Technology & Cyber Regulations in Germany

July 29th 2026

“There is still plenty of scope for innovation”

Financing, lending, compliance and internal communication: financial entities are using artificial intelligence (AI) in an increasing number of areas. These entities must observe the provisions of the new AI Act. How prepared are they for this? And what is Bafin’s new role? Bafin expert Jens Obermöller addresses these questions in an interview.

Sectors:

Banking & Credit Insurance & Pensions

Topics:

Technology & Cyber Operational Resilience / Outsourcing

BankInsuranceAll Firms

View Original

🇩🇪 BaFin News

July 29th 2026

Market surveillance of AI: Bafin granted new powers

In future, Bafin will monitor the use of AI systems by companies in the financial sector. Its key objectives will be to promote innovation and to protect fundamental rights.

Sectors:

Banking & Credit Insurance & Pensions Capital Markets & Trading

Topics:

Technology & Cyber Consumer Protection / Conduct Operational Resilience / Outsourcing

BankInsuranceAll Firms

View Original

🇩🇪 BaFin Enforcement high

July 20th 2026

TeamViewer SE: Bafin imposes administrative fine

On 16 July 2026, the Federal Financial Supervisory Authority (Bafin) imposed an administrative fine amounting to €240,000 on TeamViewer SE on the grounds that the company had violated the Market Abuse Regulation (MAR). The fact that TeamViewer SE had fallen victim to a cyberattack should have been disclosed by the company without delay as inside information.

AI Analysis

BaFin has imposed a €240,000 administrative fine on TeamViewer SE for failing to disclose a significant cyberattack as inside information without delay under Article 17(1) MAR. The case materially raises the bar for ad hoc disclosure of cyber incidents for German-listed issuers, confirming that major cyberattacks on technology-driven businesses are presumptively inside information requiring rapid public disclosure.

What Changed

- BaFin has explicitly treated a material cyberattack on a listed software company as *inside information* that must be disclosed without delay under Article 17(1) MAR.
The decision confirms that failure to publish inside information “as soon as possible” constitutes a contravention of subparagraph 1 of Article 17(1) MAR and is subject to administrative fines.
BaFin reiterates that issuers based in Germany with securities traded on an organised market in Germany are subject to an ad hoc disclosure obligation for inside information.
BaFin highlights that inside information includes precise, non-public information directly or indirectly relating to an issuer or its instruments, which would likely have a significant price effect...
The enforcement action illustrates BaFin’s willingness to use its full MAR toolkit on disclosure failures, with potential maximum fines of €2.5 million or up to 2% of total revenue for similar...

Suggested Considerations

Conduct an immediate review of incident classification frameworks to ensure that significant cyberattacks are systematically assessed for MAR “inside information” criteria, including likely price impact.
Update ad hoc disclosure policies and procedures to explicitly cover cyber incidents, including clear triggers, escalation paths, and decision-making timelines for potential MAR disclosures.
Implement or enhance cross-functional incident response governance so that Security / IT, Legal, Compliance and Investor Relations jointly evaluate cyber events for ad hoc disclosure obligations.
Review and, where necessary, revise Board and senior management training to cover MAR Article 17 obligations in the context of cyber incidents and operational disruptions.
Test existing “ad hoc announcement” workflows (including drafting, approval and publication mechanisms) to confirm the firm can publish inside information on cyberattacks “as soon as possible” in practice, including outside normal business hours.

Key Dates

16 July 2026

- BaFin imposes a €240,000 administrative fine on TeamViewer SE for violating Article 17(1) MAR by failing to disclose a cyberattack without delay

20 July 2026

- BaFin publishes the enforcement notice detailing the breach, the nature of the inside information (cyberattack), and the applicable fine range under MAR

Compliance Impact

The compliance impact is high: BaFin has clearly signalled that failures to promptly disclose price-sensitive cyber incidents will trigger enforcement and potentially substantial fines relative to issuer revenue. Beyond financial penalties, late or missing disclosures can increase litigation risk and damage market confidence in the issuer’s governance and transparency.

References

AI-generated analysis. May contain errors or omissions — verify with the original BaFin source before acting. Full disclaimer.

Sectors:

Capital Markets & Trading Investment Management

Topics:

Technology & Cyber Market Abuse / Surveillance Reporting & Disclosure

All FirmsFintechBank

View Original

🇩🇪 BaFin Guidance high

January 30th 2026

Artificial intelligence: BaFin publishes guidance on ICT risks

The Federal Financial Supervisory Authority (BaFin) has issued its “Guidance on ICT Risks in the Use of Artificial Intelligence at Financial Entities”. The guidance will help entities manage ICT risks in accordance with the requirements under DORA.

AI Analysis

BaFin's "Guidance on ICT Risks in the Use of Artificial Intelligence at Financial Entities," published December 18, 2025, provides non-mandatory advice to help financial entities manage ICT risks from AI under DORA across the AI lifecycle. It matters because it integrates AI explicitly into existing ICT risk frameworks, emphasizing security, resilience, and third-party risks for supervised institutions, aligning with RTS on ICT risk management (EU 2024/1774) and subcontracting (EU 2025/532). This clarifies supervisory expectations amid growing AI adoption in finance, reducing ambiguity in DORA compliance.

What Changed

The guidance does not introduce new binding rules but clarifies AI as ICT systems requiring DORA-compliant treatment, including:
AI strategy: Management-approved, aligned with overall strategy, defining responsibilities, competencies, and interdisciplinary collaboration for critical functions.
ICT risk management integration: Cover identification, protection, detection, response, recovery, training; apply to AI lifecycle (data acquisition, development, operation, retirement).
Development and testing: Robust standards, documentation, testing proportionate to criticality; special focus on generative AI/LLMs, open-source, and code generation risks.
Operational processes: Asset classification, monitoring, access controls, logging, anomaly detection, business continuity, secure decommissioning.

Suggested Considerations

Develop and approve AI strategy integrated with ICT roadmap and governance.
Embed AI in existing ICT risk framework, ensuring lifecycle coverage with safeguards (e.g., testing, monitoring, decommissioning).
Conduct third-party due diligence and contractual reviews for AI/cloud providers, including exit/portability testing.
Implement AI-specific testing, documentation, and incident processes proportionate to criticality.
Ensure management accountability for oversight, training, and interdisciplinary controls.

Key Dates

01 February 2024

- Related BaFin/Bundesbank supervisory notice on cloud outsourcing (contextual reference)

18 December 2025

- Guidance issuance date

Compliance Impact

Urgency: High – DORA is live (effective Jan 17, 2025), and AI use is widespread; this guidance operationalizes ICT requirements for AI, exposing non-compliant firms to supervisory scrutiny, fines, or remediation orders under CRR/Solvency II. It heightens focus on third-party/cloud risks amid EU AI Act rollout, demanding immediate gap assessments to avoid operational resilience failures.