Summer is usually a quiet season for the news cycle. Not this year. While most Danish organisations were still easing back into normal operations after the holidays, three things kept moving regardless: ransomware groups kept hitting critical infrastructure, the EU began genuinely enforcing its AI legislation, and a single cyberattack on a European logistics provider showed once again how quickly an IT incident can turn into a supply problem for ordinary consumers.
It's tempting to read August as just another month in a long series of incidents and warnings. But taken together, the month's developments point in one direction: toward September, and specifically toward the 11th, when the Cyber Resilience Act's reporting obligations take effect. That date is not simply one more entry in an already crowded regulatory calendar. It is the point at which many organisations' current vulnerability-handling and incident-reporting processes will, for the first time, be tested against a legal stopwatch that few have actually rehearsed against.
This article looks back at August to understand what actually happened and uses that as the basis for looking forward to what now awaits Danish cybersecurity leadership for the rest of 2026 and into 2027.
The Danish backdrop: exposure was already rising before August began
Although August didn't bring a single standalone Danish mega-incident, it's worth remembering the backdrop against which the month's international developments land. In late June, the Confederation of Danish Industry (Dansk Industri) put forward a proposal that Denmark's digital infrastructure needs to be hardened against a new threat picture spanning hybrid attacks, cyberattacks, and sabotage. The proposal identifies three areas for action: treating digital infrastructure as a national security priority through investment in redundancy and monitoring, raising the security baseline for operational technology (OT) through national standards and workforce competence-building, and streamlining government processes so that security-related infrastructure investments can move faster and more predictably. Cibicom's CEO, Mette Slesvig, put the underlying shift precisely: the task is no longer only to prevent outages, but to ensure society keeps functioning when outages happen anyway.
That point lines up with figures from a report TDC Erhverv published earlier this year. The share of large Danish companies hit by a cyberattack more than doubled in a single year from 6 percent in 2024 to 14 percent in 2025 with a comparable rise among mid-sized companies, from 5 to 13 percent. Forty-four percent of large companies have experienced at least one attack in the past five years, and a quarter have been hit more than once. Once an attack actually shuts down operations, the consequences are not trivial: large companies estimate losses exceeding 500,000 kroner per day, and for production and retail companies with 250+ employees, daily losses during a full IT outage can run to 20-40 million kroner. And yet fewer than 25 percent of Danish companies have a fully implemented emergency plan, and 35 percent of the smallest companies have none at all.
That is the exposure onto which August's international events land. Which is exactly why the stories below shouldn't be read as "something that happens elsewhere."
Ransomware keeps threatening physical operations not just data
Two advisories from US authorities in August illustrate that ransomware groups continue to target critical infrastructure with increasing speed and precision. In mid-August, CISA, the FBI, the NSA, and the US Secret Service warned that the ransomware-as-a-service group Gunra is actively exploiting two authentication vulnerabilities in Fortinet's FortiOS and FortiProxy (CVE-2024-55591 and CVE-2025-24472) to gain administrative access to internet-facing devices. The group, which operates a double-extortion model data theft combined with encryption reportedly gives victims between five and seven days before publishing stolen data. Victims span healthcare, financial services, government agencies, manufacturers, and law firms across countries including the US, Taiwan, Turkey, South Korea, Brazil, Japan, and Canada.
Shortly after, on August 19, the FBI, CISA, and the US Department of Health and Human Services updated a similar advisory on the Medusa ransomware group, which now exploits newly disclosed vulnerabilities within 24 hours in some cases before the vulnerability is even publicly known. According to the advisory, Medusa actors have now compromised more than 500 critical infrastructure organisations, up from just over 300 in early 2025. Healthcare is highlighted as a particularly frequent target, though the group operates opportunistically across critical sectors more broadly.
The common thread in both advisories isn't sophisticated new tradecraft. It's that known, patchable vulnerabilities in widely deployed equipment Fortinet firewalls are just as common in Danish organisations as anywhere else remain the most effective way in for groups that have industrialised their business model. That's a dull but important point for governance and audit functions: a patching backlog on internet-facing devices is still the most likely cause of the next serious incident, not some novel zero-day.
The AI Act's enforcement began in August but not where many people think
On August 2, the European Commission's AI Office and national authorities began actively enforcing parts of the AI Act. It's worth being precise about which parts. What took effect were transparency rules: chatbots must identify themselves as automated systems, deepfakes must be clearly labelled, and machine-generated or edited content must carry machine-readable marks. Providers of general-purpose AI (GPAI) models must additionally document and share information with authorities and downstream providers, publish summaries of training-data content, and address risks of large-scale harm, including cyber-related risks and manipulation. The fine level up to €15 million or 3 percent of global turnover was set high enough that it cannot be ignored.
What's less widely known is that, at the same time, the EU postponed the other, far more demanding part of the law. The Council of the EU finalised a decision on June 29, 2026 to push the deadline for high-risk AI systems (Annex III) from August 2026 to December 2, 2027 a 16-month extension while the deadline for product-embedded systems (Annex I) moves from August 2027 to August 2028. The decision followed a full legislative process that began with a Commission proposal in November 2025 and ended with European Parliament endorsement in June 2026. The substantive requirements risk management, technical documentation, human oversight, post-market monitoring have not been relaxed. Organisations have been given more time, not less to do, and the stated rationale, according to a Cloud Security Alliance research note, was that as of spring 2026 more than half of enterprises still lacked even a basic inventory of the AI systems they actually use.
For ISACA members, the point cuts two ways. First: the enforcement that began in August covers transparency and GPAI obligations not your own high-risk AI use cases in the SOC, IAM, or vulnerability management, which many may have mistakenly assumed was urgent in August. Second: the extra time to 2027 is only a gift if it's spent on what the analysis points to as the real problem building an inventory of which AI systems the organisation actually uses, before the clock starts counting down again.
A logistics attack as a warning ahead of the autumn shopping season
On August 1, logistics provider Ceva informed customers of a cyberattack that had hit eight European warehouses in its contract logistics division over the preceding weekend. The attack resulted in unauthorised access to personal and business data, while the company's other operations air, ocean, ground, and rail transport continued unaffected. Two Dutch retailers, De Bijenkorf and Bol, felt the consequences directly: orders, returns, and refunds were delayed, and the Dutch data protection authority opened an investigation.
The incident isn't unique, but its timing is telling. It lands just as European retailers and their logistics partners begin preparing for the year's most revenue-critical stretch Black Friday and the Christmas shopping season in the fourth quarter. Security researchers have long pointed out that ransomware groups deliberately time attacks to land when operational disruption hurts most, making ransom negotiations more attractive from the attacker's perspective. The Ceva case is a concrete example of how little it takes: it wasn't a manufacturing plant or a PLC that was hit, but a warehouse management system and end customers still felt it immediately. For Danish organisations that depend on European warehousing and logistics partners in their supply chain heading into the fourth quarter, now is the time to ask the question while there's still time to act: do we know our logistics partners' resilience posture, and do we have a plan if one of them goes down in November?
September 11: the clock nobody can ignore any longer
All of the above is context for the deadline that will actually define the coming quarter for many of ISACA's members: from September 11, 2026, the Cyber Resilience Act's reporting obligations take effect. The requirement applies to manufacturers of products with digital elements software, hardware, and remote data-processing solutions sold into the European market, regardless of whether the manufacturer is based inside or outside the EU. It also applies to products already on the market, including ones that are no longer supported.
The mechanics are unforgiving in their simplicity: an early warning to ENISA and the relevant national CSIRT must be filed within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident. A more detailed assessment, including severity and mitigating measures, follows within 72 hours. A final report is due within 14 days for vulnerabilities and one month for incidents. All of it flows through ENISA's Single Reporting Platform, and affected users must be notified in a structured, machine-readable format. If a manufacturer fails to notify in time, the national CSIRT can notify users itself. The fine level up to €15 million or 2.5 percent of global turnover mirrors the AI Act's, which itself signals how seriously the EU takes both.
The real difficulty isn't in the letter of the law but in organisations' ability to live up to it. Exactly when an organisation becomes "aware" that a vulnerability is being actively exploited is a question whose answer determines when the 24-hour clock starts and one that few organisations have a documented, rapid process for answering. Many manufacturers depend on third-party and open-source components and therefore won't necessarily be the first to discover a vulnerability themselves, which puts pressure on supplier escalation agreements that are often inadequate today. And because a single incident can easily trigger obligations under CRA, NIS2, DORA, and GDPR simultaneously each with its own thresholds and timelines coordination between PSIRT, SOC, legal, and leadership matters in practice more than the technical detection itself.
For many organisations, CRA has mentally lived in 2027, because the full product requirements don't apply until December 2027. September 2026 is the proof that assumption was wrong. The reporting obligation is here now, and it demands operational processes that work under time pressure not policies that merely look good in a governance document.
The calendar toward 2027: what's actually coming
Put together, August and September sketch the outline of a regulatory calendar that stretches well into 2027. September 11, 2026 brings the CRA's reporting obligation. October marks European Cybersecurity Month across the EU traditionally an occasion to focus on awareness, but this year against a much sharper regulatory backdrop than in previous years. Through the rest of the autumn and into 2027, NIS2 and DORA supervision will continue at the same intensity as before, and financial-sector organisations should watch for when their competent authority designates them for threat-led penetration testing (TLPT) under DORA. Further out on the horizon sit the two major AI Act milestones: December 2027 for high-risk AI systems and August 2028 for product-embedded systems dates that feel distant but that require the work of mapping the organisation's AI use to start now, not in 2027.
It's tempting to treat these deadlines as separate compliance projects, each with its own owner and its own timeline. But August's events show they're connected in practice: the same vulnerability in an internet-facing system that gives a ransomware group access can trigger a CRA reporting obligation, a NIS2 incident notification, and a GDPR breach notification all at once and it's the same organisational ability to get the facts on the table quickly and escalate correctly that determines whether all three are handled properly, or none of them are.
The question worth asking now
August didn't hand ISACA Denmark's members one single, dramatic incident to respond to. It handed something more demanding: a series of smaller, varied developments that are each manageable on their own, but that together define just how little time is actually left before September's deadlines become reality.
So the question every governance, audit, or security function should be asking in the coming weeks isn't whether the organisation is "compliant" in the abstract. It's far more concrete: who in our organisation can determine, within 24 hours, whether a given vulnerability falls under CRA and who has the mandate to hit "send" to ENISA once the clock has actually started counting down?