The EU anti-hacking label is on its way: what the new rules for digital devices will look like

The EU anti-hacking certification, governed by the Cyber Resilience Act, is on its way. This week, the Constitutional Affairs Committees of the Chamber of Deputies and the Senate are set to give the green light to the legislative decree implementing the 2025 European Delegated Act, which brings Italian legislation into line with the new European rules for digital devices – namely, mandatory cybersecurity requirements throughout their entire life cycle.

The European Regulation – the main compliance requirements of which will come into full effect in December 2027 – sets out cybersecurity requirements, i.e. protection against cyber-attacks, unauthorised access and malfunctions, for products containing digital elements, namely software or hardware that connects directly or indirectly to a device or a network. It also applies to products classified as high-risk AI systems.

The Italian transposition of the EU regulation designates the National Cybersecurity Agency as the authority responsible for notifying the conformity assessment of products, which will bear a specific (CE) cyber-resilience mark. The ACN will also act as the market surveillance authority (in coordination with the other supervisory authorities: the Bank of Italy, Consob, IVASS and the Data Protection Authority). The supervisory authorities may adopt policy documents (guidelines, recommendations, best practices).

To certify compliance, an ‘accreditation certificate’ will be issued to those who submit a specific application to the ACN, subject to payment of a specific fee to cover the actual costs of the service. Specific measures are in place for micro-enterprises, SMEs and start-ups. A regulatory sandbox for cyber-resilience is also being established under the supervision of the ACN, through the Sandbox-CRA (controlled test environments in which innovative products can be developed and tested to verify their compliance for a limited period prior to being placed on the market).

Penalties for manufacturers who fail to comply with the rules range from up to 15 million euros or 2.5 per cent of annual global turnover for the most serious breaches, up to €10 million or 2 per cent for other breaches, and up to €5 million or 1 per cent for those who provide inaccurate or misleading information to the authorities. The revenue from these fines collected by the Cybersecurity Agency will be used to “increase the ACN’s budget allocation”.