ENISA, NCSC and NIST Issue Cybersecurity Guidance as EU Cyber and AI Rules Advance
Summary
The newsletter covers new ENISA and NCSC security guidance, EU Cyber Resilience and AI Act implementation, a German ruling on GDPR damages after accidental disclosure, and NIST’s call to begin post-quantum migration planning.
Key points
- ENISA published a secure-by-design playbook for SME manufacturers, covering 22 practices and machine-readable evidence of security controls.
- European Commission guidance explains Cyber Resilience Act scope, compliance, and reporting duties, which begin on 11 September 2026; most obligations apply from 11 December 2027.
- UK NCSC guidance advises organizations recovering from disruptive cyberattacks to prioritize trusted identity, verify backups, coordinate recovery, and avoid restoring systems before investigating attacker access.
- Germany’s Federal Court of Justice found that accidental recruitment-data disclosure can support GDPR compensation when it causes actual harm, including loss of control and justified fear of misuse; it sent the damages question back to a lower court.
- Italy’s data protection authority recommended stronger privacy safeguards in draft national AI rules, including limits on biometric identification and greater human oversight.
- NIST urged organizations to inventory cryptographic systems, prioritize long-lived sensitive data, and plan phased post-quantum migration against the risk of harvest-now, decrypt-later attacks.
Article Details
- Event Type
- Publication of cybersecurity guidance and regulatory updates, alongside a court ruling on data-protection damages and recommendations for post-quantum cryptography migration.
- Impact
- The publications provide organizations with guidance on secure product development, Cyber Resilience Act and AI Act compliance, recovery from disruptive cyberattacks, and preparation for post-quantum cryptography. The German court ruling clarifies when accidental disclosure of personal data may give rise to compensation. No specific cyberattack or operational impact is reported.
People
Countries
Industries
Educationincluding the designation of national authorities, market surveillance, regulatory sandboxes, AI in education and employment, and coordination among regulators. The draft designates the Agency for Digital ItalyFinancial ServicesLaw enforcementThe second opinion addresses the use of AI by law enforcement authorities. It establishes rules governing AI systems used for policing, biometric identification and criminal investigations while attempting to align