Search results for
Lawyers
Markus von Fuchs advises in intellectual property law, in particular in competition, patent, and trademark law as well as on the protection of know-how. He advises companies on protecting and commercially exploiting intellectual property, for example through licensing, sales, R&D, and cooperation agreements. He also focuses on the judicial and extrajudicial defense of intellectual property rights in interim injunction and principal proceedings. He further advises on border seizing procedures, initiates and advises on criminal measures relating to product and brand piracy, and on the infringement of business and business secrets. Markus von Fuchs also advises many companies on developing and introducing new technologies and business models. He has particular expertise in the optical and medical technology sectors.
Dr. Oliver Hornung advises national and international IT service providers and users in the legal structuring and negotiation of IT, project, and outsourcing contracts, as well as in matters of copyright and licensing. He is also regularly involved in distressed projects (dispute management) and advises clients in conciliation and arbitration proceedings and, where necessary, in litigation.
The regulatory environment for the use of data and corresponding technologies is complex and new legal acts are constantly being added by the European Commission. In this dynamic environment, Dr. Oliver Hornung advises his clients on all legal issues, in particular with a focus on AI compliance, Data Act, NIS-2, cyber security, cloud computing and data law.
Another focus of his legal advice is data protection with a focus on digital health and the EU's Digital Decade. If necessary, Dr. Oliver Hornung and his team defend the rights of his clients before supervisory authorities or in court.
Finally, Dr. Oliver Hornung advises start-ups on all questions relating to IT law and data protection law. In addition to his extensive practical work, Dr. Oliver Hornung is also a frequently requested lecturer in IT law and data protection law.
Norbert Klingner specializes in national and international movie/TV and advertising film production, financing, insurance, and distribution. He represents well-known producers, distributors, global distributors, and movie financing entities. His expertise ranges from negotiating and drafting contracts from the beginning of the material development to all matters related to production and financing up to the strategically correct exploitation and licensing. A selection of the film productions in which Mr. Klingner was involved can be found on the Internet Movie Database IMDb.
Margret Knitter advises her clients in all matters of intellectual property and competition law. This includes not only strategic advice, but also legal disputes. Her practice focuses on the development and defense of trademark and design portfolios, border seizure proceedings and advice on developing marketing campaigns. She advises on labelling obligations, packaging design, marketing strategies and regulatory questions, in particular for cosmetics, detergents, toys, foodstuffs and Cannabis. She represents her clients vis-à-vis authorities, courts and the public prosecutor's office.
In the field of media and entertainment, she mainly advises on questions of advertising law, in particular product placement, branded entertainment and influencer marketing. She is a member of the board of the Branded Content Marketing Association (BCMA) for the DACH region and member of the INTA Non-Traditional Marks Committee.
Dr. Matthias Nordmann advises international groups, mid cap companies, investors and entrepreneurs on company, commercial and corporate law in particular on structuring and mergers & acquisitions. He has a special focus on transactions in IP/IT driven industries as well as real estate.
Dr. Andreas Peschel-Mehner has provided legal counsel to all forms of digital business since the inception of the world wide web. His advisory spans start-ups, multi-channel offerings and international internet companies and focuses on all applicable legal fields with a particular emphasis on data protection and usage, terms and conditions, consumer protection, compliance, advertising, gaming and competition law, among numerous others. Dr. Andreas Peschel-Mehner also commands broad expertise in media and entertainment law, in particular issues touching on the film and television industry and those related to media production finance and the global exploitation thereof, with digital media advisory on changes to utilization models, revenue streams and video on demand platforms composing a significant part of his counsel.
An excerpt of the projects Dr. Andreas Peschel-Mehner has accompanied can be found on the Internet Movie Database IMDb. His advisory expertise is augmented by decades of involvement with and counsel of national and international computer game publishers and studios. Finally, developments and use of KI technologies across all his expert areas has become a strategic element of his practice.
Legal expertise – digitally sophisticated
Stefan Schicker has been advising clients at the intersection of law, technology, and innovation for over 20 years. As an experienced and award-winning lawyer specializing in IT and IP law, he assists national and international companies in the legally compliant design of digital business models – from the design of complex internet platforms to the protection of intellectual property.
One of Stefan Schicker's special areas of expertise is the legal structuring of corporate influencer initiatives: with specially developed workshops, he supports companies in setting up corporate LinkedIn communication in a legally compliant and effective manner – in accordance with copyright, personality rights, competition law, etc. – More information.
Legal tech & law firm development – with leadership experience
In parallel to his legal practice, Stefan Schicker is one of the most prominent legal tech experts in the German-speaking world. As former COO and CEO of SKW Schwarz, he played a key role in shaping the digital transformation of the law firm – from strategy to operational implementation.
Today, he supports law firms and legal departments in establishing and expanding modern structures:
- Development and introduction of AI-supported tools
- Establishing internal teams of experts and training concepts
- Change processes for the sustainable anchoring of digital working methods
- Organization of law firms as companies
Stefan Schicker brings a unique combination of legal depth, technological experience, and operational law firm management to the table – recognized, among other things, as one of the “Top 3 Legal Leaders of the Year” (Best of Legal Awards).
For companies and law firms that don't want to wait for the future
Whether companies with digital business models or law firms undergoing change: Stefan Schicker combines legal certainty with entrepreneurial foresight – and makes complex transformations understandable, feasible, and effective – More information.
News
NIS2: Registration deadline expires – Is your company affected?
Today, Friday, 6 March 2026, is the deadline for registration under NIS2. But what does this mean for companies that have not yet taken action? Are the first fines now imminent?
Registration requirement: Many companies still not registered
The German Federal Office for Information Security (BSI), as the responsible supervisory authority, has repeatedly emphasised in recent weeks that the number of registrations received is significantly below expectations. Apparently, many companies are still unaware that they fall within the scope of the NIS2 legislation.
What has happened so far?
The German law implementing the NIS2 Directive (EU) 2022/2555 came into force on 6 December 2025. The new regulations, which impose on affected companies to implement comprehensive cybersecurity measures, are now essentially contained in the amended Act on the Federal Office for Information Security (“BSIG”).
Section 33 BSIG stipulates that affected companies must register with the BSI within three months. From a formal legal perspective, late registration already constitutes the first violation punishable by a fine (up to € 500,000).
The BSI portal for NIS2 registration
Since 6 January 2026, a dedicated portal for NIS2 registration has been available on the BSI website. Affected companies can and must use this portal to submit the required information. The portal guides users step by step through the process – from master data and contact details to IP address ranges and the relevant sector. Detailed instructions on how to register using an ‘Elster’ certificate and ‘Mein Unternehmenskonto’ (MUK) can also be found on the BSI website.
Are fines now imminent?
The good news is that the BSI has repeatedly stated publicly that it will not yet impose any sanctions for late registrations at this stage. This is particularly relevant given that the registration portal only went online one month after the law came into force. Therefore, no immediate fines or other measures are to be expected in the coming weeks.
However, this is not an invitation to just sit and wait. It is unclear how long this ‘final grace period’ for companies affected by NIS2 will last.
Why are so many companies affected and unaware of it?
One reason for the low registration rate is the significantly expanded scope of application of the new BSIG. The explanatory notes to the law assume that around 30,000 companies in Germany are affected – in reality, the number is likely to be significantly higher.
It no longer affects only traditional critical infrastructures (KRITIS), but a broad spectrum of sectors and activities. In addition to some service providers that are affected per se, companies listed in Annexes 1 and 2 of the BSIG fall within the scope of application – either as ‘important entities’ or as ‘particularly important entities’.
The relevant thresholds apply not only to the respective sector activities, but to the entire company or group of companies: as few as 50 employees or, alternatively, an annual turnover and annual balance sheet total of over 10 million euros may suffice. The values of affiliated group companies are also included in the calculation!
Surprising results: examples from practice
Many companies are simply unaware that they are subject to NIS2 obligations. This is partly due to the broad definitions of the sectors affected. Here are a few examples from our consulting practice:
- Group IT: Do you provide other group companies with IT applications such as Confluence or Microsoft? Then you are probably considered a managed services provider (MSP) according to Annex 1 BSIG. Even the internal operation or support of ICT applications for other group companies is sufficient. Employees and revenues of affiliated companies are usually included in the calculation – the thresholds are quickly reached.
- E-commerce: Do you operate your own online shop and also allow third parties to sell through it – perhaps even only companies affiliated with your group? Then you are probably considered an operator of an online marketplace within the meaning of NIS2 and must comply also with the requirements of the additional Implementing Regulation (EU) 2024/2690.
- Property managers and telecommunications services: Are you a housing association offering your tenants internet, TV or telephone services via a tenant surcharge? If so, as a provider of publicly available telecommunications services, you may be affected by NIS2 regardless of threshold values.
- Photovoltaic systems: Do you operate photovoltaic systems on your office building or production site and feed electricity into the public grid or sell it to tenants? Unless this activity is exceptionally ‘negligible’, you may be affected as an energy producer under Annex 1 BSIG.
- Manufacturing industry: The NIS2 Directive and the BSIG refer to the statistical sector list ‘NACE Rev.2’. This list is very broad. Even manufacturers of seemingly harmless products such as lamps or household appliances and the entire mechanical engineering sector can be considered ‘important entities’ if they have 50 or more employees or a turnover of 10 million euros.
What should you do now?
Carefully check whether your company is affected. The management (“Geschäftsführung”) is responsible for implementing and monitoring NIS2 obligations. They must also undergo special training. In the event of negligence, management is personally liable to the company.
Are you unsure whether your company is affected or how to implement the obligations? Feel free to contact us – we will support you in implementing the NIS2 requirements. In an introductory workshop, we will be happy to explain to you in a concise and understandable manner which NIS2 requirements the law and the supervisory authority specifically require of you and how you can implement these requirements efficiently. We support you in NIS2 implementation, in particular with legal assistance for your gap analysis and implementation measures, in securing the supply chain through fair purchasing conditions and in the legal part of the legally required management training.
A free quick check using our NIS2 impact analysis tool offers you initial guidance.
You can find our SKW white paper on this topic here.
Geopolitical conflicts – How can companies protect themselves in uncertain times?
The current very difficult geopolitical situation has shown that such events can affect any company. Acute crises in the form of cyber attacks, power outages, fires or the effects of armed attacks have become much more likely. The question arises as to how companies can prepare for geopolitical conflicts and thus remain capable of acting.
The Hamburg Chamber of Commerce, in cooperation with the Federal Office for Civil Protection and Disaster Assistance (BBK), has made a support offer available to companies, which can be accessed via this link.
The crisis prevention plan helps companies in the following ways:
- Identification of risks within the company;
- Securing critical processes;
- Establishing clear responsibilities;
- Preparing emergency communication in the event of a crisis;
- Recommendations for action on how to overcome disruptions or failures.
The Hamburg Chamber of Commerce's contingency plan increases resilience within a company and is a useful aid, especially for small and medium-sized enterprises. However, it is not enough to simply draw up plans and file them away. Responding to such crises must be practised. It is also advisable to coordinate with other stakeholders, such as civil defence, fire brigades, utilities and politicians, at an early stage.
Now it's getting serious: EmpCo directive against greenwashing implemented in German Unfair Competition Act
What you need to know now to avoid drastic consequences from September 2026 on!
With the long-awaited publication of the third amendment to the German Unfair Competition Act (“UWG”) in the Federal Law Gazette on February 19, 2026, the concrete implementation of the EU directive “Empowering Consumers for the Green Transition” (EmpCo) has been finalized. It significantly tightens competition law standards for sustainability communication and environmental advertising. Anyone who wants to continue to operate risk-free on the market after it comes into force on September 27, 2026, should take action now at the latest.
New requirements for sustainability communication & sustainability labels
The EU directive and the new UWG are intended to enable consumers to make more informed, sustainable decisions. The EU is thus picking up the fight against greenwashing. This affects everyone who participates in the market and communicates towards consumers. In Germany, the “black list” of the UWG has been supplemented with further per se prohibitions.
The following will be prohibited in the future:
- Sustainability advertising without sufficient explanation (“generic environmental claims”)
- Untrue statements about the scope of an environmental claim (“product, company, or just a part of the product?”)
- Environmental claims based solely on compensation measures for greenhouse gas emissions (e.g., “climate neutral” or “reduced carbon footprint”)
- Use of sustainability labels without a compliant certification scheme with a third-party monitoring body – this includes all trust marks, quality marks, or equivalent, i.e., basically anything that could be perceived as a label in any way
- Presentation of legal requirements as a special feature
- Misleading information about software updates, durability, and reparability
Greenwashing, which since the Federal Court of Justice's “climate-neutral” ruling at the latest can lead to serious consequences – essentially a sales ban – will be targeted even more vigorously. The list of other “important product features” in the UWG is also being expanded. In the future, “social washing” and “repairability washing” are also likely to be the focus of consumer and competition associations as well as competitors. Other new features include various pre-contractual information requirements regarding durability, repairability, software updates, and sustainable delivery options, as well as the harmonization of warranty and guarantee labels. Advertising with future environmental performance, e.g., climate targets, will also only be permitted with a verifiable concrete implementation plan and budget commitments.
Urgent need for action for all market participants
The new UWG will apply without exception from September 27, 2026, and does not provide for a transition period or a grace period for products already manufactured. Products and marketing materials that do not comply with the standards are likely to be subject to warning letters and injunctions. There is a risk that goods that do not comply with the law will be unmarketable. Fines are also possible for widespread violations, not to mention the risk of reputational damage.
How companies can best prepare
Even though the transition to the new UWG often requires considerable time, it is not too late to review your own brand, product, and marketing portfolio for compliance. The following should be critically examined in particular:
- advertising statements, online presence, and marketing material
- (product) packaging
- possible sustainability labels – i.e., anything that resembles a label
If relevant or problematic elements are discovered, changes should be initiated immediately. If adaptation is no longer possible, e.g., due to large quantities of old stock, a legally reviewed strategy for minimizing risks and losses should be pursued.
We would be happy to support you in the timely and rapid implementation of the new UWG and help you communicate your commitment to sustainability in a legally compliant manner in the future.
SKW Schwarz nominated for the Managing IP EMEA Awards 2026 in the categories ‘Copyright & Design’ and ‘Trademark’
The commercial law firm SKW Schwarz has been nominated in two significant areas as “Law Firm of the Year – Germany” in the current shortlists for the Managing IP EMEA Awards 2026: for Copyright & Design and for Trademark. The awards are among the most prestigious honours in the field of intellectual property and are based on an independent analysis of the performance of IP law firms and teams.
The double nomination underscores SKW Schwarz's particular expertise in trademark, design and copyright law, as well as the consistently high quality of its advice in complex national and international mandates. The nomination is also a reflection of our strength in IP litigation, where we have attracted attention with high-profile court proceedings.
“The nomination in two categories is a great confirmation of our work and the trust our clients place in us. It shows that we are pursuing the right approach with our strategic, business-oriented and practical IP advice,” says Oliver Stöckel, Head of IP at SKW Schwarz.
The Managing IP EMEA Awards 2026 ceremony will take place in spring 2026.
Further information on the shortlists can be found here.
No works council for Lieferando's remote cities: Why AI and platform control do not create a establishments
Companies in the “Gig Economy” that offer app- or platform-based “on-demand” services – such as delivery, transportation, courier, or IT service providers – usually organize their work in a decentralized manner across geographical units. In the case of app-based delivery services such as Lieferando, these areas of activity are subdivided into so-called “hub cities” (main transshipment bases with administration and back office) and “remote cities” (delivery areas without a “head office” where only deliveries take place).
In several related proceedings (decisions of January 28, 2026 – 7 ABR 23/24, 7 ABR 26/24, and 7 ABR 40/24) that purely remotely controlled organizational areas in “remote cities” are generally not eligible for works councils. In the court's opinion, such purely digitally controlled entities are neither establishments nor independent separate departments of establishments within the meaning of Section 4 (1) sentence 1 BetrVG. For an independent separate departments of establishments, a minimum degree of organizational independence from the main enterprise is required. This minimum degree is not achieved solely by the fact that there is a distinct group of delivery drivers with common interests or that these drivers are grouped together in a duty roster.
The court thus concurs with a series of previous state labor court decisions from recent years. The lower courts made it clear that a digitally controlled organizational unit can only be considered an independent separate departments of establishments if there is an “institutionalized” management on site that determines the deployment of employees and actually exercises the employer's authority to issue instructions. This therefore requires structured management that makes decisions on social and personnel matters. However, in the case of platform-based control of personnel and business processes, these decisions are usually made purely “remotely.” According to the Schleswig-Holstein Regional Labor Court (6 TaBV 20/23), the use of artificial intelligence in personnel management does not change this.
The decision of the Federal Labor Court is relevant for all companies that use platform-based business models and work with decentralized structures or purely digitally controlled (personnel) processes. It gives reason to review the platform- or app-controlled organizational structure to determine whether individual units meet the requirements for a business or independent part of a business.
If units are to be considered independent, organizational responsibilities and personnel management powers must be clearly defined and documented. Otherwise, companies should ensure that the management of remote cities actually originates from the hub cities and that no independent management functions arise in the remote cities that could unintentionally lead to works council eligibility.
The Platform Work Directive (Directive (EU) 2024/283), which has not yet been implemented in Germany, does not require a different assessment. According to Article 20 of the Directive, it must only be ensured that workers can communicate privately and securely with their representatives via the digital infrastructure of the platforms or comparable effective means. However, the Directive does not contain any requirements regarding the organizational prerequisites for employee representation.
We are happy to assist you with any questions you may have about your digital business processes and the design of works council structures.
Upcoming amendments to the Medical Cannabis Act (MedCanG) – Telemedicine platforms under scrutiny
On December 18, 2025, the German Bundestag held the first reading of the Federal Government’s draft bill for an initial amendment to the Medical Cannabis Act (MedCanG). The government aims to respond to a sharp surge in imports of cannabis flower for medical purposes, which have risen by up to 400 percent, as well as to the growing use of telemedicine platforms for issuing prescriptions. Following the first reading and plenary debate, the draft bill was referred to the relevant parliamentary committees for further consideration, led by the Health Committee.
A core element of the bill is a comprehensive revision of Section 3 MedCanG. Paragraph 1 is to be amended to explicitly stipulate that cannabis for medical purposes may only be prescribed where a valid medical indication exists. Paragraph 2, by contrast, is to be completely rewritten. Under the current law, the provision reads as follows:
“Cannabis prescribed for medical purposes pursuant to paragraph 1 may be dispensed to end consumers only through the operation of a pharmacy upon presentation of a prescription. Section 14 Paragraph 7 of the Pharmacy Act remains unaffected.”
The Federal Government’s draft bill now proposes the following new wording:
“The cannabis flowers referred to in Section 2 No. 1 may only be prescribed following an in-person consultation between the patient and the prescribing physician at the physician’s medical practice or in the course of a home visit by the prescribing physician to the patient. Follow-up prescriptions may be issued without a renewed in-person consultation pursuant to sentence 1 only if the prescribing physician has prescribed the cannabis flowers referred to in Section 2 No. 1 to the patient within the last four quarters, including the current quarter, following an in-person consultation pursuant to sentence 1. (…)”
This would mean that, in future, the initial prescription of cannabis for medical purposes would be permitted exclusively after a face-to-face consultation between patient and physician—either at the doctor’s practice or during a home visit. According to the explanatory memorandum, a medical practice is defined as “the physical location where a physician receives, advises, examines and treats patients,” irrespective of whether it is a solo or group practice.
The legislative rationale further clarifies that, as a result of the amendment, “treatment exclusively with cannabis flowers for medical purposes via video consultation is to be excluded due to the special status of cannabis flowers for medical use.”
The background to this reform is the rapid growth of telemedicine platforms that enable consumers to obtain medical cannabis flowers without ever having a personal doctor–patient consultation—or, in some cases, any direct contact with a physician at all. In practice, consumers can initiate an order for medical cannabis simply by completing an online questionnaire on a telemedicine platform, with dispensing handled by cooperating mail-order pharmacies. In such cases, there is neither personal contact with a physician nor interaction with pharmaceutical staff at the pharmacy.
Given the risk of dependency associated with cannabis use and the potential health risks related to brain development, medical cannabis is considered to occupy a special position among prescription-only medicinal products. This special status, the explanatory memorandum argues, now warrants specific regulatory measures to safeguard patient safety without undermining access to medicines.
The planned amendment is therefore intended to effectively prohibit telemedical prescriptions of medical cannabis altogether. Should the draft bill pass the Bundestag unchanged, it could represent a significant setback for the competitiveness of telemedicine providers—at least in the medical cannabis segment.
For further insights into the legal framework and current developments in telemedicine, please refer to our white paper “Digital Health & Telemedizin,” available for download here. A more in-depth overview of the legal foundations of telemedicine will also be provided by our partner Dr Oliver Stöckel at the DVNW Forum on February 25, 2026.
Can you be blamed for your influencer’s mistakes? What companies need to know about liability.
Influencers have become a staple in modern marketing strategies. By sharing glimpses into their personal lives, they come across as relatable, and their product recommendations feel genuine—an authenticity that builds trust. It’s no surprise that influencer marketing can significantly boost product and service sales.
But what happens when an influencer crosses the line and publishes illegal content? Can the company that hired them be held liable? The Higher Regional Court of Cologne recently tackled this question again—this time in the context of advertising a medicinal product (judgment of September 11, 2025, Ref. 6 U 118/24). It’s an issue that frequently arises in our legal practice as well.
The ruling clearly shows that companies should not only focus on the creative design of influencer marketing campaigns, but also on a solid legal framework. This is because case law is increasingly holding the commissioning companies liable and regularly regards influencers as “agents” of the respective company in terms of competition law, Section 8 (2) of the German Unfair Competition Act (UWG).
Particularly strict standards apply to the advertising of medicinal products in order to protect consumers. The reason for this is that misleading advertising in this area can have particularly serious consequences. The goal is to protect consumers, as misleading claims in this area can have serious consequences. This is especially relevant when a well-known personality (“celebrity”) with a large audience endorses such products. Under Section 11(1) No. 2 of the German Health Services and Products Advertising Act (HWG), there is no fixed threshold for such prominence; the court has assumed the influencer's popularity with 130,000 followers. The key factor – according to the court – is whether the target audience perceives the individual as well-known and trustworthy.
Many influencers, however, are unaware of these strict legal requirements. In this specific case, the legally mandated disclaimer “Risks and side effects…” was missing — mandatory warning that even short-form content like Instagram reels must include. And further: simply linking to the mandatory text is not sufficient according to the court.
Practical tip: When a company engages an influencer to promote its products, it should equip them with clear and comprehensive guidelines on how to design the content. In practice, detailed contractual provisions are one of the most effective tools to protect your company.
If your company is later sued by a competitor or, for example, a consumer protection authority because of the influencer’s advertising, it can at least seek contractual recourse against the influencer. If there are specific regulatory requirements in your industry, make sure influencers are explicitly informed about the legal rules that apply to the promotion of your products.
Our team is happy to support you in identifying and managing the “risks and side effects” … of influencer marketing campaigns.
Influencer marketing: It can be a goldmine. Today’s case-law update reveals what brands and creators must know to avoid liability pitfalls, especially when it comes to sensitive topics like pharmaceutical advertising.
SKW Schwarz again recognized in the JUVE ranking “Succession, Wealth, Foundations”
The latest edition of the JUVE Handbook of Commercial Law Firms once again confirms the strong position of SKW Schwarz in the field of Succession, Wealth, Foundations. The editors particularly highlight the breadth and depth of expertise within our Private Clients practice.
Key strengths noted in the ranking include:
- our specialized expertise in family law, particularly in divorce matters, asset division and marital agreements,
- our comprehensive advisory capabilities regarding succession and wealth structuring, covering foundation law, inheritance law, corporate law and tax law,
- our extensive experience in business succession planning, gift and exit taxation, as well as disputes over compulsory portions,
- our capabilities in establishing and advising family offices, lifetime foundations and complex wealth structures,
- our strong notarial and transaction-related know-how in finance and real estate matters.
This renewed recognition underscores JUVE’s assessment of the continued development of our practice and the exceptional commitment of our Private Clients team. We are grateful for the trust our clients place in us, which makes achievements like this possible.
The full JUVE entry is available here.
Digital Omnibus – part of the European Commission's new digital package
The EU Commission recently adopted a new digital package. The digital package is intended to help companies in the EU – from start-ups to industrial enterprises – reduce compliance and administrative burdens so they can focus more on innovation and growth. At the heart of the package is the Omnibus Regulation (‘Digital Omnibus’), which is primarily intended to simplify rules for artificial intelligence, cybersecurity and data. Below, we provide an overview of the most relevant rules and changes.
After numerous EU digital regulations have gradually come into force in recent years as part of the Digital Decade and are already being applied in some cases (an overview of the status of the laws can be found on our Digital Decade landing page), the EU now wants to move into a phase of consolidation and simplification – primarily in response to pressure from industry, which is facing increasingly significant compliance costs and, in some cases, overlapping obligations. The package is intended to address precisely this issue by better harmonising existing regulations, reducing duplicate requirements and making application and implementation more practical for businesses.
The Digital Omnibus, which primarily aims to consolidate regulations on artificial intelligence, cybersecurity and data, is complemented by the Data Union Strategy, which aims to facilitate access to high-quality data for AI, and by the European Business Wallets, which provide companies with a single digital identity.
Below, we would like to provide an initial overview of the changes in the Digital Omnibus:
What are the key changes to EU data law?
With the Digital Omnibus, the EU is pursuing a consolidated further development of data law. The aim is to simplify regulations, reduce administrative burdens and create a clearer framework for data-driven innovation. The focus is on amendments to the Data Act and selective changes to the GDPR – all data rules are to be consolidated in these two main pieces of legislation.
The following adjustments are planned for the Data Act:
- Consolidation of previous legal acts: Several previously coexisting legal acts, including the Open Data Directive, the Free Flow of Non-Personal Data Regulation and the Data Governance Act, are to be integrated into the Data Act in order to create a uniform set of rules for non-personal data.
- Data intermediation services: Mandatory registration and the EU label for data intermediaries are to be abolished, significantly streamlining the regulatory framework as a whole. New intermediation models should be able to be offered more quickly and with less red tape as barriers to market entry are lowered.
- Data altruism: The legal framework for public interest data sharing will be simplified to reduce the complexity of existing structures and requirements. Organisations should be able to make data available more easily for research, health or sustainability purposes without having to comply with extensive administrative processes.
- Public sector data sets: Existing requirements for public data sets are to be consolidated and harmonised to eliminate existing fragmentation. It should be easier for companies to understand which public data can be used under which conditions in order to strengthen innovation in the internal market.
- Business-to-government access (B2G): Access by government agencies to company data should be clearly limited to genuine emergencies and crises such as natural disasters or pandemics. Outside of such situations, companies should not be subject to additional or unclear disclosure requirements.
- Relief through bureaucracy reduction and harmonisation: The regulatory framework in the areas of data, data protection, cybersecurity and AI should be streamlined and harmonised by centralising reporting systems and reducing information requirements.
The following changes are planned for the scope of cloud switching obligations:
The Omnibus proposal specifically realigns the scope of the Data Act's cloud switching rules. The basic principle of easier switchability between cloud, edge and data processing services remains in place, but is made more precise and placed on a more proportionate and risk-based basis. The most important adjustments are summarised below:
- Restriction of the scope of application for SMEs and micro-enterprises: The switching obligations shall only apply if they are technically feasible and economically reasonable for these providers. This is intended to relieve smaller market participants of disproportionate regulatory requirements.
- Exemption for customer-specific data processing services: Individually developed data processing solutions that are provided exclusively for a single customer will no longer be subject to the full cloud switching obligations. The reason for this is that interoperability and standardised data portability are often neither technically feasible nor practicable in such tailor-made architectures.
- Emphasis on the technical and economic feasibility of switching: The omnibus clarifies that the requirements should only apply if they can be met at reasonable cost. This clarification reduces existing legal uncertainties and prevents providers from finding themselves in situations where compliance would be virtually impossible or disproportionately expensive.
- Strengthening existing industry standards: The reform makes it clear that service providers do not have to develop new proprietary interfaces. The use of industry-standard data formats and protocols should be sufficient to meet the requirements. This reduces development effort and integration costs, especially for smaller providers.
- More user-friendly switching framework: The EU remains committed to reducing switching costs and giving users real opportunities to switch providers. At the same time, the reform aims to ensure that specialised or smaller providers are not squeezed out by excessive compliance burdens.
Overall, the aim is to create a more differentiated, proportionate and risk-based switching framework. The cloud switching regime of the Data Act will remain functional, but will focus more clearly on standardisable services and on providers for whom the implementation of the obligations is realistic and economically viable.
The following adjustments are planned for the GDPR and the rules on cookies:
- New approach to cookie banners and consent management: Until now, regulation has been based on a two-tier divided structure: access to end devices fell under the ePrivacy Directive, while the subsequent processing of personal data was subject to the GDPR. The Commission's new proposal ends this dual system. In future, cookies and similar tracking technologies will be fully integrated into the GDPR, resulting in a harmonised legal framework with common principles, enforcement mechanisms and sanctions. The Commission recognises an existing problem: consent management often works poorly in practice. Users are confronted with complex pop-ups, and many reflexively click ‘Accept all’ to continue browsing. This hardly represents the informed consent originally intended by the legislator. The aim of the reform is therefore to make consent a functional and credible legal basis again. Among other things, the proposal stipulates that cookie banners must offer a genuine ‘one-click option’ to reject all non-essential cookies – visible, equivalent and as easily accessible as the ‘Accept all’ option. A rejection must be valid for at least six months.
- Central system for data protection preferences: The planned rules on technical preference signals are even more far-reaching: users should be able to set data protection decisions once (e.g. in their browser or operating system). Websites and apps must automatically respect these machine-readable signals in future. Companies must therefore design their consent mechanisms in such a way that these standards can be processed.
- Differentiation between high-risk tracking and low-risk uses: The proposal introduces a ‘whitelist’ of certain privacy-friendly types of use, for example for statistical analyses or aggregated audience measurements. If the specified conditions are met, companies may process device data for narrowly defined purposes without consent and without cookie banners. For companies that primarily perform performance analyses or service optimisations, this means fewer banners, less compliance overhead and a more user-friendly experience.
- Stricter enforcement, but more legal certainty: Through integration into the GDPR, violations of rules on end device access will in future be subject to the existing framework of sanctions. At the same time, the reform aims to increase legal certainty by reducing fragmentation and clarifying protection standards.
- Clarifications regarding the definition of personal data: The proposal implements current ECJ case law. Data is not considered personal to a recipient if the recipient has no realistic possibility of re-identification. However, the original controller who pseudonymised the data retains all obligations under the GDPR.
- Technical guidelines via implementing acts: The Commission is given the power to lay down technical criteria and methods for pseudonymisation and the assessment of re-identification risks. This is intended to provide companies with clearer assessment criteria and practical guidance in future.
- Changes to the GDPR: The ‘Digital Omnibus’ does not change the basic structure of the GDPR, but addresses specifically identified problem areas:
- Innovation and AI: The proposal clarifies that the development and operation of AI systems and models can be based on the legal basis of ‘legitimate interest’ as long as the processing meets all the requirements of the GDPR and is not prohibited by other EU or national regulations or subject to consent. If special categories of personal data appear only residually in training or test data sets and are not the subject of the collection, a narrow exception to the usual processing prohibition is introduced. Controllers must implement appropriate safeguards throughout the AI lifecycle, remove such data as soon as it is identified, and ensure that it is not used to derive results or made available to third parties. Data subjects retain an unrestricted right to object to the processing of their personal data for these AI purposes.
- Simplification of everyday compliance obligations: Information obligations do not apply if there are legitimate reasons to believe that data subjects already have the information and the processing does not pose a high risk. This benefits smaller companies with limited data usage.
In addition, the right to information is protected against misuse: Controllers can respond to manifestly unfounded requests with a refusal or a reasonable fee; with a lower burden of proof than today to show that a request is excessive.
- Data protection impact assessments are harmonised through EU-wide uniform lists, both for types of processing that always require a DPIA and for those that do not. This is supplemented by a uniform methodology and template.
- Notifications of data breaches to supervisory authorities will in future be aligned with the ‘high risk’ threshold – the same threshold at which notification of the data subjects is already required. Notification will be made centrally via a single point of contact linked to other digital and cybersecurity-related regulations. For companies, this means fewer reports with little benefit, a more predictable risk assessment and more efficient communication with supervisory authorities.
- Innovation and AI: The proposal clarifies that the development and operation of AI systems and models can be based on the legal basis of ‘legitimate interest’ as long as the processing meets all the requirements of the GDPR and is not prohibited by other EU or national regulations or subject to consent. If special categories of personal data appear only residually in training or test data sets and are not the subject of the collection, a narrow exception to the usual processing prohibition is introduced. Controllers must implement appropriate safeguards throughout the AI lifecycle, remove such data as soon as it is identified, and ensure that it is not used to derive results or made available to third parties. Data subjects retain an unrestricted right to object to the processing of their personal data for these AI purposes.
What does this mean for companies? For many businesses, the immediate headline will be the prospect of fewer and simpler cookie banners. But the real change runs deeper: all device‑based data access is drawn into a single GDPR‑based regime, augmented with central preference signals, a privacy‑friendly whitelist for low‑risk uses, and tougher expectations around consent design. At the same time, long‑running ambiguities around pseudonymized data, AI training, access requests, information duties, DPIAs and breach notifications are addressed through targeted legislative clarifications and mechanisms for future technical guidance. In practical terms, businesses that invest early in mapping their cookie and tracking practices to the new whitelist, in re‑engineering consent flows around “one‑click” choice and central signals, and in aligning AI and analytics projects with the clarified legitimate‑interest and pseudonymization framework will be best placed to benefit from the promised simplification – and to avoid becoming the test cases for the strengthened enforcement system that comes with it.
What changes will the Digital Omnibus bring to cyber security law?
Simplified reporting of cyber security incidents: Under current law, companies must comply with various legal reporting obligations under different legal acts in the event of a cyber security incident (e.g. Art. 32 GDPR, Art. 23 NIS-2 Directive, Art. 14 CRA and many other sector-specific reporting obligations such as Art. 73 AI Act for high-risk AI systems, Art. 19 DORA in the financial sector, etc.). Each of these reporting obligations is subject to different content requirements and different reporting deadlines and is addressed to different authorities. The EU Commission's proposal aims to simplify reporting under cybersecurity law and consolidate it in a single point of contact at the European Agency for Cybersecurity (ENISA). A central reporting portal is to be set up at ENISA, where affected companies can submit their mandatory reports on cybersecurity incidents in a collective manner. These reports will then be processed centrally by ENISA and forwarded to the relevant authorities. The exchange of reported information between authorities is also to be facilitated. The reporting platform for vulnerabilities established under Article 16 CRA is to be used to implement the changes. The EU Commission expects that this will reduce the annual costs associated with reporting cybersecurity incidents by up to 50%.
The Commission's draft specifically addresses inter alia existing reporting obligations under NIS-2, GDPR, eIDAS-VO and DORA. However, the substantive requirements for the individual reporting obligations and the respective competent supervisory authority remain largely unaffected by the proposed amendments. However, the proposal also contains some substantive adjustments. For example, the deadline for reporting data protection incidents in Art. 33 GDPR is to be increased to 96 hours and will in future only apply to breaches with a high risk to data subjects.
What are the main changes in the area of artificial intelligence and the AI Act?
The AI Act came into force in August 2024 and is being implemented in stages: some provisions, such as certain prohibitions, requirements for AI competence and rules for general-purpose AI models, are already in force. The remaining provisions are to become binding from 2 August 2026. The European Commission identified several challenges during the 2025 stakeholder consultations and is now proposing the following adjustments:
- New timetable for high-risk AI systems: The application of the rules will be linked to the availability of standards and support tools. Once the Commission has confirmed that these are sufficiently available, the rules will enter into force after a transition period.
- Annex III AI systems: 6 months after the Commission's decision or by 2 December 2027 at the latest.
- Annex I systems: 12 months after the Commission's decision or by 2 August 2028 at the latest.
- AI competence: The obligation for companies to ensure an adequate level of AI competence is removed. Instead, the Commission and Member States should encourage providers and users to provide sufficient AI competence.
- Processing of special categories of personal data: Providers and users of AI systems may process special categories of personal data for bias detection and correction, provided that appropriate safeguards are in place.
- Registration of high-risk AI systems: Systems used in high-risk areas for tasks that are not themselves considered high-risk no longer need to be registered.
- Expansion of the use of AI regulatory sandboxes and real-world testing: From 2028, an EU-wide regulatory sandbox is to be established, among other things.
- Abolition of the requirement for a harmonised post-market monitoring plan.
- Extension of simplified compliance rules to small and medium-sized enterprises (SMEs): For example, simplified rules for the technical documentation required for AI systems are to apply to SMEs.
- Centralisation of supervision of AI systems based on general-purpose models: Supervision will be bundled at the AI Office to reduce governance fragmentation. AI in very large online platforms and search engines will also be supervised at EU level.
- Clarification of interaction with other EU legislation: Procedures will be simplified to ensure the timely availability of conformity assessment bodies.
Unpleasant surprises regarding presumed rights of representation between spouses/registered civil partners
In consulting practice, one often finds the assumption that spouses/registered civil partners are allowed to make comprehensive decisions for each other if the other becomes incapacitated due to illness or accident.
This is not the case, which can lead to unpleasant surprises.
On 1 January 2023, the reform of guardianship law (Betreungsrecht) introduced the so-called emergency representation right for spouses (Notvertretungsrecht, Section 1358 of the German Civil Code (BGB)) for the first time. Previously, statutory power of representation was only provided for in relation to transactions covering basic living expenses (Section 1357 (1) BGB). Put simply, this made it possible to represent the other spouse ‘within the scope of weekly shopping’. However, there was no further authorisation.
Even with the introduction of the right of emergency representation for spouses (Notvertretungsrecht), this has not changed significantly and only within the scope of health care. In detail:
‘If one spouse is legally unable to manage their health care affairs due to unconsciousness or illness,’ the other spouse (Section 1358 (1) BGB) may, for a maximum period of six months, essentially:
- consent to or refuse examinations, medical treatment and surgical procedures (with restrictions under Section 1358(6) in conjunction with Section 1829 of the German Civil Code (BGB))
- conclude and enforce treatment/hospital contracts or contracts for urgent rehabilitation measures,
- decide on measures that may deprive the patient of their physical liberty (such as bed rails) to a limited extent, and
- assert claims against third parties (e.g. social security institutions) on the basis of the illness.
During this period, the spouse is also exempt from medical confidentiality obligations towards the patient.
The spouse/partner must exercise the right of representation in accordance with the wishes or presumed will of the patient.
However, this right of emergency representation does not apply if the partners are separated or if a power of attorney has been granted that includes the aforementioned rights, or if guardianship (Betreuung) has been established with this area of responsibility. However, representation vis-à-vis the spouse may be objected to in advance or this decision may be entered in the Zentrale Vorsorgeregister (Central Register of Lasting Powers of Attorney). In some cases, the approval of the Betreuungsgericht (guardianship court) is still required.
In order to exercise the right of emergency representation, a doctor must also confirm in writing that the requirements are met (cf. Section 1358 (4) BGB).
The explanations make it clear that representation in (other), especially financial matters, is not covered.
Extensive representation rights for spouses can only be achieved by expressly granting them power of attorney before an emergency arises. In addition to bank power of attorney, it is generally advisable to grant power of attorney (Vorsorgevollmacht) in order to ensure that your spouse/partner is able to act on your behalf. Further important information can be found here.
In the power of attorney (Vorsorgevollmacht), ideally in combination with a patient declaration (Patientenverfügung), it is possible to comprehensively and detailedly regulate which rights the partner (or even a third party) should have in the event of incapacity and which treatment (or non-treatment) is desired.
We would be happy to advise you comprehensively on the issue of emergency representation rights as well as on questions regarding power of attorney and patient declarations.











































