Trend radar · · 5 min read · By Alexander
Trend Radar Week 45/2026: New rules for instalments
Trend Radar filters the week’s developments for freelancers and small businesses in Germany. Week 45 covers new rules for instalments and buy now, pay later, a future shared robots.txt control, connected AI tools for small firms and the surprisingly ordinary causes behind many cyber incidents.
New rules also cover buy now, pay later
New consumer credit rules apply in Germany from 20 November 2026. The law implementing the EU Consumer Credit Directive extends protection to many buy now, pay later offers and smaller loans. Providers must give clearer pre-contract information and assess creditworthiness. Interest-free payment deferrals may remain outside the credit rules only under defined conditions—for example when no third party provides the credit, there are no interest charges or other fees, and the full amount is due within a short period. Larger online retailers face tighter conditions than smaller providers.
What does this mean for you? If your shop offers instalments, deferred payment or a BNPL service, review the checkout, product wording and payment terms with your payment provider now. The marketing label is less important than who grants the credit, what it costs and when payment becomes due. Present information clearly before purchase and test the full mobile checkout. Small merchants should not assume that the payment provider automatically fulfils every information duty inside their own shop. See /ratgeber/online-shop-lohnt-sich/ and /ratgeber/website-rechtssicher-checkliste/.
Google backs a shared signal for AI training preferences
On 30 October, Google announced plans to support a shared machine-readable AI training preference in robots.txt, based on work by the IETF AIPREF group. Instead of maintaining separate rules for every AI company, website owners should be able to express a broad preference with one policy token. Google aims to support it with other providers in 2027. Existing company-specific controls such as Google-Extended will remain available. Google also states that Google-Extended does not affect inclusion or ranking in traditional Google Search.
What does this mean for you? Do not rewrite robots.txt because of an announcement alone. First decide what you want: traditional search visibility, citations in AI answers, protection of your content or a balance of these goals. Explicitly allowing Google-Extended may make content eligible for grounding and clicks from Gemini, while opting out should be a documented business decision. Have every robots.txt change checked because a wrong “Disallow” can block important pages. See /ratgeber/ki-sichtbarkeit-chatgpt-statt-google/ and /ratgeber/ki-suche-ai-overviews/.
Gemini brings small-business tools into one hub
On 20 October, Google introduced a dedicated business hub in Gemini and additional connections to business tools. These include Google Business Profile, Google Ads and Workspace, plus services such as Adobe, Canva, Dropbox, Shopify, Wix, Zoho and Xero. The features are rolling out globally to Gemini app users. The practical shift is that AI can work with approved business context rather than an isolated prompt—for example, analysing profile performance, drafting updates or combining information from connected applications.
What does this mean for you? Do not connect every account immediately. Begin with one defined use case, such as a monthly draft reviewing Google Business Profile performance. Grant only the permissions required, separate private and company accounts, and approve every public output. Reviews, financial information and email may contain personal or confidential data, so provider checks, internal rules and data-processing terms should come before the productivity experiment. See /ratgeber/google-business-profil-optimieren/.
Phishing and missing patches still lead real cyber incidents
ESET’s 2026 cyber resilience study for German SMEs shows a gap between fear and everyday reality. Forty-two per cent of respondents see AI-supported malware as a major threat for the next twelve months. Yet reported incidents were most commonly caused by phishing at 29 per cent and unpatched vulnerabilities at 28 per cent, followed by missing security monitoring at 23 per cent and weak passwords at 21 per cent. The survey covered 500 people involved in security decisions at German organisations with 25 to 1,000 endpoints.
What does this mean for you? Do not start by buying the next AI security promise. Close the ordinary gaps: updates with fixed deadlines, two-factor authentication, separate admin accounts, tested backups and a clear route for reporting suspicious messages. Include plugins, themes and server components, not only office computers. A simple monthly record of pending updates, restore tests and access reviews can be more useful to a small firm than a complex dashboard. See /ratgeber/2-faktor-authentifizierung-unternehmen/ and /ratgeber/website-backup-wichtig/.
In brief
- Review instalments and BNPL with your payment provider and shop terms before 20 November.
- The shared AI training signal is planned, but it is not a reason for untested robots.txt changes today.
- Connect AI to business tools according to the principle of least privilege.
Frequently asked questions
What should online merchants review for BNPL and instalments?
Review with your payment provider and legal adviser who grants the credit, what it costs, when payment is due and which information and creditworthiness checks apply from 20 November.
Should I block Google-Extended in robots.txt?
It depends on your objective. Google says it does not affect traditional Search, but it can control training and Gemini grounding. Make and document the decision deliberately.
Which cyber measure should a small company implement first?
Start with timely updates, two-factor authentication, separate admin access, tested backups and a simple process for suspicious emails.