Paving the way to security
In the TÜV NORD GROUP, we are actively helping shape technological innovations by arming them against digital threats from the ground up.
Here are six examples
In the TÜV NORD GROUP, we are actively helping shape technological innovations by arming them against digital threats from the ground up.
Here are six examples
Business Unit Certification
Having been accredited in accordance with ISO/IEC 42001, TÜV UK and TÜV NORD Nederland are setting the standard for the secure and responsible use of AI.
“Artificial intelligence is a technology that offers enormous opportunities but also comes with a lot of risks,” explains Thora Markert, Product Manager for AI at TÜV NORD CERT. The possible challenges range widely from technical malfunctions and manipulation risks to attacks on AI systems and ethical issues. “These are completely new questions that never used to be relevant with earlier technologies of this kind,” says Ms. Markert. This is precisely why companies are being called upon to use AI responsibly; after all, this is the only way to ensure the security and integrity of their systems.
And this is exactly where the ISO/IEC 42001 standard comes in. It is the world’s first international standard for management systems in the field of AI. “ISO/IEC 42001 offers a framework for implementing and deploying AI systems responsibly and effectively, and mitigating risks,” Ms. Markert explains. The standard places particular emphasis on the protection of people and society, the management of societal risks and compliance with ethical, data protection and security requirements.
The point of ISO/IEC 42001 certification is to help companies meet growing regulatory requirements. Like many other regions around the world, the EU is currently establishing a legal framework for AI. In the summer of 2024, the bloc passed the EU AI Act, which will be gradually ramped up in the months leading up to August 2027. “With the gradual introduction of the AI Act, the demand for certification is going to increase significantly,” Ms. Markert predicts. Companies outside the EU which offer AI-based products in Europe must also meet the requirements of the EU AI Act. The certification arose out of close collaboration between TÜV UK and TÜV NORD Nederland, both accreditation pioneers within the TÜV NORD Group. TÜV NORD CERT supports the two foreign subsidiaries and is itself aiming for similar accreditation in the future. “Together we’ve developed an effective certification process that we’re also making available to other foreign companies,” Ms. Markert says. “This is enabling us to offer high-quality certifications for AI systems worldwide and offer companies optimal support in their various markets.”
Thora Markert, Product Manager for AI at TÜV NORD CERT
Business Unit Digital & Semiconductor
TÜVIT is building a state-of-the-art research laboratory for Quantum Key Distribution (QKD) systems in Essen. It is here that the foundations are being laid for the testing and certification of systems that enable secure data encryption using quantum technology.
Our digital world is home to more and more connected devices which are generating increasing volumes of data. And it is to protect these data that encryption systems are so very important. But quantum computers may well soon be in the position to crack classical encryption methods. This is because they offer a new type of data processing that is opening the door to previously unimagined computing power. “One common method of data encryption is what we call key exchange. In this process, two prime numbers are combined to create a very large number,” explains Sven Bettendorf, expert in quantum technology at TÜVIT. “A classical computer would need millions of years to get back to the original prime numbers. A quantum computer can do it in just a few minutes.”
This is why new approaches to secure data encryption are needed – such as QKD, with which key exchange is based on physical laws. “This is basically beating quantum technology at its own game,” explains Mr. Bettendorf. However, some hurdles still remain to be overcome for this method to see practical use.
The aim of TÜVIT’s new research laboratory in Essen is to create the technological basis for the testing, qualification and certification of QKD components and systems. This has been made possible thanks to funding from the “Blueprint of a Certification Eco-System for QKD Systems and Applications” project being run under the aegis of the German Federal Ministry of Research, Technology and Space.
“There’s probably no other laboratory in the world that is so well positioned professionally in this field,” says Mr. Bettendorf. One special feature is its open optical laser laboratory, in which researchers can deliberately and precisely manipulate key device components using lasers and simulate possible attack scenarios.
The laboratory was completed in 2025, and trials are now beginning. “Our goal is to be in the position to carry out our first tests and certifications in 2027,” Mr. Bettendorf explains. In this way, TÜVIT is not only supporting manufacturers of QKD systems but also strengthening the role of German industry in this forward-looking technological field.
Sven Bettendorf, expert in quantum technology at TÜVIT
Business Unit Energy & Resources
Whether they be power plants, airports or water utilities, critical infrastructures are the backbone of our society. TÜV NORD EnSys and TÜV NORD IT Secure Communications are now combining their expertise to provide system-relevant facilities with holistic protection – an offer that is unique in Germany.
For operators of critical infrastructures, malfunctions can have grave consequences. The pressure on these companies is increasing as they are having to arm themselves against a range of fundamentally different dangers, including natural disasters and cyberattacks. This is exactly where the new collaboration comes in.
Jan Struve is Head of Fire and Explosion Protection at TÜV NORD EnSys. His team has many years of experience of assessing safety-related issues relating to nuclear power plants and is therefore familiar with high-risk technologies. Burkhard Rose-Mende is Head of the business field Cyber Security Projects & Critical Infrastructures at TÜV NORD IT Secure Communications. These two experts are all set to combine the expertise of their respective fields to create an offer without precedent in Germany: Business Continuity Management, which combines physical safety with IT security. Their shared task is to give companies the tools and wherewithal they need to quickly resume or restore operations in the event of power outages, hacker attacks or fires.
“Many of our existing customers work with unconnected solutions, with fire protection in one silo and IT security in another. We’re now systematically bringing all of these into relationship with one another, and our work is being welcomed by clients,” explains Mr. Struve. In collaboration with the customer, his starting point is a systematic analysis of the risks, after which he arranges them in order of priority and works out suitable measures to counter them. The coronavirus pandemic and the war in Ukraine have shown that companies often do not know where they are vulnerable – until critical processes fail.
The implementation of the Network and Information Security Directive is prompting companies to act, Mr. Rose-Mende says: “The scope of application will be expanded and the requirements tightened.” The number of affected companies is expected to increase from its current level of about 4,500 to 29,500.
The idea for the cooperation arose out of practical experience: Data centres served as a blueprint and showed how valuable the combination of both disciplines is. The municipal utility market, in which both business units already have established customer relationships, looks particularly promising. With the integrated approach, customers benefit from the pooling of expertise, and TÜV NORD is optimally positioned in this growing market.
Jan Struve, Head of Fire and Explosion Protection at TÜV NORD EnSys, and Burkhard Rose-Mende, Head of business field Cyber Security Projects and Critical Infrastructures at TÜV NORD IT Secure Communications
Business Unit Industry
For the first time, the Korean electronics manufacturer Samsung has commissioned TÜV NORD with the testing and certification of its smart home products – a sign of its commitment to cyber and data protection in connected environments.
Smart home products, ranging from intelligent refrigerators that that keep track of their own contents to generate shopping lists to robot vacuum cleaners that that improve their own navigation skills by recognising certain objects, can make everyday life easier. “A device becomes a smart home product when it gets connected to a network and interacts with its environment,” explains Matthias Springer, Senior Vice President for Functional Safety & Security at TÜV NORD. However, connecting more and more devices brings with it a weight of responsibility: To prevent devices from becoming gateways for hackers, manufacturers must secure their products against cyberattacks.
The Cyber Resilience Act (CRA) has set minimum requirements for IT security in the EU since 2024. TÜV NORD tests and certifies connected products for the Internet of Things (IoT) taking its cue from the ETSI with the ETSI EN 303 645 standard, which provides guidelines for compliance with the CRA.
During the audit, manufacturers must, on the one hand, produce documentation to prove that their products meet certain safety criteria; on the other, the devices themselves are subjected to verification and validation tests. “Password protection, authentication and user documentation are the key points,” says Kim Youngcheon, engineer at TÜV NORD Korea.
For the first time, Samsung has had two ranges of robot vacuum cleaners, the Bespoke AI Jet Bot Stream and the Bespoke Jet Bot Combo tested along with a range of bespoke AI refrigerators – with success. The manufacturer-independent TÜV NORD “Certified Cybersecurity” test mark is intended to offer consumers better protection, provide guidance for purchase decisions and reduce security concerns.
“We’re very proud to have carried out the first IoT certification according to ETSI EN 303 645 for Samsung in collaboration with the team in Germany,” says Kim Soyeon, Assistant Engineering Manager at TÜV NORD Korea. “This project and the certification are a milestone in IoT cybersecurity and will set new standards for the market.”
The transitional phase of the CRA will finish at the end of 2027 – until then, the requirements will be gradually tightened. “We will keep pace with the regulations and continue to use our expertise to support our customers,” says Mr. Springer. The most important thing now is to tell the customers and raise awareness of the upcoming regulations, he adds.
Matthias Springer, Senior Vice President Functional Safety & Security at TÜV NORD, and Kim Youngcheon, an engineer at TÜV NORD Korea, alongside Kim Soyeon, Assistant Engineering Manager at TÜV NORD Korea
Business Unit Mobility
TÜV NORD Onboard Car Diagnosis represents an innovative solution for modern vehicles which makes digital inspections safer, more efficient and more transparent – and offers potential for other fields of application.
Modern cars have long been more than just a means of transport – they are now data storage devices on wheels. From navigation destinations to call logs and payment data, they collect enormous amounts of sensitive data over time, especially via smartphone connections. This means that vehicles are not exempt from the increasing regulatory requirements for digital information security.
A particularly risky juncture is the point when a car changes hands. “There are many scenarios in which it’s critically important to establish if particular information is still stored in the vehicle,” says Gero Eggers, Product Developer and Product Manager at TÜV NORD Mobilität.
The concerns extend beyond mere unprotected data to include manipulated mileage and concealed faults. This is exactly where the TÜV NORD Onboard Car Diagnosis comes in. The system uses the on-board diagnostic interface to connect to the vehicle and delivers a comprehensive analysis within minutes. As a one-dongle solution, it combines several services: Personal information is cleaned up (using an app) in compliance with GDPR, technical problems are brought to light by an error memory analysis, and the mileage and vehicle identification number are checked for plausibility. For this innovative solution, the system was recognised as one of the top-3 innovations in the “Electrical/electronical systems & software” category of the Best of Industry Award 2025, Mr. Eggers reports. “It’s amazing how many vehicles do actually get manipulated,” Mr. Eggers reports. The TÜV NORD Onboard Car Diagnosis detects which control units have been used to store mileage and identification numbers and reliably detects discrepancies. Installed spare parts can also be checked for “false identity” by the same means.
The solution is also opening up further perspectives. “We have lots of ideas for additional applications – for different services, customer groups and vehicle types,” Mr. Eggers explains. The latest addition to the portfolio is a battery check for electric vehicles, which can be used to reliably assess the condition of the traction battery in an EV. All collected data are anonymised and stored on secure servers. As well as meeting current data protection requirements, the TÜV NORD Onboard Car Diagnosis is thus also laying the foundations for further analyses. “In the long term it will be possible to evaluate this data pool and use it to improve road safety,” says Mr. Eggers.
Gero Eggers, Product Developer and Product Manager at TÜV NORD Mobilität
Business Unit People & Empowerment
Cybersecurity no longer only affects large corporations – SMEs are also increasingly being targeted by hackers. With the TÜV NORD Akademie’s NIS-2 expert training course, companies can precisely target the measures they need to become resilient and meet the new legal requirements.
The threat posed by cyberattacks is growing as digitalisation continues to spread. It is for this reason that the European Union has fundamentally revised its Directive for Network and Information Security. “The requirements have been dramatically tightened,” explains Melanie Braunschweig, Product Manager at the TÜV NORD Akademie. The new NIS 2 Directive (EU) 2022/2555 will oblige not only operators of critical infrastructures but also numerous medium-sized and large companies from other sectors to implement stricter standards in cyber resilience. The TÜV NORD Akademie responded very early to these changes. “Close market observation and open communication enabled us to pioneer a tailor-made training programme,” says Ms. Braunschweig.
Depending on size and annual turnover, some 30,000 companies in Germany from 18 sectors are affected, including digital services, public administration and food production. What is new is the insistence on the personal responsibility of management: Directors and senior executives must ensure that risk management measures are implemented and monitored. They are obliged to complete appropriate training – and, in the event of violations, they will be personally liable. But motivation to act should not come solely from the legal requirements. “It’s important to communicate the importance of security to employees and to be well prepared for emergencies,” emphasises Diana Kühn, Account Manager at the TÜV NORD Akademie.
To support managers and directors in their duties, the TÜV NORD Akademie offers three training courses with different focuses. Another component of the comprehensive training programme for cyber and information security is the four-day certificate course entitled “NIS-2 Expert (TÜV)”, which is aimed at security and IT managers. “Participants leave the seminar with an understanding of the legal requirements and the ability to apply them to their company,” Ms. Braunschweig says.
The course has been successfully held eleven times since September 2024, and at least 18 more training dates are planned for 2026. “The increase in demand has vindicated our early strategic orientation and confirms our expertise in practical communication,” Ms. Kühn says.
Melanie Braunschweig, Product Manager at the TÜV NORD Akademie, and Diana Kühn, Account Manager at the TÜV NORD Akademie
Read in the magazine to find out how we support our customers.
