European Union: Cybersecurity

The EU Cyber Resilience Act introduces strict cybersecurity reporting requirements for manufacturers of connected products, with deadlines as tight as 24 hours for early warnings of actively exploited vulnerabilities and severe incidents. Manufacturers must navigate parallel obligations across multiple regulatory frameworks while facing penalties of up to EUR 15 million or 2.5% of global turnover for non-compliance.

The Finnish Cybersecurity Act has fundamentally transformed business insurance requirements by extending cyber risk management obligations to thousands of companies across new sectors. With management now personally liable for cybersecurity compliance and facing potential fines up to EUR 10 million, organizations must reassess their cyber insurance coverage, directors' and officers' liability policies, and overall risk management frameworks.

The Cyber Resilience Act (Regulation (EU) 2024/2847)1 (“CRA”) establishes horizontal cybersecurity requirements for products with digital elements (“PDEs”) placed on the European Union (“EU”) market. Reporting obligations took effect on 11 September 2026, with full application of the CRA from 11 December 2027.

A logistics company sends a fleet of AI-powered drones across a city. Each one carries a high-resolution camera and machine-learning software to identify obstacles and find safe landing zones. Along the way, without anyone intending it, the drones capture footage of gardens, open windows, children in playgrounds, and people on their morning commute.

Ireland's Data Protection Commission received a record 16,160 new cases in 2025, marking a 45% increase from the previous year, while imposing over €530 million in administrative fines. The Commission finalized four major inquiries, with the TikTok decision accounting for €530 million of the total penalties, and concluded 208 cross-border complaints as Lead Supervisory Authority.

This content appears to be a YouTube video page that requires user authentication to verify human access. The page displays a security checkpoint asking users to sign in to confirm...

Herbert Smith Freehills Kramer's Frankfurt Corporate Crime & Investigations team hosted a conference examining cybercrime threats, AI-driven attacks, and the evolving responsibilities of corporate leadership in building cyber resilience. Senior representatives from law enforcement, industry leaders, and global legal partners explored prevention strategies, incident response protocols, and the complex liability landscape facing organizations in an increasingly digital threat environment.

The EU's Cyber Resilience Act introduces mandatory cybersecurity obligations for products with digital elements placed on the EU market. Understanding the five key manufacturer obligations—from secure-by-design requirements to incident reporting deadlines—is essential for compliance with this groundbreaking regulatory framework that elevates cybersecurity from best practice to legal requirement.

The European Central Bank has issued an urgent directive to major financial institutions requiring comprehensive action plans to counter rapidly evolving cybersecurity threats powered by frontier artificial intelligence models. With an October 2026 deadline looming, banks must demonstrate concrete measures across vulnerability management, monitoring capabilities, and third-party risk controls as AI-enabled attacks compress the timeline between threat discovery and exploitation. This supervisory escalation s