Glossary term
Passkeys
Also: WebAuthn Passkeys, Discoverable Credentials
Phishing-resistant authentication credentials per WebAuthn/FIDO2 that keep private keys on the device and are unlocked biometrically or by PIN. Replace classic passwords and SMS OTP.
Passkeys use public-key cryptography: the private key never leaves the device (Secure Enclave/TPM); only a signature is sent to the service. Structurally immune to phishing, server database theft and replay.
Sync variants: platform passkeys (iCloud Keychain, Google Password Manager, Microsoft Authenticator) sync via the provider for convenience but introduce vendor lock-in. Hardware passkeys (FIDO2 sticks) do not sync and remain strictly on the hardware token.
In practice
Implementation 2026: Apple, Google, Microsoft, GitHub, Cloudflare, Shopify, Amazon and many others natively support passkeys. For regulated workloads, hardware passkeys with attestation review (level 1/2) are state of the art.
Related terms
MFA
Authentication combining at least two factors from knowledge (password), possession (hardware token, smartphone) and inherence (biometrics). Mandatory under NIS2 Art. 21 (j) and DORA Art. 9.
FIDO2
Open authentication standard of FIDO Alliance and W3C, comprising WebAuthn (browser/platform interface) and CTAP2 (device protocol). Foundation for phishing-resistant MFA and Passkeys.
IAM (Identity and Access Management)
The stack of systems that governs who has access to which systems under which conditions. IAM covers authentication, single sign-on, lifecycle management, access governance (IGA) and privileged access management (PAM), and is the most commonly breached control in enterprise environments.
PAM
Software category for governing privileged access: vault, session management, just-in-time permissions, session recording, zero standing privilege. Mandatory stack under NIS2 and DORA for admin access.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
BAIT
BaFin circular that concretises IT requirements for credit institutions. Specifies MaRisk AT 7.2 for IT strategy, information security, user permissions, project management, application development, and IT outsourcing.