Bitkom Economic Protection Report 2026 and the Duty of Data Sovereignty

The Bitkom Economic Protection Report 2026 proves that 37 percent of companies affected by data theft and sabotage attribute at least one attack to foreign intelligence services. In the previous year, this figure was 28 percent, and in 2023 it was a mere 7 percent. The threat landscape for mid-sized companies has fundamentally shifted: away from untargeted crime and towards highly specific state-sponsored espionage. Overall, 96 percent of German companies are affected by data theft, industrial espionage, or sabotage, or suspect such incidents. Processing sensitive corporate data via unsecured interfaces in this environment is grossly negligent.

What the Bitkom Economic Protection Report 2026 reveals in detail

The figures from Bitkom e.V. show a massive increase in state-controlled attacks, primarily from three nations. Among the companies definitively affected, 52 percent were able to trace at least one attack back to China. Russia follows closely at 49 percent, while Iran, at 9 percent, has more than doubled its presence compared to the previous year. The quantifiable damage to the German economy ranges between 211 and 270.8 billion euros.

The growing number of unreported or unconfirmed cases is particularly alarming. Only 67 percent of companies can now definitively prove a successfully executed attack, down from 87 percent the previous year. At the same time, the proportion of companies that merely suspect an incident has risen to 29 percent. The attack vectors are primarily digital: 57 percent of companies were affected by digital sabotage, 54 percent by the interception of their communications, and 45 percent by the digital theft of business data. The state is increasingly assisting in investigations: every second company that was able to identify perpetrators received information from authorities.

Why expired NIS2 deadlines increase management liability

Since December 6, 2025, the NIS2 Implementation Act has been in force in Germany without any transition period, and the registration deadlines with the BSI expired on July 31, 2026. This places around 29,850 facilities under strict supervision, extending far beyond the previous critical infrastructure operators. Management is now personally liable: they must approve and monitor cybersecurity measures and undergo regular training.

The reporting deadlines for security incidents are extremely tight. Affected companies must submit an initial early warning within 24 hours, a report with an initial assessment after 72 hours, and a final report exactly one month later. Despite these strict requirements, current surveys indicate that around 48 percent of surveyed companies underestimate their regulatory exposure. Relying on outdated IT structures or unclear data flows now risks not only the loss of trade secrets but direct legal consequences for management.

What a strict governance architecture for financial data looks like

Sensitive financial data requires a closed processing chain that runs exclusively through secured European endpoints. A system that merges raw data from multiple sources into a continuous profit and loss, EBITDA, and liquidity statement must not be a black box. Every metric must remain traceable to its source: from the source field through the mapping and tariff to the final formula.

In practice, this means abandoning error-prone Excel islands. Cost modeling down to the individual invoice line, such as shipping, commission, or storage costs, must be versioned and allocated by channel, category, and country. When a system processes 1.2 million invoices and 2 million invoice lines with history, auditability is the fundamental prerequisite. This is the only way to answer questions about plan deviations, such as those caused by increased energy costs or more expensive external personnel, in a legally compliant and verifiable manner.

How systems with integrated data sovereignty work in practice

A system with integrated governance processes data via EU endpoints such as Vertex AI or Azure and keeps sensitive information strictly within a defined framework. Governance is not an afterthought but is firmly built into every tool. Approvals, logs, and limits precisely regulate which data leaves the company and which decisions can be made automatically.

A document and accounting system turns a document archive into a largely automated, DATEV-compatible accounting process. The path from receipt to booking occurs without media breaks. The system reads documents via OCR and AI vision and creates ready-made booking proposals with accounts, splits, and tax keys. A safety net of four sources is utilized: rigid rules, historical data, machine learning, and large language models. An orchestrator decides in three stages whether a receipt is booked automatically, submitted for review, or processed manually. Nothing is blindly waved through. The system is GoBD-compliant, operates with procedural documentation, and remains audit-proof up to the DATEV export.

Which security steps are now mandatory

Companies must audit their data flows and replace open interfaces with closed, versioned modules. The EU AI Act demands clear risk classes, transparency, and human oversight. These requirements must be firmly established in the approval stages from L0 to L4. An approval-first approach ensures that concrete recommendations for prices, reorders, or campaigns are always accompanied by a justification and are only executed after human approval.

The quality and traceability of data processing determine a company's resilience. Answers from AI systems must absolutely be provided with a source reference. Feedback loops and double-checks guarantee that every action remains traceable. Those who build their systems according to this modular principle configure processes and rules top-down and roll them out to departments without translation losses. Given the threat posed by state espionage, this form of digital sovereignty is no longer an option, but a prerequisite for survival in the market.