BSI Issues CRA Guidance as Courts and Reports Address Privacy and AI Security

Summary

A roundup covers Germany’s CRA and SBOM guidance, Czech and Hungarian data-protection decisions, and reports on AI governance, privacy, agentic-system risks, and security.

Key points

• Germany’s BSI published CRA manufacturer guidance and updated its SBOM specification, with reporting obligations for actively exploited vulnerabilities and severe incidents beginning September 11, 2026.
• The Czech Supreme Administrative Court held that whether pseudonymized data is personal data depends on the recipient’s reasonably available means of identification.
• Hungary’s data-protection authority fined an online retailer HUF 2 million over inaccurate, incomplete and template-generated privacy information.
• The Network Advertising Initiative recommends risk-based controls for AI in advertising, including least-privilege permissions, oversight, audit logs and safeguards for consumer privacy signals.
• A UN scientific panel warned that agentic AI can create new attack surfaces; it cited attacks manipulating coding agents through external content and AI capabilities that can help discover vulnerabilities or produce exploits.
• The UN panel also identified privacy, monitoring and accountability challenges, while calling for stronger independent evaluation and ongoing assessment of AI systems.
• A Stanford HAI policy brief calls for risk-based governance of AI world models, including independent testing, physical validation and protections against spatial privacy risks.

Countries

Industries