Search results for

Dr. Dorothee Altenburg represents clients in all aspects of intellectual property law. She is particularly experienced in the area of trademark law. Operating in Germany as well as internationally, Dr. Altenburg devises legal strategies to establish and defend trademarks, design rights, and patents. She represents clients before the relevant authorities in Germany, in the European Union, and in WIPO proceedings. She conducts trademark registrations worldwide. She has substantial experience in drafting licensing agreements. She is acquainted with the litigation issues that arise in the environs of intellectual property and (unfair) competition law. She represents clients before customs authorities counterfeiting cases. She also coordinates EU-wide customs seizure proceedings against counterfeit products.

Dr. Altenburg further represents publishers, media companies, and artists in matters to do with copyright, publishing law, and personality rights. 

Nikolaus Bertermann has been a lawyer for a Europe-wide leading internet service provider for ten years and can therefore rely on in-depth technical expertise, a sound knowledge of the IT industry, and many years of experience as a company lawyer.

He provides comprehensive advice on all forms of classic and agile software creation and IT project contracts, the use and adaptation of open source software, and cloud computing within and outside the EU.

Mr. Bertermann conducts data protection audits, advises companies on the legally compliant design of data processing procedures within and outside corporate structures, and accompanies clients in projects to implement the requirements of the EU General Data Protection Regulation. He commented on the central provisions of the GDPR for publishing house C.H.Beck.

Eva Bonacker advises German and international clients on diverse matters of competition, M&A, corporate and general commercial law, with a special focus on European and German antitrust and competition law.

Eva Bonacker has advised clients from various industries including media, IT and software, e-commerce, publishing, information and business intelligence, energy, climate technology, and consumer goods.

Dr. Mathias Pajunk advises on all issues of public commercial law. The main focus of his work lies on advising public authorities on the award of public contracts and service concessions. This includes the monitoring of awards at all stages, including the drafting of contracts. At the same time, Dr. Mathias Pajunk represents both public authorities and bidders in the context of review proceedings. His other fields of activity include dealing with complex issues in the areas of state aid and antitrust law.

Dr. Brock specializes in IP law (trademarks, patents, designs, copyright law, etc.), unfair competition law (including advertising law), IT law, data protection law as well as distribution and contract law.

He advises comprehensively on IP matters, including the filing of national and international intellectual property rights as well as licensing and enforcement in disputes in and out of court. He further advises on innovation and know-how protection (including trade secrets), on cross-border research and development projects, on employees’ inventions law, and on standard essential patents (SEP). Furthermore, his advice includes the development of brand-based labeling and quality seal systems.

While his client base covers a wide selection of industries (for instance health care & life sciences, information technology and consumer goods), he focuses on technology-driven and innovative companies, ranging from start-ups to mid-sized companies to globally operating corporations.

Dr. Oliver M. Bühr has been advising on IT matters for many years. This includes software, hardware, projects, and outsourcing. He frequently supports his clients in all matters relating to data protection, especially in the implementation of the GDPR. He also has extensive experience in e-business and advises companies on designing their offerings on the internet. Innovative topics such as cloud computing or the advising of FinTechs are also a key part of his work. Many of the projects on which he advises have an international dimension, and he works closely with lawyers from foreign legal systems.

As a notary, he works particularly in the areas of property law, corporate law, and inheritance law.

Markus von Fuchs advises in intellectual property law, in particular in competition, patent, and trademark law as well as on the protection of know-how. He advises companies on protecting and commercially exploiting intellectual property, for example through licensing, sales, R&D, and cooperation agreements. He also focuses on the judicial and extrajudicial defense of intellectual property rights in interim injunction and principal proceedings. He further advises on border seizing procedures, initiates and advises on criminal measures relating to product and brand piracy, and on the infringement of business and business secrets. Markus von Fuchs also advises many companies on developing and introducing new technologies and business models. He has particular expertise in the optical and medical technology sectors.

Christoph Haesner’s work comprises the entire range of media law, copyright law, and entertainment law. He advises clients in the fields of film and TV, and in sales and licensing on legal issues at all stages of development, production, distribution, and evaluation of audiovisual productions, both nationally and internationally.

His work focuses on all matters pertaining to movie financing, not only for purely national projects, but also for those with major international connections.

He also advises on transactions (M&A) in the media sector. Christoph Haesner regularly supports companies throughout the transaction phase and advises on all matters arising from M&A transactions, under corporate law, contract law, copyright law, and media law.

Dr. Johann Heyde provides comprehensive legal advisory throughout media and entertainment law, in which film and television compose a main focus of his practice. Mr. Heyde advises on all aspects of national and international film and TV productions from film financing and subsidization, right clearance particularly in terms of copyright and privacy law, as well as licensing and exploitation of such productions.

Moreover, Dr. Johann Heyde’s advisory work spans all levels of digital commerce and business with a particular emphasis on improving internet portals, online services and other digital media (including on- demand platforms) and counseling on all relevant legal issues in e-commerce, some of which include terms and conditions, consumer protection, advertising and competition law, licensing and the dissemination of all forms of content over the internet.

Dr. Johann Heyde’s expertise includes his command of music law and especially collecting societies law in particular with respect to digital media.

Dr. Magnus Hirsch advises both German and international clients on a wide variety of matters which fall within the area of trademarks, designs, copyrights, patents, and unfair competition – in both preventative and contentious situations.

He also has more than 25 years of intellectual property litigation experience, having worked on numerous litigation matters regarding all kinds of IP issues and has appeared in many Federal District Courts, as well as Courts of Appeal, throughout Germany, and has represented several clients in proceedings up to the Federal Court of Justice.

In particular, his specialization comprises portfolio management as well as enforcing clients’ rights against counterfeiters, parallel importers and domain name pirates, both through court proceedings, as well as international dispute systems. Mr. Hirsch also represents clients before the German Patent and Trademark Office and the European Union Intellectual Property Office (EUIPO) registering or opposing German national trademarks and Community Trade Marks, respectively. He also has significant experience in drafting IP-related agreements, such as trademark license agreements, priority agreements and agreements with publicity agencies.

A further focus lies in the field of trademark and competition infringements on the Internet, in particular in the conduct of litigation in and out of court, also in connection with Internet domains, as well as the litigation of patent infringements.

Dr. Magnus Hirsch spent several months practicing at the Hong Kong office of an international law firm where he focused on Asian IP law, especially the enforcement of intellectual property rights in and out of court and the prosecution of product piracy and trademark counterfeiting in Southeast Asia.

Dr. Oliver Hornung advises national and international IT service providers and users in the legal structuring and negotiation of IT, project, and outsourcing contracts, as well as in matters of copyright and licensing. He is also regularly involved in distressed projects (dispute management) and advises clients in conciliation and arbitration proceedings and, where necessary, in litigation.

The regulatory environment for the use of data and corresponding technologies is complex and new legal acts are constantly being added by the European Commission. In this dynamic environment, Dr. Oliver Hornung advises his clients on all legal issues, in particular with a focus on AI compliance, Data Act, NIS-2, cyber security, cloud computing and data law.

Another focus of his legal advice is data protection with a focus on digital health and the EU's Digital Decade. If necessary, Dr. Oliver Hornung and his team defend the rights of his clients before supervisory authorities or in court.

Finally, Dr. Oliver Hornung advises start-ups on all questions relating to IT law and data protection law. In addition to his extensive practical work, Dr. Oliver Hornung is also a frequently requested lecturer in IT law and data protection law.

Klaus Jankowski advises on complex investment projects and company settlements, with a focus on public building and planning law.

For several years, he has also been advising the public sector on legislative projects and sensitive infrastructure projects.

He plays a leading role in the international network of lawyers First Law International and has excellent contacts to law firms worldwide.

Dr. Bernd Joch advises on corporate restructuring in employment law and corporate law, conducts balancing of interests and social plan negotiations, and represents his clients in arbitration proceedings.

He has many years of experience in advising companies, executive board members, general managers, and employees, in particular also in the field of dismissal protection matters.

In the area of commercial law, he advises and represents companies, in particular, in the areas pertaining to agencies and representatives.

René M. Kieselmann specializes in EU public procurement law and associated legal fields. Among others he is a member of SKW Schwarz’s IT & Digital Business and Life Sciences & Health Practice Group and has wide-ranging technical expertise in various areas. In addition to IT law, he advises on state aid law, subsidy law/grant law, and on rescue services and civil protection, i.e. the prevention of health hazards. Jointly with his team he is designing complex public procurement projects. René Kieselmann ensures adequate communication between bidders and clients, constructively conducting negotiations. SKW Schwarz advises on major bidding projects, including in the housing, in healthcare/pharmaceuticals and IT/banking sectors. He is also familiar with the structures of rescue services, civil protection, and disaster control as well as the regulatory context (SGB). Here he constructively designs award procedures on a long-term basis (“planning model”). In this connection, he also deals with issues of medical law ranging from emergency physicians to paramedics. While he is not litigating in court or before the Public Procurement Tribunal frequently, he has nevertheless gained considerable forensic experience since 2009, including at the Court of Justice of the European Union.

Norbert Klingner specializes in national and international movie/TV and advertising film production, financing, insurance, and distribution. He represents well-known producers, distributors, global distributors, and movie financing entities. His expertise ranges from negotiating and drafting contracts from the beginning of the material development to all matters related to production and financing up to the strategically correct exploitation and licensing. A selection of the film productions in which Mr. Klingner was involved can be found on the Internet Movie Database IMDb.

Margret Knitter advises her clients in all matters of intellectual property and competition law. This includes not only strategic advice, but also legal disputes. Her practice focuses on the development and defense of trademark and design portfolios, border seizure proceedings and advice on developing marketing campaigns. She advises on labelling obligations, packaging design, marketing strategies and regulatory questions, in particular for cosmetics, detergents, toys, foodstuffs and Cannabis. She represents her clients vis-à-vis authorities, courts and the public prosecutor's office.

In the field of media and entertainment, she mainly advises on questions of advertising law, in particular product placement, branded entertainment and influencer marketing. She is a member of the board of the Branded Content Marketing Association (BCMA) for the DACH region and member of the INTA Non-Traditional Marks Committee.

Dr. Olaf Kreißl is a notary and lawyer specialising in real estate, corporate and inheritance law. He provides support in real estate transactions, property development projects, land and residential property purchase agreements, corporate transactions (M&A) and all corporate law matters (corporate housekeeping, capital increases, conversion and restructuring measures, etc.). In the area of asset management and succession planning or anticipated succession, he drafts and certifies gifts, wills, marriage contracts, divorce agreements, and powers of attorney for precautionary and special purposes.

He also has many years of legal expertise in the field of real estate management and private construction and architectural law.  The focus here is also on advising on legal issues in connection with the management of real estate (commercial leasing, asset management, etc.), the realisation of construction projects and the drafting and negotiation of the corresponding real estate-specific contracts. 

Stefan Kridlo regularly advises national and international companies on all material issues of business law, commercial law, and corporate law, in particular also on corporate acquisitions.

The main focus of his many years of work is the support of real estate investors pertaining to real estate transactions and real estate portfolios, their structuring and administration. Stefan Kridlo worked as a notary until April 2025 in the areas of corporate law, real estate law and inheritance law. He also works as an executor.

Sabine Kröger is a Certified Expert for Commercial and Corporate Law as well as for Banking and Capital Markets Law and advises and represents national and international companies, executives and shareholders comprehensively in the field of corporate law and banking law.

As an experienced litigator, she also comprehensively represents her clients in court (corporate litigation / banking litigation).

Ms. Kröger's activities focus in particular on:

• advising and representing mid-sized enterprises (SMEs) or their managing directors or shareholders in shareholder disputes and internal company disputes;
• the assumption of committee representation for shareholders;
• advising and representing financial investors and credit institutions in the field of credit law and collateral security law and in defending claims of clients/investors, including the representation in mass claim proceedings.

Eberhard Kromer’s traditional focus in media law is entertainment and music. He counsels artists, publishers, labels, internet service providers, managements, as well as tour promoters. He has been active and well-versed in digital commerce issues since the inception of the internet. Eberhard’s practice is constantly affected by rapidly changing e-commerce models, social media platforms and ongoing digitization (Web 4.0, Internet of Things).

Dr. Kromer’s many years of experience as General Counsel and VP Business Affairs for a global media corporation give him the insight to recognize a corporation’s operational strengths and weaknesses. This enables him to find the best solution together with and for the client.

Franziska Ladiges advises clients on all questions of IT and data protection law. Thanks to secondments and many years of experience, she has in-depth knowledge of data protection. In this area, she supports companies (from small businesses to listed companies) from various industries with the implementation of data protection compliance. In addition, she advises on various individual data protection issues, including order processing, data subject rights and international data transfer. Finally, she regularly carries out data protection quick checks for companies on site.

In addition, Franziska Ladiges has experience in drafting contracts regulating the creation, use or transfer of software. She also drafts and reviews general terms and conditions (both purchasing and sales and internet platforms) and advises on the development of online shops and internet platforms. She often represents her clients before state courts in contract disputes or data protection matters.

In the area of private clients, Christoph Meyer has special expertise in establishing and managing family foundations, the creation of succession rules for medium-sized companies and high-net-worth individuals, as well as in all matters pertaining to family law, with a focus on more complex asset situations. The drafting of wills, powers of attorney, and marriage contracts also play an important role, with a considerable proportion of cases having international relevance. Should amicable solutions not be achievable, Mr. Meyer advises the clients, with careful strategic and tactical planning, but also with the required readiness to resolve disputes, through possible legal proceedings before civil and financial courts.

Dr. Ulrich Muth advises companies, in particular banks and financial service providers.

In particular, he specializes in consulting for creditors of loan claims secured by real estate, in the monitoring of credit and reorganization negotiations, in the prevention of damage claims on account of alleged breaches of the duty of disclosure and consultation as well as in the enforcement of creditor interests in the event of the insolvency of the debtor. Based on many years of experience of proceedings in the fields of banking, commercial and company law, as well as in disputes involving competition law, Dr. Muth works together with the clients to develop economic solutions for avoiding legal disputes as well as efficient trial strategies.

Dr. Matthias Nordmann advises international groups, mid cap companies, investors and entrepreneurs on company, commercial and corporate law in particular on structuring and mergers & acquisitions. He has a special focus on transactions in IP/IT driven industries as well as real estate.

Dr. Orthwein was admitted to the bar in 2003 and became a partner at SKW Schwarz in 2011. He received his Master of Laws (LL.M.) in American Law from Boston University (USA) in 2000 and his doctorate from the University Muenster in 2003 with a topic in telecommunications law.

He advises his clients in all areas of IT law, in particular cloud and software contract law using new agile software developing and contract methods, the commercial use of data and artificial intelligence (AI) as well as digital transformation projects. Together with his clients, he develops and brings to life new digital platforms and business models. He is an experienced expert in national and international data protection law issues in particular with regard to the use of cloud services.

The Lexology Index Germany 2025 lists him as a “world's leading practitioner” in the data category. In 2025, Handelsblatt / Best Lawyers again recommends him as a lawyer in the categories “IT law” and “data protection law.” He is once again listed in the JUVE Handbook 2025 as a “frequently recommended lawyer” for IT and data protection law.

Dr. Orthwein is a lecturer for IT and data protection law in applied AI at the Technical University of Rosenheim.

Dr. Orthwein is member of the German Society for Law and Informatics, the International Association of Privacy Professionals, the German Outsourcing Association and the German-American Lawyers Association. He is Senior Vice Chairman of the Technology Law Committee of the International Bar Association.

Dr. Andreas Peschel-Mehner has provided legal counsel to all forms of digital business since the inception of the world wide web. His advisory spans start-ups, multi-channel offerings and international internet companies and focuses on all applicable legal fields with a particular emphasis on data protection and usage, terms and conditions, consumer protection, compliance, advertising, gaming and competition law, among numerous others. Dr. Andreas Peschel-Mehner also commands broad expertise in media and entertainment law, in particular issues touching on the film and television industry and those related to media production finance and the global exploitation thereof, with digital media advisory on changes to utilization models, revenue streams and video on demand platforms composing a significant part of his counsel. 

An excerpt of the projects Dr. Andreas Peschel-Mehner has accompanied can be found on the Internet Movie Database IMDb. His advisory expertise is augmented by decades of involvement with and counsel of national and international computer game publishers and studios. Finally, developments and use of KI technologies across all his expert areas has become a strategic element of his practice.

Ulrich Reber is a certified expert in international business law. Mr. Reber advises and represents German and foreign companies in civil and commercial matters with an emphasis on corporate litigation, for example in commercial and corporate disputes before civil courts and arbitration tribunals. He commands particular expertise in cross-border debt enforcement cases in and out of court. His clients include leading European and non-European companies requiring legal assistance in Germany, to whom he provides corporate legal advice with a special focus on insolvency law. Numerous clients come from the media, entertainment and IT sectors.

Legal expertise – digitally sophisticated

Stefan Schicker has been advising clients at the intersection of law, technology, and innovation for over 20 years. As an experienced and award-winning lawyer specializing in IT and IP law, he assists national and international companies in the legally compliant design of digital business models – from the design of complex internet platforms to the protection of intellectual property.

One of Stefan Schicker's special areas of expertise is the legal structuring of corporate influencer initiatives: with specially developed workshops, he supports companies in setting up corporate LinkedIn communication in a legally compliant and effective manner – in accordance with copyright, personality rights, competition law, etc. – More information.
 

Legal tech & law firm development – with leadership experience

In parallel to his legal practice, Stefan Schicker is one of the most prominent legal tech experts in the German-speaking world. As former COO and CEO of SKW Schwarz, he played a key role in shaping the digital transformation of the law firm – from strategy to operational implementation.

Today, he supports law firms and legal departments in establishing and expanding modern structures:

• Development and introduction of AI-supported tools
• Establishing internal teams of experts and training concepts
• Change processes for the sustainable anchoring of digital working methods
• Organization of law firms as companies

Stefan Schicker brings a unique combination of legal depth, technological experience, and operational law firm management to the table – recognized, among other things, as one of the “Top 3 Legal Leaders of the Year” (Best of Legal Awards).
 

For companies and law firms that don't want to wait for the future

Whether companies with digital business models or law firms undergoing change: Stefan Schicker combines legal certainty with entrepreneurial foresight – and makes complex transformations understandable, feasible, and effective – More information.

Dr. Tatjana Schroeder has extensive experience in stock corporation law and also accompanies the development of this very specific legal field through regular publications. Stock corporation law also always depends on trends in the capital market and is subject to continuous change.

Mathias Schwarz advises on movie and TV productions, copyright and personality rights, licensing, and media financing. His clients are financial institutions, private investors, movie and TV producers, as well as broadcasting and publishing companies. He also represents a number of renowned individuals in the German media industry. In addition, he has been advising a number of family offices and private clients for a long time.

This article is the second part of a three-part series on current developments around AI assistants. The first part set out the advertising and data protection standards applying to the advertising model (available here). This part looks at the obligations that follow from the designation, at the gaps the DSA may leave for advertising in AI assistants, and at the supervisory bodies that have a say alongside the Commission. Like the first part, it is addressed to companies that advertise in this environment or deploy AI assistants in their own operations. The third part deals with the responsibility and liability of advertisers and agencies.

ChatGPT as a search engine

The Commission bases the classification as a search engine on the fact that the service accesses internet content directly when answering queries. OpenAI has not contested the designation and has stated that the search function of ChatGPT operates as a search service within the meaning of the DSA. The DSA was designed for classic platforms and search engines and contains no separate category for generative systems of this kind. The Commission has therefore applied an existing framework to a new type of service.

The designation starts a four-month period (Article 33(6) DSA) which, according to the Commission, expires around the turn of the year 2026/2027. Section 5 of Chapter III DSA then applies. It covers the assessment of systemic risks under Article 34 and their mitigation under Article 35, expressly including advertising systems, as well as independent audits under Article 37, the advertisement repository under Article 39, data access for researchers under Article 40, extended transparency reporting under Article 42 and the annual supervisory fee under Article 43. Articles 37, 39 and 40 DSA, which the first part identified as starting points for verifying the provider’s promise that advertising does not influence its answers, therefore only apply from that date. For Section 5, supervisory and enforcement competence lies exclusively with the Commission.

An asymmetry in the DSA advertising rules

By its wording, Article 39(1) DSA addresses „providers of very large online platforms or of very large online search engines“. The substantive advertising requirements in Section 3, by contrast, consistently address only „providers of online platforms“: Article 25 on the design of the online interface, Article 26 on the labelling of advertising and on profiling using special categories of data, Article 27 on the transparency of recommender systems and Article 28 on the protection of minors, including the prohibition of profiling-based advertising directed at minors. On the wording, OpenAI as a VLOSE is therefore subject to the repository obligation, but not to the requirements on labelling, transparency of recommender systems, manipulative design and targeting of minors.

This literal reading is not undisputed. It is argued in the literature that Article 26 DSA applies at least to advertising-funded online search engines, and that the transparency requirements for recommender systems extend functionally to very large online search engines via Article 38 DSA. The asymmetry produces the inconsistencies described above and is accordingly the subject of ongoing debate. Advertisers and providers would be well advised not to rely on the gap in the wording holding in the long run.

It should also be noted that the Commission has designated ChatGPT as a VLOSE, but has not thereby decided that the service is not also an online platform within the meaning of Article 3(i) DSA. If it also meets the platform criteria, the provisions of Section 3 could apply in addition.

There are several starting points for that argument. Article 3(i) DSA requires a hosting service that stores information at the request of a recipient and disseminates it to the public. That applies first of all to the advertisements themselves, which the provider stores and displays on behalf of its advertising customers. It may also apply to features that allow users to make their own content publicly accessible, such as sharing individual conversations through retrievable links or offering self-configured assistants in a public directory. Whether such features qualify as a minor and purely ancillary feature within the meaning of Article 3(i) DSA determines whether the platform classification holds.

German media law is already engaged

Alongside the DSA, German authorities have been applying German media law since July 2026. On 14 July 2026, in two proceedings conducted by the state media authorities of Hamburg/Schleswig-Holstein and Berlin-Brandenburg, the Commission on Licensing and Supervision (ZAK) issued its first decisions against AI services, concerning Google’s AI Overviews and Perplexity. It found that AI answers are the providers’ own content and that the liability exemption under the DSA does not apply to them. The levers used are the diversity rules for media intermediaries under sections 91 to 94 of the Interstate Media Treaty (MStV), in particular the transparency requirement and the non-discrimination rule, which in principle presuppose the transmission of third-party information. Google has announced an appeal; the decisions are not yet final.

The proceedings concerned Google and Perplexity. Whether the reasoning can be transferred to ChatGPT is likely to depend on how source selection and linking are designed in detail. On the distinction set out in the first part, classification as a media intermediary requires that the service aggregates third-party content, selects it and determines how easily it can be found, without combining it into an overall offering of its own, which is difficult to assume for content that providers generate themselves and are liable for. It is disputed in the literature whether presenting generated answers is sufficient or whether visibly displayed third-party content with an identifiable source reference is required. An expert opinion commissioned by the state media authorities concludes that large language models are to be classified as media intermediaries to the extent that they reproduce source links within their own generated answers. That is said to apply only where the sources are not given as mere evidence, but as „further sources“, with the result that third-party content is transmitted. How that distinction is to look in practice is left open.

Two supervisory regimes side by side

If ChatGPT were both a media intermediary under sections 91 et seq. MStV and a VLOSE under the DSA, two supervisory structures would meet: the state media authorities on one side, and on the other the Commission, which is solely competent for Section 5, together with Coimisiún na Meán as Digital Services Coordinator for the remaining obligations given the Irish establishment. Between them stands the country-of-origin principle under section 3 of the Digital Services Act implementation statute (DDG) and Article 3 of Directive 2000/31/EC. Whether section 93 MStV is enforceable against providers established in another Member State has been left open by the Administrative Court of Berlin and the Higher Administrative Court of Schleswig, which referred the question to the Court of Justice of the European Union. In Germany, the Federal Network Agency also acts as Digital Services Coordinator; the lead data protection authority is the Irish Data Protection Commission.

There is also the allocation of competence under the German AI market surveillance act (KI-MIG), which the first part described for Article 50 AI Act: the Federal Network Agency is the central market surveillance authority, while for media services serving journalistic or advertising purposes the authorities competent under state law remain responsible under section 2(8) KI-MIG. The question of competence therefore needs clarification both between the Union and state level and within German supervision. We have set out the draft Interstate Treaty on Digital Media and the allocation of competence it provides for in a separate article (available here).

What the enforcement pattern shows so far

The Commission has concluded three DSA cases with a fine to date. On 5 December 2025, X was fined 120 million euros for the misleading design of its verification mark, an incomplete advertisement repository and insufficient data access for researchers, all of them verifiable transparency obligations. On 28 May 2026, a fine of 200 million euros against Temu followed, and on 20 July 2026 a fine of 550 million euros against AliExpress. In both cases the focus was not on transparency obligations but on the assessment and mitigation of systemic risks in connection with illegal, unsafe or counterfeit products. In the Temu case, according to the Commission, the risk assessment relied on general information about risks in the e-commerce sector instead of evidence relating to the service itself.

For ChatGPT, the second line may be the more informative one, because the risk assessment is among the first obligations to apply once the period expires. In the Temu case in particular, the Commission did not merely check whether an assessment had been submitted, but whether it holds up in substance. Fines may reach up to six per cent of worldwide annual turnover; the amounts imposed so far have remained well below that.

Consequences for the advertising system

The advertising system went live a week before the designation and must feed into the first systemic risk assessment before the period expires. Article 34(1)(b) and (d) DSA covers negative effects on fundamental rights, including consumer protection and the rights of the child, as well as on the protection of minors and on physical and mental well-being. Under Article 34(2) DSA, the systems for selecting and displaying advertising are among the factors to be taken into account in the risk assessment. The selection of ads by the topic of the ongoing conversation, described in the first part, should therefore be subject to that assessment, regardless of whether Article 26 DSA applies on its wording.

What comes next

Two developments are on the horizon. At Union level, the Commission is expected to propose a Digital Fairness Act in the fourth quarter of 2026, focusing on manipulative interface design, unfair personalisation and the protection of minors. At state level, the Broadcasting Commission discussed the draft of an Interstate Treaty on Digital Media (part 2) on 16 September 2026. Under that draft, providers of AI information systems are to be responsible for the content these systems generate. One option under consideration is to treat AI services as media intermediaries, another to create a new category of telemedia. The public consultation is still planned for 2026.

The expiry of the period around the turn of the year will show how the Commission assesses the risk assessment of a conversational service. Until then, the question that matters most for companies that deploy such services or advertise in them is which supervisory regime governs their own role. The third part of the series addresses that role.

If you have questions about the regulatory classification of your campaigns or of your use of AI assistants, or about what the DSA designation means for your advertising environment, we are happy to help.

More about our EmpCo Compliance & Litigation services  (LINK)

Find out more about our EmpCo Compliance & Litigation services Click here

This article opens a three-part series on current developments around AI assistants. The second part deals with the designation of ChatGPT as a very large online search engine under the Digital Services Act and the obligations attached to it. The third part asks to what extent advertisers and agencies are responsible for the content of ads placed in AI assistants and liable for the statements they make. The question of when a provider must have AI answers attributed to it as its own content was already covered in our KI-Flash of 2 July 2026.

No personalised advertising in the EEA so far

For ads on online platforms, a distinction is drawn between personalised and non-personalised advertising. The legal requirements for the two differ considerably. 

In the first phase, currently implemented in the European Economic Area, ads are selected without personalisation in the sense of profiling. What is used is the topic of the ongoing conversation together with limited contextual information such as approximate location, language, time of day and device type. Earlier chats and stored information are expressly excluded according to the provider. Advertisers receive aggregated performance data only, and no conversation content, no real names and no precise location data.

Personalised advertising requires separate consent. Only then do chat history, stored information and a user’s behaviour in response to earlier ads feed into the selection. Users’ consent is required for this, as OpenAI also expressly describes in the version of its European privacy policy of 2 June 2026. This personalised advertising option has not yet been activated in the EEA.

One point that has largely gone unnoticed deserves attention here: behaviour in response to earlier ads can only feed into the selection if it has been collected beforehand, and, at least according to the provider, that does not happen in the first phase. The change therefore does not consist solely in evaluating existing data but first of all in building up a new set of data. Consent would have to cover that step as well.

How must advertising in an AI assistant be labelled?

The provider describes the ads as clearly labelled and visually separated from the answer. Under advertising law, the question is usually discussed under Section 5a(4) UWG. No. 11 of the Annex to Section 3(3) UWG may also apply, which covers the use of editorial content financed by a trader and disguised as information. That provision presupposes, however, that editorial content exists at all, and whether an AI-generated answer qualifies is an open question. For comparison portals and search engines, editorial content is in part affirmed even though there is no editorial team in the traditional sense. What speaks against that classification is precisely the position taken by the ZAK, the joint commission of the German state media authorities, according to which AI answers are the provider’s own content and therefore do not appear as neutral reporting. Added to this are Section 6(1) DDG for commercial communication in digital services and, where the service qualifies as a media intermediary or a media-like offering, Section 22 MStV. Classification as a media intermediary depends on whether the service aggregates third-party content, selects it and determines how easily it can be found. That is exactly what the ZAK relied on in relation to source citations and link lists. A service that generates only its own answers does not meet that test.

The structural risk, however, lies not in the design of the ad block but in the selection logic. An ad selected on the basis of the topic of the ongoing conversation appears at a moment when the user has just articulated a specific concern. In functional terms it works like native advertising, even where it is presented as “formally separated”. Whether a visual separation is enough to address this problem of contextual proximity is a question of the specific implementation. 

Are AI answers the provider’s own content?

Against the labelling obligations under Section 22 MStV and Section 6 DDG it could be argued that a chat interface has no editorial part from which advertising would have to be distinguished in the first place. On the line that has emerged so far, that defence does not hold: in its judgment of 28 May 2026 (26 O 869/26), the Regional Court of Munich I treated a search engine’s “AI Overview” function as the provider’s own substantive statement and found that the provider had adopted the content as its own (paras. 33 f.). Three aspects were decisive: the function produces a self-contained running text that summarises, structures and evaluates search results; it forms statements that are not contained in the sources relied on; and, from the perspective of a reasonably informed average user, it appears as an answer for which the provider is responsible rather than as a neutral list of results. On 14 July 2026, in proceedings of the Hamburg/Schleswig-Holstein and Berlin-Brandenburg state media authorities, the ZAK issued its first orders against AI services operated by Google and Perplexity, holding that AI answers are the providers’ own content and that the liability exemption under the DSA does not apply. Neither decision is final and binding yet, and appeals have been announced. For Section 5a(4) UWG this preliminary question is irrelevant. For No. 11 of the Annex it matters, because editorial content is a constituent element there.

The promise about the answers

OpenAI promotes the principle that advertising does not influence the answers. Beyond being a product description, this also appears to be a statement about a material characteristic of the service within the meaning of Section 5 UWG. If the actual design departs from it – for instance through influence on ordering, product mentions or shopping integration – a misleading commercial practice would come into consideration. In practice the question of evidence arises immediately: how does a competitor prove a distortion in the model’s behaviour? How the model works lies solely within the provider’s sphere, which speaks in favour of a secondary burden of substantiation: the competitor puts forward tangible indications and the provider then has to respond in substantiated form. It can be countered that a secondary burden of substantiation is ruled out to the extent that the competitor can test the answering behaviour itself. Starting points are offered by the audit obligations under Art. 37, the ad repository under Art. 39 and researcher access under Art. 40 DSA – provisions that now apply as a result of the designation as a very large online search engine of 31 August 2026. More on this in the next article.

Who is subject to the consent requirement?

Section 25 TDDDG applies to access to information on terminal equipment through cookies. The OpenAI measurement pixel sets a first-party cookie on the advertiser’s domain. The consent requirement therefore falls not on the platform operator but on the booking party. The provider also makes a server-side interface for conversion measurement available; its use, too, is processing carried out by the booking party itself. 

Section 25 TDDDG does not apply to server-side transmission, because no access to terminal equipment takes place there. The only benchmark in that respect is the GDPR.

May chat histories be used to select ads?

This is where the real point of examination lies. Chats are shared for the purpose of completing a task, not for optimising advertising. Drawing on the history for ad selection must therefore be measured against Art. 5(1)(b) and Art. 6(4) GDPR, regardless of whether consent is obtained.

Art. 9 GDPR also comes into play. Conversation histories regularly reveal health data, religious or philosophical beliefs, sexual orientation or political opinions. In Cases C-252/21 and C-446/21 the CJEU applied a broad standard for when special categories of data are involved and set strict requirements for the validity of consent. In Case C-446/21 it also found a breach of the data minimisation principle because personal data had been processed for targeted advertising purposes without any distinction according to their nature. Irrespective of this, Art. 21(2) GDPR provides an unconditional right to object to direct marketing, which is not open to any balancing exercise. The right attaches solely to the purpose of the processing and not to the legal basis. It therefore also covers the delivery of non-personalised ads to the extent that these constitute direct marketing.

Self-commitment does not replace a legal basis

The provider has set category exclusions for physical health, mental health and politics; political advertising is currently not permitted at all. Exclusions of this kind are contractual self-commitments. They replace neither a legal basis under Art. 9 GDPR nor an assessment of sector-specific advertising bans. How a prohibition under the law on advertising for medicinal products is to be enforced in an interface in which users are describing their symptoms is an open question. 

The reverse case also arises. Under the provider’s advertising policies, regulated industries, among them legal, health and financial services, are excluded from booking outside the United States. For companies in these sectors, the first question is therefore not one of admissibility but one of access.

The protection of minors, too, operates through a technical self-commitment: ads are not served where the user is presumed to be a minor, as determined by age estimation. That protective measure is itself processing that calls for justification. Section 6 JMStV and No. 28 of the Annex to Section 3(3) UWG have to be taken into account in addition. Section 6 JMStV is a rule governing market conduct within the meaning of Section 3a UWG and can therefore also be enforced under unfair competition law. No. 28 of the Annex covers direct exhortations to children to buy, that is to persons under the age of fourteen. Art. 6(1)(f) GDPR comes into consideration as the legal basis for age estimation. It cannot be based on Art. 6(1)(c) GDPR to the extent that it rests on a voluntary self-commitment rather than on a specific legal obligation.

Transparency and labelling

The information obligations under Art. 12 to 14 GDPR are under particular scrutiny in 2026: on 19 March 2026 the EDPB launched a coordinated enforcement action on precisely these provisions, with 25 supervisory authorities taking part. A privacy policy revised shortly beforehand, which for the first time includes advertising as a processing purpose, therefore falls within an ongoing year of review.

Art. 50 AI Act has applied since 2 August 2026 in addition. Digital Omnibus Regulation (EU) 2026/1744 postponed only the machine-readable marking under Art. 50(2) AI Act for systems placed on the market before that date, namely to 2 December 2026. As regards competence, a distinction has to be drawn in Germany: under the KI-MIG, the Federal Network Agency is the central market surveillance authority, but for media services used for journalistic or advertising purposes competence remains, pursuant to Section 2(8) KI-MIG, with the authorities designated under state law.

What remains open for the booking party

What remains unresolved above all is which labelling obligations apply to the booking party itself, independently of how the platform operator implements them, and who is the controller under data protection law once the booking party deploys its own measurement tools. The third article in this series addresses both questions. For companies whose staff use ad-funded plans in their day-to-day work, there is the added point that conversation content feeds into ad selection there. What this means for trade secrets and for professionals bound by professional secrecy has barely been examined so far.

We would be glad to support you in reviewing your campaigns in the AI environment, in designing labelling and measurement, and in assessing the allocation of roles under data protection law.

Beck-Online subscribers can read the full article here (in German).

Following our report on the GEMA v. Suno case in our last AI Flash, we would like to continue providing you with regular legal insights into current developments in AI law.

Today’s topic: AI literacy under Article 4 of the AI Act

Hardly any provision of the AI Regulation affects as many companies in practice as Article 4 of the AI Act on so-called “AI literacy.” It applies regardless of risk class or industry and thus to anyone who offers or operates AI systems. This is already relevant simply when using ChatGPT, Copilot, or comparable tools in everyday work. The provision has now been amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744 of July 8, 2026, in effect since July 27, 2026). This is reason enough to take another detailed look at the regulation.

I. What Has Changed?

In its original version, Article 4 of the Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence  (AI Act) required providers and operators to ensure, to the best of their ability, that their personnel possessed a sufficient level of AI literacy. This wording faced criticism for implying a success that companies could hardly guarantee reliably.

The Digital Omnibus on AI has made adjustments. Article 4 AI Act now states:

(1) Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.

(2) The Commission and the Member States shall support and facilitate the efforts of providers and deployers of AI systems, in particular SMEs, in fulfilling their obligation under paragraph 1 of this Article. For that purpose, the Commission shall publish practical examples of how to comply with that obligation on the single information platform referred to in Article 62(3), point (b).

(3) The Board shall adopt recommendations, taking into account European competence frameworks, to support the Commission and Member States in the promotion of AI literacy required under paragraph 1, including by setting out common objectives.

Thus, the obligation has shifted from "ensuring" a level of competence to supporting the development of AI literacy through appropriate measures - explicitly without guaranteeing a specific individual competence level. 

Notably, what was not included in the new version of the regulation is significant: the original Commission proposal aimed to largely shift the responsibility for promoting AI literacy to the EU and the Member States. This fundamental realignment did not prevail in the trilogue. The obligation remains-albeit mitigated-with the providers and operators themselves. The only new aspect is the accompanying support from the Commission, Member States, and the AI Committee (paragraphs 2 and 3).

II. What Does "AI literacy" Actually Mean?

The term "AI literacy" is not defined in Article 4 AI Act but is elaborated in the definition provided in Article 3 No. 56 AI Act. According to this, AI literacy refers to the "skills, knowledge and understanding that allow providers, deployers and affected persons, taking into account their respective rights and obligations in the context of this Regulation, to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause."

Thus, AI literacy is not merely technical niche knowledge but a bundle of technical understanding, risk awareness, and legal and ethical basic understanding. It addresses all actors along the AI value chain - from developers and operational staff to individuals who use AI systems on behalf of the company, such as external service providers.

Importantly for practice: Article 4 AI Act does not prescribe a specific training format, certification, or a dedicated "AI Officer." Internal training, e-learning, workshops, or external training are all permissible-what matters is that the measures fit the technical knowledge level, experience, context of use, and risk profile of the respective target group. Both the Federal Network Agency and the AI Service Center Austria of the RTR explicitly recommend documenting the measures taken (type of training, content, timing, affected groups) to demonstrate compliance with Article 4 AI Act if necessary, even though no legally mandated proof standard currently exists.

III. The (Highly Problematic) Question of Sanctions

The question remains, particularly contentious in practice: What happens if a company fails to promote AI literacy?

1. No Immediate Fine Under Article 99 AI Act

First, the good news: Article 99 AI Act lists the provisions subject to fines exhaustively. Article 4 AI Act is not mentioned there. Therefore, the regulation does not provide for an immediate fine specifically for violations of the AI literacy obligation - this is confirmed by both the Austrian AI Service Center of the RTR and the Federal Network Agency.

However, a violation is not without consequences. Some literature suggests that national market surveillance authorities - in Germany, the Federal Network Agency - can address violations of Article 4 AI Act based on national regulations with other enforcement measures. Moreover, and practically more significant, Article 4 AI Act exerts its effect mainly indirectly, through general civil and corporate law.

2. Employer Liability Under § 278 BGB

If a company uses AI systems, it bears the entrepreneurial risk as an operator and is responsible for the proper organization of operations and work equipment. If damage occurs to customers or business partners - due to incorrect operation of an AI system, unverified adoption of erroneous AI outputs, or inputting business secrets into an external AI system - the employer is liable under § 278 BGB for the fault of its employees as vicarious agents. Article 4 AI Act reinforces an existing duty of care and effectively becomes the benchmark against which the appropriateness of the organizational measures taken is assessed. If there is a complete lack of a traceable training and governance structure, the assumption of a breach of duty of care is likely.

3. Recourse Against Employees

Conversely, a company that suffers damage can seek recourse from responsible employees under the principles of internal damage compensation. Here, an interesting interaction emerges: in cases of slight negligence, the employee is typically not liable; in cases of moderate negligence, only partially; full liability generally only arises in cases of gross negligence or intent. Literature suggests that the success of a recourse claim may depend on whether the employer has fulfilled its training obligation under Article 4 AI Act. A company without a robust training concept may find itself at a disadvantage in a serious case - even with potentially gross negligence on the part of employees.

4. Liability of Management and Board

Finally, the question also concerns the management level itself. Managing directors of a GmbH (§ 43 Abs. 1 GmbHG) and board members of an AG (§§ 76, 93 Abs. 1 AktG) are obliged to take the necessary organizational measures to ensure compliance with legal behavior within the company - such as through a compliance management system that also incorporates the AI literacy obligation. If they violate this obligation culpably and the company suffers damage as a result, internal liability under § 43 Abs. 2 GmbHG or § 93 Abs. 2 S. 1 AktG may apply. The recognized business judgment rule in German law provides only limited assistance here: whether or not to establish a compliance system with a training concept is not a matter of entrepreneurial discretion but is legally mandated. Entrepreneurial discretion exists only regarding the specific design - as long as an appropriate minimum standard is maintained.

Interim Conclusion: While Article 4 AI Act is not subject to fines, it is by no means without consequences. The actual "sanctioning" occurs through the backdoor of general liability law - and this makes the norm more relevant for business practice than the absence of a fine might initially suggest.

IV. Looking Beyond the Obligation: Added Value in Practice

While the legal discussion of liability risks is certainly justified, our consulting practice with numerous in-house training sessions and workshops on AI literacy reveals another often underestimated effect: the real value does not arise only in disputes but already in the training room itself. In almost every format we have facilitated, most of the staff's open questions - from responsibility for AI outputs to handling confidential data and copyright issues - could be clarified through direct exchange.

Practical uncertainties in daily interactions with AI tools can often be resolved easily before they become actual problems. Moreover, through shared exchange, a collective awareness within the company is created. AI literacy is then not perceived as an abstract compliance requirement but as a jointly developed standard that the staff supports.

V. Conclusion and Outlook

The Digital Omnibus on AI has made Article 4 AI Act more practical without abandoning the obligation itself. The absence of a fine does not change the fact that deficiencies in AI literacy can become relevant under general civil, labor, and corporate law - for the company, for employees in recourse cases, and for the management level alike. Those who take this framework seriously and simultaneously leverage the practical value of training and workshops not only create legal certainty but also foster a sense of shared sovereignty in dealing with AI within the company.

SKW Schwarz is happy to assist you in designing suitable training programs and accompanying you in conducting initial workshops on AI literacy in your company. Please feel free to contact us so that we can jointly create the greatest possible value for your business.

All of this results in a scope of action for affected service providers that is manageable, but time critical. A point of contact ready to receive orders must be designated or appointed, internal workflows for receipt, review, preservation, transmission, and documentation must be established, and the relevant personnel should be familiar with the tight deadlines before an actual case arises. To provide a quick overview, we have summarized the key deadlines and review steps for EPOC and EPOC-PR in this one-pager.

This outlines the practical obligations arising from the EEVO. Service providers falling within the scope of the Regulation should have incorporated the deadlines, review obligations, and response duties described above into their internal processes by 18 August 2026 at the latest, in order to be able to respond in a timely and legally compliant manner in the event of an EPOC or EPOC-PR.

Would you like support in setting up or reviewing your internal processes? We would be glad to assist you in developing workflows that work in practice and to support you in preparing for 18 August 2026.

In addition to these two articles, we have created a cheat-sheet that provides a quick overview of the key deadlines and review steps.
>> Read cheat-sheet <<

Two New Instruments: EPOC and EPOC-PR

At the heart of the EEVO are two new types of order that allow law enforcement authorities in one Member State to address service providers in another Member State directly in future – without the previously customary detour via mutual legal assistance proceedings. The European Production Order (EPOC) requires a service provider to produce specified electronic evidence, such as content, traffic, or subscriber data. The European Preservation Order (EPOC-PR) operates a step earlier: it merely requires the service provider to preserve data for a specified period so that it is not deleted before a production order, where applicable, follows.

For affected companies, this means one thing above all: both types of order take immediate effect. Unlike before, no separate involvement of a German authority is required – an order issued by another Member State becomes binding as soon as it reaches the designated point of contact within the company. What was previously described as a passive role thus becomes an active obligation to act. Whereas a service provider was previously permitted to leave a foreign request unanswered without consequence, it is now directly obligated in its own right from the moment an EPOC or EPOC-PR is received.

Who Is Subject to the EEVO?

The EEVO addresses service providers with a connection to the EU under Article 2(1) EEVO, irrespective of whether they are established in the EU at all. This marks an important difference from many other pieces of European legislation: a cloud provider without any European establishment can be just as affected as a German company. Under Article 3(3) EEVO, this covers in particular providers of electronic communications services (such as messaging or VoIP services), domain name registries and registrars, as well as other information society services – a category under which the Regulation expressly includes platform operators such as social networks and file-hosting services, as well as hosting providers and cloud services.

The addressee of an order is, as a general rule, the controller within the meaning of Article 4(7) GDPR, i.e. whoever determines the purposes and means of the processing. Only exceptionally may an EPOC be addressed directly to a processor: where the controller cannot be identified by the issuing authority despite reasonable efforts, or where the investigation would otherwise be jeopardized (Article 5(6) EEVO).

When Is There a “Connection to the EU”?

The Regulation first requires that the services be accessible to persons in a Member State – identifiable, for example, by language, currency, or targeted marketing. That alone, however, is not sufficient. In addition, there must be a substantial connection to one or more Member States, such as an establishment carrying out genuine economic activity, a significant number of users, or activity that is clearly directed at the relevant Member State. Mere technical accessibility of a website is expressly not sufficient for this purpose under Recital 29 EEVO – a service that happens to also be accessible from Germany does not thereby automatically fall within the scope of the Regulation.

Who Receives the Orders?

Once the question of whether a provider is covered has been resolved, the practical question remains of where an order is actually to be sent. Under Article 3(1) of Directive (EU) 2023/1544, every service provider must designate an establishment or a legal representative for the receipt of EPOCs and EPOC-PRs – by 18 August 2026 at the latest, or within six months of commencing service provision in the EU. Orders are, as a general rule, addressed exclusively to this designated point of contact (Article 7(1) EEVO). If it fails to respond in time in an emergency, or if no point of contact has yet been designated, the authority may exceptionally address another establishment of the company (Article 7(2) EEVO).

In practice, it is therefore advisable for the function internally responsible for EPOC/EPOC-PR matters – such as Legal or Compliance – to correspond to the externally designated point of contact and to be genuinely reachable. Otherwise, there is a risk that an emergency order with a particularly short deadline ends up with a group entity that is unprepared and consequently unable to respond in time.

This sets out the legal framework. What this looks like in practice – which specific deadlines apply, when an order may be refused, and what consequences follow non-compliance – is the subject of the second and final part of this series.

Would you like to assess whether, and to what extent, your company is subject to the EEVO, or do you need support in designating a point of contact for receiving orders? We would be glad to assist you with the legal assessment and with preparing for 18 August 2026.

The European Commission has now published guidelines on the application of the CRA. Using practical examples, the Commission explains how it interprets key concepts and obligations under the Regulation. Although the guidelines are not legally binding, they provide important guidance for companies and, likely, for the competent authorities responsible for enforcing the CRA.

Below, we summarize the aspects of the guidelines that are particularly relevant in practice.

1. The 24-hour reporting deadline does not start with the first suspicion

From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe security incidents. The guidelines explain when these short reporting deadlines begin to run.

An unconfirmed indication alone does not trigger the reporting deadline. However, the manufacturer must assess it without undue delay. The reporting period begins once this initial assessment establishes with sufficient certainty that:

• a vulnerability contained in the product is being actively exploited; or
• a severe security incident has occurred and has affected the security of the product.

From that point onward, an initial early warning report must generally be submitted within 24 hours. A follow-up notification must be submitted within 72 hours.

For an actively exploited vulnerability, the complete report must generally be submitted within 14 days after a corrective or mitigating measure becomes available. For a severe security incident, the deadline is one month after the 72-hour notification.

Companies therefore need not only a technical reporting mechanism but also clear responsibilities for the initial assessment and escalation of potential incidents. The process should cover both external reports and findings from internal security testing. The guidelines emphasize that the initial assessment must be carried out without undue delay, particularly where the potential vulnerability poses a significant risk. These procedures should be tested in practice before 11 September 2026.

2. A software version is generally placed on the market only once

According to the European Commission, software that is offered as a standalone product is placed on the market when the completed version is first made available on the EU market. This applies regardless of when individual customers purchase or download the software.

The guidelines illustrate this with an example: If software version 1.0.0 is first made available for download on 1 January 2028, it is considered to have been placed on the market on that date-even if some customers download it only at a later stage. A later version, such as 1.0.1, is not considered to have been newly placed on the market unless the changes are substantial. Consequently, the original placement-on-the-market date remains decisive.

The situation may differ for different variants of the same software, for example, builds for different operating systems or packages with different functionalities. Such variants may qualify as separate products. A new software version is also considered to be placed on the market again if it has undergone a substantial modification.

This distinction is particularly important for the CRA's transitional provisions. Manufacturers should document when individual versions were first made available, which variants they treat as separate products, and what changes were introduced subsequently.

3. Products that have already been developed do not automatically need to be redesigned

Many products that will only be placed on the market after 11 December 2027 are already under development today or have even been fully developed. According to the guidelines, the CRA does not automatically require these products to be redesigned.

However, manufacturers must assess the cybersecurity risks of the product. Based on the technical documentation, they must be able to demonstrate that the product achieves an appropriate level of cybersecurity and complies with the CRA requirements. The required conformity assessment, the EU Declaration of Conformity, and CE marking also remain mandatory.

However, the Commission does not require manufacturers to retrospectively recreate all evidence and testing from earlier development phases. If it is no longer possible to demonstrate how cybersecurity risks were addressed during the original development process, the manufacturer may instead carry out a current risk assessment and explain how the existing product design and security measures mitigate the identified risks.

This clarification is particularly relevant for industrial products with long development cycles. Companies should review which evidence is already available for ongoing product developments and identify any documentation gaps that still need to be closed.

4. For software updates, the decisive factor is the cybersecurity risk-not the scope of the update

Not every major update constitutes a "substantial modification" within the meaning of the CRA. Conversely, even a small change may qualify as substantial. The decisive factor is whether the intended use of the product changes or whether new or increased cybersecurity risks arise that were not previously considered.

The Commission provides the example of a system that initially only displays operational data from machines. If the system is later updated to allow it to control those machines, its intended use changes. The update must therefore be regarded as a substantial modification.

The guidelines also set out a non-exhaustive list of assessment criteria. In particular, it should be examined whether the update:

• introduces additional interfaces, communication channels, execution environments, or external dependencies;
• enables new attack scenarios; or
• significantly changes the likelihood or potential impact of attack scenarios that have already been considered.

By contrast, a significant functional enhancement does not necessarily constitute a substantial modification if it was already planned during the original development and taken into account in the risk assessment. Updates that merely remediate vulnerabilities or strengthen existing security measures generally do not constitute a substantial modification, provided that they neither change the intended purpose of the product nor introduce new or increased cybersecurity risks.

Companies should therefore align their product roadmaps with their cybersecurity risk assessments at an early stage. A technical classification as a major or minor release is not sufficient for the legal assessment. It is advisable to establish a documented process for evaluating security-relevant updates against the CRA criteria.

5. Five years is not a standard support period

As a general rule, the CRA requires a support period of at least five years. If a product is expected to be used for a shorter period, the support period may also be shorter. Conversely, where a product has a longer expected service life, five years will not automatically be sufficient.

This is particularly relevant for industrial installations, control systems, and other long-life products. For such products, the support period must reflect the realistically expected service life. The guidelines expressly clarify that five years should not be regarded as a universal standard for all products.

A substantial modification also does not automatically trigger a new five-year support period. The decisive question is whether the modification also affects the product's expected service life. For example, if a software update merely introduces new functionalities without extending the lifetime of the hardware or changing users' expectations, the remaining original support period generally continues to apply.

For continuously evolving software, manufacturers may, under certain conditions, limit vulnerability remediation to the most recently placed-on-the-market version. Users must be able to upgrade to that version free of charge and without additional costs. Normal efforts such as testing or configuration changes are generally not regarded as additional costs. However, if users are required to purchase new hardware or fundamentally rebuild their system environment, the manufacturer cannot rely on this simplification.

Practical Tip

The guidelines do not create any additional legal obligations. However, they provide important clarification on key issues that companies must address when implementing the CRA.

Manufacturers should, in particular, review whether software versions and updates are documented in a traceable manner, whether the cybersecurity risk assessment is integrated with product planning, whether support periods have been determined realistically, and whether the reporting process will be operational by September 2026.

The guidelines also address, among other topics, free and open-source software, cloud-based functionalities, spare parts, and the interaction of the CRA with vehicle regulation, the Radio Equipment Directive, and the Machinery Regulation.

Discover Our CRA Compliance Suite

Our CRA Compliance Suite provides modular, fixed-fee consulting services to help manufacturers, importers, and distributors of digital products implement the requirements of the Cyber Resilience Act (CRA). Contact us for more information.

You can download the full article as a PDF here.

• The European Commission's guidance is available here.
• More information about our CRA Compliance Suite is available here.

You can download the full article as a PDF here.

While information on the internet is accessible worldwide at any time, its legal regulations and intellectual property rights are always subject to strict territorial limits. Anyone who publishes content online must therefore be aware of the risk of infringing third-party rights abroad. The Court of Justice of the European Union (CJEU) has now ruled that effective geoblocking can prevent such infringements in other countries (judgment of 9 July 2026, Case C-788/24 – Anne Frank Fonds).

The Anne Frank Case: Geoblocking as Protection Against Copyright Claims

The legal proceedings involved a dispute between the Anne Frank Fonds and the Anne Frank Stichting regarding the online publication of the diaries of the world-famous Jewish teenager. While the works are already in the public domain in Belgium, they remain partially protected by copyright in the Netherlands until 2037. The defendants published a scientific edition on a Belgian website but blocked access for users from the Netherlands using geoblocking. The Anne Frank Fonds nevertheless considered this an infringement of its copyrights, arguing that users could bypass the restriction via standard VPN services.

The CJEU ruled that an unauthorized "communication to the public" — and thus an infringement of the copyrights still existing in the Netherlands — does not occur, provided that the geographical restriction is effective. To achieve this, the block must primarily correspond to the latest state of the art. Absolute security is not required. A user-side circumvention by means of VPN services does not automatically render the restriction ineffective.

Relevance Beyond Copyright Law

At the same time, the CJEU emphasizes conversely that an active duty applies to anyone who knows or ought to know about existing intellectual property rights abroad. Anyone who, with knowledge of such rights, fails to implement effective geoblocking measures is deemed to be targeting their content at the entire global audience (para. 42 of the judgment). The CJEU left open when such knowledge (the duty to know) can be assumed. Previous business relationships or the existence of delimitation agreements could already be sufficient.

This duty by no means affects copyright law alone. Geoblocking is also playing an increasingly important role in trademark law. An infringement of a national trademark on the internet requires that the use of the trademark actually takes place within the domestic territory. In this context, courts examine whether the use of the sign produces a noticeable economic effect in the domestic market—the so-called "commercial effect".

Whether such a domestic nexus exists must generally be assessed based on the specific circumstances of each case. Relevant factors include, among others, the language of the website, the top-level domain, information provided on the website, or—if available—specific delivery options, as well as other circumstances such as economic activity in the country. Now confirmed by the CJEU, the absence of geoblocking measures is at least a strong, if not decisive, indication that the website in question is (also) directed at the domestic public. This is likely to be particularly relevant for global websites.

Liability of the Website Operator, Not the VPN Provider

According to the CJEU, it is solely the website operator who is liable for ineffective technical measures — not the VPN provider whose service is used to circumvent them. This applies even if the VPN provider is aware that its service can be used to access protected content without the rights holders’ consent.

Conclusion

The CJEU judgment provides much-needed clarity for online business practices. Geoblocking has become a central tool for legally secure market segmentation in intellectual property law. At the same time, the lack of geoblocking measures can indicate that accessing the content from abroad is intentionally desired. Conversely, anyone who deliberately restricts their online activities to specific countries and implements this technically soundly via geoblocking can effectively eliminate liability risks abroad.
 

Austria's Supreme Court sought clarity and referred this question – which ultimately determines when consumers' right of withdrawal lapses and thus goes well beyond a mere semantic distinction – to the Court of Justice of the European Union (CJEU). On July 9, the CJEU ruled in favor of stronger consumer protection (Judgment of 9 July 2026, Case C-234/25).

Personalized Streaming Services Constitute ‘Digital Services’

Consumers who wish to access films, series, or live sports on Sky or other streaming platforms before the expiration of the 14-day withdrawal period are typically required to waive their right of withdrawal when concluding the contract. Article 16(1)(m) in conjunction with Article 2(11) CRD provides such an exception to the right of withdrawal laid down in Article 9(1) – but only for ‘digital content’.

Following the view of the European Commission and the Advocate General, which the CJEU has adopted, streaming subscriptions generally do not constitute ‘digital content’, but rather ‘digital services’, to which this exception does not apply. Instead, the consumer's right of withdrawal expires only once the streaming provider has fully performed the contractual service (Article 16(1)(a) in conjunction with Article 2(16) CRD).

Unlike the supply of ‘digital content’, the supply of a ‘digital service’ is ‘necessarily defined by the dynamic nature of the offering proposed by the trader concerned, which goes beyond the mere stable and, as the case may be, continuous provision of specific content.’ According to the CJEU, this is the case, in particular, where ‘the offering is designed to adapt to the consumer’s individual behaviour or expectations, or to influence the manner in which the consumer uses the services concerned, for example by recommending specific content to the consumer.’ Such recommendation systems are an integral part of virtually all modern streaming services, helping users navigate an overwhelming volume of available content.

No Risk of Abuse Due to Appropriate Compensation

Sky Österreich Fernsehen GmbH (hereinafter ‘Sky Austria’) was unsuccessful in arguing that such an interpretation would open the door to abuse. Sky Austria pointed out that subscription numbers typically spike when a popular series’ first or final season is released, or when decisive matches in football championships take place. If customers were able to cancel their subscription immediately after viewing such content, they could effectively receive this premium programming for free.

The CJEU held that the legislature had already addressed this concern in Article 14(3) CRD, which entitles the trader to compensation proportionate ‘to what has been provided until the time the consumer has informed the trader of the exercise of the right of withdrawal, in comparison with the full coverage of the contract.’ In this regard, the trader is not required to calculate this compensation purely on a time‑proportionate basis (pro rata temporis); it may instead take the market value of the service provided as a starting point in order to reflect the differences in economic value between the offered content (for example, the final stage of a sporting competition compared with a daily television series). In plain terms, this means the compensation a consumer owes could actually exceed the monthly subscription fee; either way, charging at least a pro-rata (time-proportional) fee remains permissible. Seen in this light, the CJEU ruling is likely to be a theoretical victory for consumers – in practice, not much is likely to change, and probably rightly so.

Applicability to German Law

Since the Austrian provision at the centre of this request, Section 18(1)(1) and (11) of the Distance and Off‑Premises Contracts Act (Fern‑ und Auswärtsgeschäfte‑Gesetz), essentially corresponds to Sections 356(5) and (6) of the German Civil Code (Bürgerliches Gesetzbuch), the decision can readily be transposed to German law. In addition, the CRD does not expressly refer to the law of the Member States for the interpretation of the term ‘digital content’, which is why that term must be interpreted autonomously and uniformly under EU law.

Outlook

With this decision, the CJEU is significantly shaking up the existing landscape of streaming subscriptions, particularly since, on the one hand, the architecture of streaming services in the form of recommendation systems is affected, and on the other hand, claims for compensation in the event of withdrawal following prior streaming consumption are likely to meet with little acceptance at first.

Indirectly, the decision is also likely to have repercussions for other streaming models – whether the streaming of music tracks and podcasts via Spotify, audiobooks via Audible, or the magazine subscription with the Süddeutsche Zeitung – wherever the provider's performance goes beyond the mere provision of a single digital item. The CJEU has thus cut a dogmatic swath that points far beyond the specific question referred. In economic terms, this swath will be less significant, since compensation fees will become established for the usage that occurred prior to withdrawal.

Web scraping is practically indispensable for training large AI models – and, from a data protection perspective, one of the biggest open questions: who is liable if personal data ends up in a training dataset through the automated harvesting of the open internet? On 7 July 2026, the European Data Protection Board (EDPB) addressed this question in Guidelines 03/2026, presenting a concrete assessment framework for the first time. Having already reported on the EDPB's Opinion 28/2024 on AI models in an earlier KI-Flash, we now turn to this second major development from the same plenary session. We reported separately on the Guidelines on the Anonymization of Personal Data adopted at the same time. The new web scraping guidelines are likewise open for public consultation until 30 October 2026.

Web Scraping for AI Training Purposes

More precisely, web scraping refers to the automated extraction of large volumes of data from publicly accessible internet sources – one of the central methods for sourcing training data for generative AI models. Until now, there was no specific, EU-wide guidance on how this practice can be reconciled with the requirements of the GDPR. The new guidelines close this gap and build on the Opinion 28/2024 mentioned above, as well as on Guidelines 1/2024 on Article 6(1)(f) GDPR. They are addressed to private entities that scrape data themselves, engage third parties to do so, or use already-scraped datasets for training or fine-tuning.

Controllership: Who Is Responsible for the Scraping Process?

A key question in practice concerns the allocation of roles under data protection law: the EDPB clarifies that the entity carrying out the scraping is not automatically a controller within the meaning of the GDPR. What matters instead is who determines the purposes and means of the processing. If an AI developer engages a service provider to carry out scraping under documented instructions, that provider will generally qualify as a processor, while the developer is treated as the controller. Where an already-scraped dataset is reused by a third party, the scraper and the reusing AI developer are, in principle, separately responsible for their own respective processing. Only where both parties jointly determine the purposes and means does joint controllership come into consideration.

Transparency: When Does the Individual Duty to Inform Not Apply?

With controllership clarified, this also raises the question of adequate transparency: the information obligations under Articles 13 and 14 GDPR pose practical difficulties for controllers engaged in web scraping, since data subjects are often not individually identifiable where data is collected indirectly. The EDPB acknowledges that individual information may be dispensed with where it proves impossible or would involve disproportionate effort (Article 14(5)(b) GDPR). This exception, however, does not apply across the board; it requires weighing the effort involved against the impact on the data subjects concerned, considering the volume and age of the data and the safeguards already in place. As a minimum measure, the EDPB requires controllers in such cases to make the information publicly available, for instance through a privacy notice specifying the categories of data, the sources and, where possible, the characteristics of the crawler used.

Data Minimisation: Measures Before, During and After Collection

The principle does not rule out training on large volumes of data as such, but it does require that personal data not needed for the purpose should not be collected in the first place. The EDPB proposes a multi-layered set of measures to this end. Before collection, controllers should, among other things, consider using synthetic data, define precise selection criteria, and exclude websites that structurally contain particularly sensitive data or that technically oppose scraping, for example through robots.txt, ai.txt or CAPTCHA. During and after collection, syntax-based filtering, pseudonymization and anonymization come into consideration as well. In addition, the EDPB requires controllers to ensure data quality by relying on reliable sources, timestamping the data and carrying out sample checks, to meet the principle of accuracy.

Legitimate Interest as the Key Legal Basis

The question of which legal basis could justify any of this in the first place usually leads, in practice, to Article 6(1)(f) GDPR: consent is practically impossible to obtain in the case of indirect, large-scale collection, which is why web scraping for generative AI is regularly based on legitimate interest instead. The EDPB applies the familiar three-step test: the existence of a legitimate interest, the necessity of the processing, and a balancing of interests. As examples of legitimate interests, it cites the development of chatbots or improvements to threat detection. In the balancing exercise, particular weight is given to data subjects' ability to control their own data, possible chilling effects arising from a sense of being under surveillance, and data subjects' reasonable expectations, for example whether a website technically excludes scraping or whether the data was made recognizably and publicly available.

Where the balancing test comes out against the data subjects, mitigating measures such as opt-out lists, shortened retention periods or enhanced transparency measures can restore the lawfulness of the processing.

Special Categories of Personal Data

Handling sensitive data also poses a particular challenge: special categories of personal data under Article 9 GDPR are, in principle, subject to a prohibition on processing that can only be lifted where one of the exceptions under Article 9(2) GDPR applies. Because it is difficult to reliably rule out in advance that sensitive data will also be captured when scraping large volumes of data, the EDPB transposes the CJEU's reasoning in GC and Others (C-136/17), concerning the responsibility of search engine operators, to the web scraping context: the prohibition under Article 9(1) GDPR then applies only within the framework of the controller's responsibilities, powers and capabilities, provided the controller takes appropriate measures to prevent and delete such data before, during and after AI development. This transposition is subject to narrow conditions: it applies only where the activity is structurally comparable to that of a search engine, and only to the incidental, unintended capture of sensitive data.

Practical Note

Even though the guidelines have not yet been finally adopted, they already provide clear guidance that national supervisory authorities are likely to apply when reviewing existing and future training data pipelines. Companies that scrape data themselves, commission scraping, or purchase already-scraped datasets should promptly review their own documentation on the balancing of interests, data minimization measures and the handling of special categories of data against the criteria set out in the guidelines. The ongoing consultation also offers an opportunity to feed practical experience and concerns directly into the final text.

We would be glad to assist you in reviewing your training data pipelines for compliance with the new EDPB guidelines, as well as in preparing or updating your data protection documentation for AI training processes.

This recognition complements SKW Schwarz's excellent performance in the IP STARS 2026 rankings, where the firm was once again recognised among the leading firms for trademark and copyright law, with several of its practitioners receiving individual distinctions.

Congratulations to Margret Knitter on this well-deserved international recognition.

On 7 July 2026, the EDPB published its long-awaited Guidelines on the anonymisation of personal data (“Guidelines”). These Guidelines are currently in draft form and are expected to be adopted following the public consultation process, which is open until 30 October 2026.

What is this about?

The key criterion for the application of the General Data Protection Regulation (“GDPR”) is the processing of personal data (“PD”). This concept is defined broadly in Article 4(1) GDPR. According to Recital 26, sentence 5 GDPR, the principles of data protection do not apply to anonymous information. Consequently, the GDPR does not apply to information that does not relate to an identified or identifiable natural person. Existing links between information and an identifiable individual can be removed through anonymisation.

Although this fundamental distinction in data protection law already existed before the GDPR came into force, determining when information has been anonymised to a legally sufficient standard remains both a technical and legal challenge in practice.

The former Article 29 Working Party had already addressed this issue in its respective Opinion from 2014. Over the past ten years, the Court of Justice of the European Union (CJEU) has also issued several judgments on the subject (see, for example, most recently the SRB decision).

Key Content of the Guidelines

The EDPB aims to provide greater clarity in distinguishing between anonymous information and personal data by establishing a practical assessment framework.

According to the EDPB, the three key criteria are No Record Isolation, No Linkage, and No Inference (see paragraphs 52 et seq. of the Guidelines).

The first criterion, No Record Isolation, requires that a dataset does not contain any attributes capable of identifying an individual. Considered on its own, the data must not constitute personal data.

The second criterion, No Linkage, builds on the first. It requires that the dataset cannot be linked to another dataset in a way that would enable the identification of a natural person.

The third criterion, No Inference, requires that no conclusions about a specific individual can be drawn from the available data. Such conclusions or inferences must also not be possible through the combination of the data with reasonably available additional information. In practical terms, it must not be possible to re-identify a natural person through analysis, linkage, or statistical inference.

These three criteria interact with one another and may be satisfied to varying degrees. What matters is that, when assessed as a whole, the information has been effectively anonymised (see paragraph 53 of the Guidelines).

What Happens Next?

The EDPB invites all interested stakeholders to participate in the public consultation until 30 October 2026. As discussions are currently ongoing at EU level regarding the GDPR-related provisions of the Digital Omnibus Act-which also focus (or have focused) on the concept of personal data-we expect a significant number of submissions.

In our view, the Guidelines represent an important step towards making the GDPR's requirements and the relevant case law on anonymisation more practical and easier to apply.

We will also publish an analysis once the final version of the Guidelines has been adopted.