REGULATION
Regulatory developments and their relevance to cyber insurance, kept separate from legal advice.
The five regulatory developments of October 2026 that matter to those who take on cyber risk: the Italian decree implementing the AI Act, simpler NIS2 registration, the EU Council position on the Digital Omnibus, a data protection fine after a ransomware breach and the first reminder of Cyber Resilience Act reporting duties.
Nov 03, 2026
ReadIn its letter of 7 July 2026, ECB Banking Supervision asked significant banks for an action plan against AI-enabled cyber threats, due by 31 October. The ESRB raised systemic cyber risk to "severe". An underwriter's reading: what the ECB asks for, what changes for cyber policies of financial institutions and which questions to bring to renewals.
Nov 02, 2026
ReadFact sheet updated to 1 November 2026 on Regulation (EU) 2022/2554 (DORA) and Italian Legislative Decree 23/2025: who is in scope, ICT risk management, major incident reporting, critical ICT providers, fines and what it means for the cyber insurance of banks, insurers and intermediaries.
Nov 02, 2026
ReadFact sheet updated to 1 November 2026 on Regulation (EU) 2024/2847 (Cyber Resilience Act): which products are in scope, reporting of exploited vulnerabilities in force since 11 September 2026, security requirements from 11 December 2027, fines and what it means for cyber, tech E&O and product liability policies.
Nov 02, 2026
ReadFact sheet updated to 1 November 2026 on Regulation (EU) 2024/1689 (AI Act), the 2026 amendments and the related Italian rules (Law 132/2025 and Legislative Decree 160/2026): who is in scope, prohibited and high-risk systems, deadlines, fines, authorities and what it means for cyber, PI and liability policies, including life and health pricing.
Nov 02, 2026
ReadFact sheet updated to 1 November 2026 on the NIS2 Directive and Italian Legislative Decree 138/2024: who is in scope, security and incident reporting obligations, fines, management liability and what it means for cyber insurance.
Nov 02, 2026
ReadWith no dedicated EU directive, damage caused by an AI system is handled through national civil law, the new Product Liability Directive, the AI Act and, in Italy, Law 132/2025 and Legislative Decree 160/2026. A reading from the side of those who take on cyber risk: where liability falls, which policies are exposed, where the market is excluding and which questions to bring to renewals.
Nov 01, 2026
ReadFrom 9 December 2026 software is a product under Directive (EU) 2024/2853. What falls into PI, product liability and cyber, where the three covers overlap or leave gaps, and what changes in underwriting questions.
Oct 31, 2026
Read