European Union: Cybersecurity

Herbert Smith Freehills Kramer's Frankfurt Corporate Crime & Investigations team hosted a conference examining cybercrime threats, AI-driven attacks, and the evolving responsibilities of corporate leadership in building cyber resilience. Senior representatives from law enforcement, industry leaders, and global legal partners explored prevention strategies, incident response protocols, and the complex liability landscape facing organizations in an increasingly digital threat environment.

The EU's Cyber Resilience Act introduces mandatory cybersecurity obligations for products with digital elements placed on the EU market. Understanding the five key manufacturer obligations—from secure-by-design requirements to incident reporting deadlines—is essential for compliance with this groundbreaking regulatory framework that elevates cybersecurity from best practice to legal requirement.

The European Central Bank has issued an urgent directive to major financial institutions requiring comprehensive action plans to counter rapidly evolving cybersecurity threats powered by frontier artificial intelligence models. With an October 2026 deadline looming, banks must demonstrate concrete measures across vulnerability management, monitoring capabilities, and third-party risk controls as AI-enabled attacks compress the timeline between threat discovery and exploitation. This supervisory escalation s