The European rules on network security and digital operational resilience, read from the point of view of insurers and policyholders.
The five regulatory developments of October 2026 that matter to those who take on cyber risk: the Italian decree implementing the AI Act, simpler NIS2 registration, the EU Council position on the Digital Omnibus, a data protection fine after a ransomware breach and the first reminder of Cyber Resilience Act reporting duties.
Regulation · Nov 03, 2026
ReadIn its letter of 7 July 2026, ECB Banking Supervision asked significant banks for an action plan against AI-enabled cyber threats, due by 31 October. The ESRB raised systemic cyber risk to "severe". An underwriter's reading: what the ECB asks for, what changes for cyber policies of financial institutions and which questions to bring to renewals.
Regulation · Nov 02, 2026
ReadFact sheet updated to 1 November 2026 on the NIS2 Directive and Italian Legislative Decree 138/2024: who is in scope, security and incident reporting obligations, fines, management liability and what it means for cyber insurance.
Regulation · Nov 02, 2026
ReadFact sheet updated to 1 November 2026 on Regulation (EU) 2022/2554 (DORA) and Italian Legislative Decree 23/2025: who is in scope, ICT risk management, major incident reporting, critical ICT providers, fines and what it means for the cyber insurance of banks, insurers and intermediaries.
Regulation · Nov 02, 2026
ReadApril 2026 brings the IEEE S&P proceedings. Valid but inconsistent 5G messages crash the modems of 542 smartphone models, and imperceptible audio hijacks voice assistants. Computer-use agents cause harm even from benign instructions. On the post-quantum side, HQC and Falcon give way to side channels. The insurance lead market and the AI Act close the month.
Research · Apr 30, 2026
Read