Trend Radar Week 37/2026: security becomes reportable

Cyber Resilience Act: first duties start on September 11

Bitkom reported on September 10 that the first Cyber Resilience Act duties start on September 11, 2026. Manufacturers must report actively exploited vulnerabilities and serious incidents in software or connected products within 24 hours and add further information within 72 hours. Bitkom says only 3 out of 10 companies are prepared.

What does this mean for you? Even if a standard company website is not automatically treated like a manufacturer product, you need a clear incident plan. Write down hosting contacts, backup location, admin access, responsible people and first steps. If you sell software, plugins, apps or connected devices, get a detailed technical and legal review.

Google tightens its view of site reputation abuse

In recent weeks, Google Search Central published an update to its Site Reputation Policy. The policy targets third-party content placed on a strong domain mainly to benefit from that domain’s reputation, such as unrelated coupon, loan, review or affiliate pages.

What does this mean for you? Do not rent out folders or subdomains casually. Check guest posts, directories, coupon areas and auto-generated pages: do they really fit your business, and are you responsible for them? A clear local website with real services is safer than short-term SEO promises built on unrelated mass content.

Anthropic shows how AI is misused for attacks

On September 10, Anthropic published “Detecting and countering misuse of AI: September 2026”. The report describes attempts to use Claude for malicious activity including cyber operations, fraud, influence operations and illicit model distillation. The wider lesson is that AI lowers the barrier for text, code, phishing, research and automation.

What does this mean for you? Train staff on practical risks: fake invoices, convincing emails, support scams, manipulated applications and login pages. Use processes, not gut feeling: call-back checks for payment changes, 2FA, no credentials in chat and a second pair of eyes for unusual requests.

German companies barely use Chinese AI tools

Bitkom reported on September 9 that Chinese AI applications are hardly used in the German economy. Among companies that use AI, 2 percent use DeepSeek, 1 percent Alibaba Qwen and 1 percent Tencent Hunyuan. Data protection, cybersecurity, trust and performance are part of the discussion.

What does this mean for you? Choose AI tools by more than price or hype. For SMEs in Germany, check data processing, business accounts, processing agreements, roles and export options. Start with low-risk tasks such as ideas, drafts and internal checklists. For customer data, contracts or credentials, define rules first.

In brief

• Google Search Central announced new live events in Latin America. Official Google sources remain a better SEO basis than short-video rumours.
• Bitkom offers information on the Cyber Resilience Act. Digital product sellers should not wait for the next incident.
• Recent Google Search AI Mode examples show a more advisory search experience; clear service pages and structured content matter more.