EU anti-hacker sticker, new rules and sanctions for digital devices: what to know

A set of rules to adapt to to counter hacker attacks. It's called the Cyber ​​Resilience Act, but they have defined it as the EU anti-hacker "stamp": a European regulation - whose main compliance obligations will definitively come into effect in December 2027 - which establishes cybersecurity requirements, i.e. protection from cyber attacks, abusive access and malfunctions, for products with digital elements, i.e. software or hardware equipment that connect directly or indirectly to a device or network.

The Constitutional Affairs commissions of the Chamber and Senate this week will give the green light to the legislative decree, implementing the European Delegation Law 2025, which aligns Italian legislation with the new European rules for digital devices, i.e. mandatory requirements on cybersecurity, during the entire life cycle. The "stamp" also applies to products classified as high-risk AI systems.

The National Cybersecurity Agency will be the notification authority for the conformity assessment of products, which will have a specific cyber-resilience sticker (CE). The ACN will also be the market supervisory authority (in coordination with the other supervisory authorities, the Bank of Italy, Consob, Ivass and the Privacy Guarantor). The supervisory authorities will be able to adopt guidelines (guidelines, recommendations, good practices).

To certify compliance, those who make a specific request to the ACN will be issued an "accreditation certificate" against the payment of a specific fee that covers the actual costs of the service. Specific measures are envisaged for micro-enterprises, SMEs and start-ups. A regulatory testing space for cyber resilience is then established under ACN supervision, with the Sandbox-CRA (controlled test environments in which innovative products can be developed and tested, for the purposes of verifying their compliance, for a limited period prior to being placed on the market).

Fines for manufacturers who do not comply with the rules are up to 15 million euros or 2.5% of annual global turnover for the most serious violations, up to 10 million or 2% for other non-compliances and up to 5 million or 1% for those who provide inaccurate or misleading information to the authorities. The proceeds from sanctions by the Cybersecurity Agency will go to "increase the budget of the ACN".