Cyber regulatory watch: what changed in October 2026

The five regulatory developments of October 2026 that matter to those who take on cyber risk: the Italian decree implementing the AI Act, simpler NIS2 registration, the EU Council position on the Digital Omnibus, a data protection fine after a ransomware breach and the first reminder of Cyber Resilience Act reporting duties.

Regulatory watch · October 2026 · by cybercoverinsurance

October 2026 brings the AI Act fully into force in Italy, simplifies NIS2 administration and opens a European debate on a single channel for incident notification. For those who take on cyber risk, though, the most useful item is a fine from the Italian data protection authority: it lists, control by control, the weaknesses that turned a ransomware attack into a data breach.

In brief

AI Act in Italy: since 23 October 2026 Legislative Decree 179/2026 has been in force, giving ACN supervisory powers and setting fines.
NIS2: ACN determination no. 314287/2026 simplifies 2027 registration for entities already on the list.
Digital Omnibus: on 21 October 2026 the EU Council adopted its position, which rewrites data breach notification.
Italian data protection authority: an engineering firm fined 120,000 euros after a ransomware attack, for weaknesses in authentication, segmentation and backups.
Cyber Resilience Act: European authorities remind manufacturers of the duty to report exploited PHP vulnerabilities.

1. The decree implementing the AI Act is in force

Italian Legislative Decree no. 179 of 7 October 2026, published in Official Gazette no. 234 of 8 October, has been in force since 23 October 2026 (Quotidiano Sanità, Normattiva). ACN becomes the general market surveillance authority, with powers to inspect, including without notice; AgID oversees conformity assessment bodies; the data protection authority, Banca d'Italia, Consob and IVASS cooperate for their sectors. Fines mirror the AI Act: up to 35 million euros or 7% of turnover for prohibited practices, up to 15 million or 3% for other obligations.

The decree also bans final decisions on hiring, dismissal, discipline and performance assessment from being taken solely by automated systems, on pain of nullity.

For underwriters: together with Legislative Decree 160/2026, in force since 30 September, the Italian framework is complete. There is an authority with inspection powers, and a breach of the AI Act creates a presumption of causation in a damages claim. Details in the AI Act fact sheet.

2. NIS2: simpler registration from 2027

ACN determination no. 314287/2026, applicable from 25 October 2026, replaces no. 127437/2026 (CyberSecItalia). Entities already on the NIS list with no data to change need not register again in the January-February 2027 window. Specific obligations apply to mergers and transfers of business units linked to NIS activities. Listing and categorisation of activities and services remain set between 1 May and 30 June.

For underwriters: the rule on mergers and transfers matters in corporate transactions. A NIS business unit that changes owner carries its registration duties with it, and the underwriting questionnaire should reflect this. The full picture is in the NIS2 fact sheet.

3. Digital Omnibus: the EU Council rewrites data breach notification

On 21 October 2026 the EU Council adopted its position on the Digital Omnibus, the package simplifying digital rules (NicFab). Two points concern incident handling directly:

notifying a data breach to the authority would be mandatory only for high-risk breaches, within 96 hours instead of the current 72;
the single European entry point for incident notifications would become an information point directing entities to national channels, with a new Article 23b of NIS2.

The position also extends to DORA incident reporting. The text is not law: negotiations with the European Parliament come next.

For underwriters: if adopted, fewer mandatory notifications to data protection authorities mean lower notification costs and fewer fines for late notification in minor incidents. Nothing changes for NIS2, DORA and the CRA, which keep their own deadlines.

4. Italian data protection authority: the weaknesses behind a ransomware attack

In a decision of July 2026, discussed on 13 October, the Italian data protection authority fined an engineering consultancy 120,000 euros after a ransomware attack in October 2024 (Data Protection Law). The firm processed data on behalf of more than 1,200 clients; part of the stolen data, including health data, was published on the dark web in December 2024. The authority found breaches of Articles 5 and 32 of the GDPR and pointed to five weaknesses:

accounts locked after ten failed attempts, but unlocked automatically after five minutes;
multi-factor authentication on only some accounts, not on the VPN, the firewall or network devices;
no network segmentation, with domain controllers able to reach every VLAN, including the backup network;
no offline or immutable backup, with the last usable backup two months old;
no formal vulnerability management process.

For underwriters: the five weaknesses match the key questions of a cyber underwriting questionnaire. The decision also confirms that a supplier with many clients, here more than 1,200, is an aggregation point: a single attack produces a claim for the supplier and notification duties for each client.

5. Cyber Resilience Act: first reminder on PHP vulnerabilities

On 21 October 2026 the European Commission, ENISA, CERT-EU, Europol and the CSIRTs network issued a joint statement on critical PHP vulnerabilities (NicFab). It recalls that since 11 September 2026 manufacturers must report actively exploited vulnerabilities through ENISA's single reporting platform. It is the first time the authorities have publicly reminded manufacturers of the duty for a widespread vulnerability.

For underwriters: for software makers that ship PHP in their products the reporting duty is already live. Those that did not report may face fines and, from 9 December 2026, a weaker position in a defective product claim. Details in the Cyber Resilience Act fact sheet.

Upcoming deadlines

2 December 2026: new AI Act bans on systems that generate non-consensual intimate images.
9 December 2026: Directive (EU) 2024/2853 makes software a product for defective product liability.
1 January - 28 February 2027: NIS 2027 registration window in Italy, under the new rules of determination 314287/2026.

Impact for insurersMedium

October completes the Italian AI Act framework and simplifies NIS2, while the Digital Omnibus is still being negotiated; the data protection fine offers a concrete list of controls to check at underwriting.