A planned intelligence services law would require the BSI to report previously unknown security vulnerabilities to the BND — a practice that cybersecurity experts view critically.
Planned reforms of the Intelligence Services Act are intended to grant BND and Constitutional Protection Service explicit offensive cyber capabilities, including zero-day exploitation, and place the BSI structurally under their control.
Chat Control 1.0 continues until 2028 and allows service providers to scan private messages on Discord, Skype, Instagram, Snapchat, Xbox and Gmail/iCloud without search warrants.
The plan creates a coordinated strategy to develop AI-enabled cybersecurity solutions while implementing existing EU regulations such as the EU AI Act and the NIS2 Directive.
The EU Code of Practice on AI Transparency is recognized as an effective instrument for meeting AI Act requirements in Articles 50(2), (4) and (5), but does not replace direct compliance responsibility.
