justice/democratic processes.
General-Purpose AI Models (May 2026)
Providers of general-purpose AI models (GPT-4, Claude, Gemini, Llama, etc.) must comply with transparency requirements and, for systemic-risk models (>10^25 FLOPs training), additional obligations including:
- Model evaluations and adversarial testing
- Tracking and reporting serious incidents
- Cybersecurity protection of model weights
- Energy consumption reporting
📋 Compliance Checklist: Q2 2026
- NIS2 (Immediate):
- Confirm in-scope status (essential or important entity)
- Implement all 10 minimum security measures
- Establish 24/72-hour incident reporting procedures
- Document supply chain security assessments
- Ensure management body accountability mechanisms
- DORA (9 months remaining):
- Complete ICT risk management framework implementation
- Inventory all ICT third-party providers and assess criticality
- Update contracts with ICT service providers for DORA compliance
- Plan threat-led penetration testing (TLPT) for 2026
- Establish incident classification and reporting processes
- GDPR (Ongoing):
- Review AI/automated decision-making for Article 22 compliance
- Audit cookie consent mechanisms for dark patterns
- Update Records of Processing Activities (ROPA)
- Test data breach notification procedures (<72 hours)
- Review international data transfer mechanisms
- EU AI Act:
- Inventory all AI systems and classify risk levels
- Discontinue any prohibited AI practices immediately
- Prepare high-risk AI system technical documentation
- For GPAI providers: Implement transparency requirements
- Monitor EU AI Office guidance and registration timelines
⚠️ Regulatory Risk Assessment
High enforcement risk: Organizations operating in multiple regulated sectors (e.g., financial services + healthcare) face overlapping compliance obligations from NIS2, DORA, GDPR, and sector-specific regulations. Gaps in any framework create compounding regulatory risk.
Supply chain exposure: Both NIS2 and DORA impose explicit supply chain security and third-party risk management requirements. Organizations relying on non-compliant vendors inherit regulatory risk.
Cross-border complexity: Different EU member states are transposing and enforcing NIS2 at different paces, creating compliance complexity for organizations operating across multiple jurisdictions.