Blog on Datargo

APIs as Part of the Supply Chain: Why Interface Security Becomes a Matter of Evidence

Tue, 23 Jun 2026 00:00:00 +0000

Software is rarely a monolith today. Modules, partner services and tenants talk to each other through interfaces, and these APIs are the quiet connectors of the supply chain. NIS2 explicitly requires supply chain security as part of the risk picture. That moves a question long treated as purely technical to the foreground: how secure, and how auditable, are your own interfaces?

The interface is the attack surface

The most common API weaknesses are not exotic exploits but authorization flaws. In the OWASP API Security Top 10, Broken Object Level Authorization sits in first place: an API hands out data without properly checking whether the requesting account is allowed to see it at all. A changed object ID in the request is then enough to retrieve someone else’s records. Three control points decide robustness in practice:

Passkeys in the Enterprise: Phishing-Resistant Sign-In Beyond Passwords and OTPs

Tue, 23 Jun 2026 00:00:00 +0000

Phishing remains the most reliable way into corporate networks, and most second factors do little to change that. A password plus an SMS code, TOTP app or push approval counts as multi-factor authentication, yet at its core it is attackable: lure the user onto a fake page and the second factor can be captured in real time too. FIDO2 passkeys address exactly this point.

Why classic MFA stays phishable

The problem is not the number of factors but their transferability. A one-time code is a shared secret: it works wherever it is entered, including on the phishing page. What is missing is a binding to the genuine counterparty. That binding is precisely what WebAuthn, the standard behind passkeys, provides.

The EU Data Act and the End of Switching Fees: Cloud Switching Becomes Mandatory

Tue, 23 Jun 2026 00:00:00 +0000

Vendor lock-in was long a commercial lever: anyone wanting to leave paid for the exit, fought proprietary formats and lost weeks to migration work. The EU Data Act (Regulation (EU) 2023/2854) reverses that logic. The regulation has applied since 12 September 2025, and its Chapter VI turns switching cloud providers into an enforceable customer right.

What has applied since September 2025

Providers of data processing services (IaaS, PaaS, SaaS) must remove every obstacle that makes switching harder: pre-commercial, commercial, technical, contractual and organisational barriers alike. In practice this means a maximum notice period of two months, a 30-day transition window for the actual move (extendable to up to seven months where technically unfeasible) and the right to take data and digital assets along. For new contracts these duties already apply.

When the Chatbot Has to Identify Itself: AI Transparency in Customer Service from August 2026

Tue, 23 Jun 2026 00:00:00 +0000

Automated first responses, AI-assisted ticket triage, generated reply suggestions: in customer service, AI is already routine. From 2 August 2026 Article 50 of the EU AI Act becomes enforceable, bringing binding transparency obligations for exactly these systems. These duties are distinct from the rules for providers of general-purpose AI models (GPAI): the point here is not the model, but the interaction with people.

What Article 50 requires

At its core sits a disclosure duty. Providers of AI systems intended for direct interaction with people (such as chatbots) must ensure that the person concerned is aware they are communicating with an AI system. The notice must be given at the latest at the time of the first interaction, unless the use of AI is obvious from the circumstances. On top of that, AI-generated or manipulated content must be marked as such in a machine-readable way, and content of public interest that could appear authentic has to be labelled separately.

47-Day Certificates: The CA/Browser Roadmap to 2029

Tue, 09 Jun 2026 00:00:00 +0000

The debate is settled, and part of the outcome is already operational reality: since 15 March 2026, publicly trusted TLS certificates may be valid for at most 200 days, down from 398. That is the first step in a roadmap the CA/Browser Forum adopted in April 2025 with Ballot SC-081v3: unanimously, with 29 votes in favour and none against. At the end of that roadmap sits a maximum lifetime of 47 days.

eIDAS 2.0 and the EUDI Wallet: What Relying Parties Must Prepare by the End of 2026

Tue, 09 Jun 2026 00:00:00 +0000

In about six months a deadline expires that many companies still treat as distant regulation: by 24 December 2026, all 27 EU member states must provide their citizens and residents with at least one European Digital Identity Wallet (EUDI Wallet). The legal basis is Regulation (EU) 2024/1183 (“eIDAS 2.0”), in force since 20 May 2024.

For most companies the more pressing question is not when the wallet arrives, but when they will have to accept it. And that deadline follows immediately.

The Cyber Resilience Act: What 11 September 2026 Means for Makers of Digital Products

Tue, 09 Jun 2026 00:00:00 +0000

In about three months a regulation turns into operational reality. From 11 September 2026 the first binding obligations of the Cyber Resilience Act (Regulation (EU) 2024/2847) take effect, and they happen to be the ones that demand the most process: reporting actively exploited vulnerabilities and severe security incidents. The remaining product and conformity obligations follow with full application on 11 December 2027.

Anyone who manufactures, imports or distributes products with digital elements in the EU should therefore treat September not as a distant date, but as the day a working reporting path has to exist.

Data Sovereignty After the Data Privacy Framework: Why EU Hosting Becomes an Architecture Question

Tue, 02 Jun 2026 00:00:00 +0000

Anyone transferring personal data to the United States has relied since 2023 on the adequacy decision for the EU-US Data Privacy Framework (DPF). In September 2025 the General Court of the European Union (EuG) dismissed a challenge against it, leaving the framework a valid legal basis. But the matter is not closed: in late October 2025 an appeal was lodged with the Court of Justice (Case C-703/25 P). Another reversal, a “Schrems III”, is not ruled out.

The EU AI Act: GPAI Enforcement from 2 August 2026 and What the Digital Omnibus Postponed

Tue, 26 May 2026 00:00:00 +0000

The EU AI Act has been in force since August 2024, but many of its obligations take effect in stages. One date stands out: on 2 August 2026 active enforcement against providers of general-purpose AI models (GPAI) begins through the EU AI Office, and national sanction regimes take effect in parallel. In Germany the accompanying AI Measures and Innovation Act (KI-MIG) applies. Anyone who uses or provides AI should know the deadline, but also the most recent postponements.

SD-JWT VC and OpenID4VP: The Protocols Behind the EUDI Wallet

Tue, 12 May 2026 00:00:00 +0000

Most of the conversation around the EUDI Wallet sits at the political and organisational level: member-state provisioning by the end of 2026, registration duties, acceptance deadlines. But anyone who actually wants to accept the wallet eventually faces a technical question: how exactly do I verify that a presented attribute is genuine, valid and sufficient for my purpose? This article looks at the verification side and the building blocks that come together there.

Archiving Structured E-Invoices the GoBD Way: The Eight-Year Question

Tue, 21 Apr 2026 00:00:00 +0000

The debate around e-invoicing mostly turns on issuing and receiving. The quieter but longer-lived obligation only begins afterwards: retention. A structured invoice is not a document in the classic sense but a data set, and it must remain unalterable and machine-readable for years. Building that into your processes from the start avoids costly rework later.

What changed about the retention period

For a long time, accounting records had to be kept for ten years. Germany’s Fourth Bureaucracy Relief Act (BEG IV) shortened this to eight years as of 1 January 2025. The new period applies to all records whose previous ten-year period had not yet expired at that point.

NIS2 in Practice: From Reporting Duty to Defensible Evidence

Tue, 14 Apr 2026 00:00:00 +0000

Since 6 December 2025, NIS2 is law in Germany. The NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) was passed by the Bundestag on 13 November 2025, confirmed by the Bundesrat on 20 November, and entered into force with no transition period. Around 29,500 companies across 18 sectors are in scope. The BSI registration deadline on 6 March 2026 has passed; late registration remains possible and is advisable.

Many organisations treated the rollout as a registration and documentation task. The harder part begins afterwards: being able to prove, when it counts, what actually happened.

ACME Beyond the Web Server: Certificate Automation for Internal Services and mTLS

Tue, 17 Mar 2026 00:00:00 +0000

Shortening public TLS lifetimes towards an eventual 47 days has created an awareness that manual renewal no longer scales. What often gets overlooked: inside a company there are usually far more certificates than at the outward-facing edge. Service-to-service communication, mTLS in a service mesh, internal APIs and database connections all live on certificates, and these follow different patterns than the public web.

Why “internal” does not mean “simpler”

At the public web server the situation is tidy: a handful of domains, a public CA, a clearly defined validation path. Internally the ratio inverts. Here there are often hundreds or thousands of short-lived endpoints that appear and vanish dynamically, for instance when an orchestrator starts new containers. An internal CA issues certificates for them that nobody sees publicly, but which expire just the same, must renew just the same, and take down a service just the same when they fail.

DORA for ICT Providers: Third-Party Risk and Incident Reporting

Tue, 09 Dec 2025 00:00:00 +0000

DORA, the Digital Operational Resilience Act (Regulation (EU) 2022/2554), has applied to the European financial sector since 17 January 2025. Since 19 November 2025, oversight has become concrete: the European Supervisory Authorities EBA, EIOPA and ESMA published the first official list of 19 ICT third-party providers designated as critical, among them AWS, Google Cloud, Microsoft, Oracle, SAP, IBM and Deutsche Telekom. The list is updated annually.

The instinctive reaction of many IT providers is: this does not concern me, I am not a bank. That is a fallacy. DORA travels down the supply chain.

Post-Quantum Cryptography: Why the Migration Starts in 2026, Not 2030

Tue, 16 Sep 2025 00:00:00 +0000

Since August 2024, the first three post-quantum standards have been final. NIST published FIPS 203 (ML-KEM, derived from Kyber), FIPS 204 (ML-DSA, from Dilithium) and FIPS 205 (SLH-DSA, from SPHINCS+), concluding an eight-year selection process. Many read the headline, see the frequently cited year 2030 and put the topic back on the shelf. That is a misunderstanding: 2030 is a deadline, not a starting gun.

“Harvest now, decrypt later” makes it urgent

The threat does not wait for the first capable quantum computer. Attackers intercept encrypted traffic today and store it to decrypt later. Anything that must stay protected for a long time is therefore already exposed: contracts, health and HR data, long-lived keys, intellectual property, state and trade secrets. For this data, what matters is not when a quantum computer becomes practical, but how long the data must remain secret.

Germany's E-Invoicing Mandate: The 2025 to 2028 Roadmap Without the Myths

Tue, 11 Feb 2025 00:00:00 +0000

Since 1 January 2025, e-invoicing in German B2B business is no longer optional. The first stage of the new mandate is in force: every domestic company must be able to receive structured electronic invoices. Issuing them electronically is not yet compulsory, but receiving them is. The legal basis is the Growth Opportunities Act (Wachstumschancengesetz), passed by the Bundesrat on 22 March 2024; the details are set out in the Federal Ministry of Finance guidance of 15 October 2024.