The EU Artificial Intelligence Act is directly applicable in all Member States, yet its practical effectiveness hinges on national enforcement structures that the Regulation itself only sketches in outline. Member States were required to designate notifying and market surveillance authorities by 2 August 2025—a deadline most of them, including Germany, missed. With the entry into force of the KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG) on 29 July 2026, Germany has now settled its national enforcement architecture: a hybrid model that concentrates residual market surveillance, coordination, single-point-of-contact and complaint-handling functions in the Bundesnetzagentur, preserves the sectoral competences of existing regulators at federal and Länder level, creates an independent chamber for fundamental-rights-sensitive high-risk AI systems, and ties the supervision of the cybersecurity dimension of high-risk AI to the market surveillance authority of the Cyber Resilience Act—a role performed in the interim by the Federal Office for Information Security. This article analyses the KI-MIG against the requirements of Chapter VII of the AI Act, situates it within the timelines recalibrated by the Digital Omnibus on AI (Regulation (EU) 2026/1744), and compares the German approach with the enforcement models emerging in Spain, Italy, Cyprus and other Member States. It argues that the German hybrid model offers instructive answers to the coordination problems of decentralised AI oversight, but that its ‘blueprint’ quality will ultimately depend on operational capacity, on the resolution of federal frictions that have already brought the law to the brink of a mediation procedure, and on whether the Union succeeds in containing the fragmentation of AI market surveillance across 27 national systems.
High-risk AI systems distributed as software or embedded in connected hardware are simultaneously subject to two horizontal security rulebooks: the accuracy, robustness and cybersecurity requirements of Art. 15 of the AI Act and the essential cybersecurity requirements of the Cyber Resilience Act (CRA). The Union legislature anticipated this overlap and built a bridge: under Art. 12 CRA—since July 2026 mirrored in Art. 42(3) AI Act, as inserted by the Digital Omnibus on AI (Regulation (EU) 2026/1744)—products with digital elements that are classified as high-risk AI systems are deemed to comply with the cybersecurity requirements of Art. 15 AI Act if they satisfy the CRA’s essential requirements and the achievement of the Art. 15 protection level is demonstrated in the CRA declaration of conformity, with the conformity assessment, as a rule, integrated into the AI Act procedure. The Omnibus has re-sequenced the two regimes: the high-risk obligations for stand-alone Annex III systems, deferred to 2 December 2027, now become applicable nine days before the CRA’s main obligations on 11 December 2027, whereas high-risk AI embedded in Annex I products follows on 2 August 2028, and the CRA’s reporting duties have bound manufacturers—including of AI products already on the market—since 11 September 2026. Drawing on the consolidated legislative texts, the Commission’s CRA guidance of July 2026 and the standardisation work of CEN-CENELEC JTC 13 and JTC 21, this article maps the scope overlap, analyses the mechanics and limits of the bridge—the accuracy and robustness carve-out, the narrowly drawn derogation for important and critical products in Art. 12(3) CRA, and the gap between AI-specific attack vectors and the CRA’s generic essentials—and argues that the bridge is coherent on a reading, anchored in the recitals of both acts, under which the adversarial-machine-learning threat model enters the CRA’s risk-based essentials. It translates the analysis into an integrated compliance architecture with a structured requirement-to-evidence mapping and formulates recommendations addressed separately to the Commission and the standardisation bodies, and to providers and manufacturers.
This article focuses on a significant trend in cyber confrontation: an increasing number of state-sponsored private entities are involved in cyber actions. Within this trend, the concept of cyber privateering has emerged. It refers to the counterattack against a broad range of cybercriminals in the target state by private entities with explicit authorization or covert support from the territorial state. It is generally categorized as active cyber defense, but can sometimes exceed limitations and devolve into offensive action. Furthermore, the illegality of offensive cyber privateering is widely recognized under international law, but the legality of defensive cyber privateering remains a subject of debate. Regarding this, via comparing the various theories on its legality, neither the legality theory nor the illegality theory can adequately evaluate it. The differentiation theory based on judging whether the intent of cyber privateers and the consequences of cyber privateering in a specific scenario violate domestic or international law should be the appropriate theory for evaluating its legality. Meanwhile, whether offense or defense, cyber privateering deemed illegal should be regulated and counteracted. But unfortunately, the lack of legal guidance means cyber privateering could be abused by malicious actors, deviating from technological neutrality and becoming a pretext for aggression and a tool for profit. Regarding this risk, this article considers that simply constructing the new legal framework to regulate illegal cyber privateering may be too late. Instead, existing legal tools, including but not limited to those mentioned below, should be leveraged: (1) Transnational litigation. When illegal cyber privateering harms and infringes upon the interests of private entities abroad, the victimized private entities can resort to civil or criminal litigation to counteract the illegal cyber privateers; (2) Private sanctions. For specific motives, the victimized private entities can take a series of measures against the supporting state of illegal cyber privateering in order to achieve sanctioned results while the state provides support; (3) State responsibility. When cyber privateers are authorized, instructed, directed or controlled, acknowledged and adopted by the supporting state, and their actions violate international law, the injured state can claim state responsibility from the supporting state; and (4) Cyber-related sanctions. When the injured state suffers from significant malicious cyber-enabled actions and meets specific conditions, it can legally take a series of restrictive measures targeting individuals and private entities who are responsible for or complicit in such actions. Such polycentric legal counteractions can provide targeted responses to illegal cyber privateers and their supporting state, thereby achieving good results.
European cybersecurity law increasingly runs on reports. The NIS2 Directive obliges essential and important entities to notify significant incidents within a staggered 24-hour, 72-hour and one-month cascade and to operate coordinated vulnerability disclosure; from 11 September 2026, Article 14 of the Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities and severe incidents through a single reporting platform operated by ENISA. Both regimes address organisations. Yet virtually every report originates with an individual—an employee, an administrator, an external security researcher—whose own legal position is governed, if at all, by a third instrument: the Whistleblowing Directive (EU) 2019/1937. This article maps that intersection and identifies three structural gaps. First, breaches of NIS2 fall within the Whistleblowing Directive’s material scope through the substitution of references to the repealed NIS1 Directive, but national transpositions—the German Hinweisgeberschutzgesetz prominent among them—track this coverage only partially. Second, the Cyber Resilience Act is absent from the Directive’s annex, producing a marked asymmetry between a harshly sanctioned entity duty and an unprotected individual reporter. Third, independent security researchers generally fall outside the Directive’s personal scope, and its acquisition shield does not reach conduct constituting a self-standing criminal offence. Drawing on the incentive-theoretic and empirical literature on whistleblowing, the article analyses incentive design and the emerging risk of AI-generated false reports before proposing proportionate reforms: annex maintenance, an EU-wide researcher safe harbour, channel interoperability and abuse-resistant incentives.
This study examines digital sovereignty as a crucial aspect of national sovereignty, particularly in the context of Egypt’s growing reliance on foreign digital platforms and technology. This study examines the concept and application of digital sovereignty, concentrating on institutional, legal, and technological innovation via a conceptual framework of multi-level governance. The focus is on how national, regional and transnational principles coalesce in the digital environment to manifest policy and practice. Taking shifts in Egypt’s digital landscape and legal frameworks as a primary case study, this work highlights a balanced approach to think about managing the potential for technological autonomy whilst remaining reliant on the global digital ecosystem; supported by comparative models in similar regional and international contexts. It further demands an overarching national digital strategy, formulating cybersecurity legislation, and building capability to create and defend digital infrastructure for promoting sustainable economic growth. The study proposes a governance-based framework aimed at emerging economies, with an example of Egypt and its burgeoning digital infrastructure.
