NIS 2 Italy has moved from registration to enforcement. Entities listed in April 2025 have reached the 18-month deadline for the basic security measures this month, incident notification has been mandatory since January, and the annual cycle of declarations and updates now runs whether boards pay attention to it or not.
Ransomware liability in Italy now the first Italian court that responded to the question on whether the IT provider that managed the systems has to pay for damages caused by the cyber attack.
Italian AI Act enforcement now has a complete institutional machine behind it, because the second implementing law that Italy published on 8 October 2026 in the Italian Official Journal designates the authorities that will inspect and sanction, fixes the level of the fines, opens a national regulatory sandbox and restricts the use of artificial intelligence in decisions affecting employees.
When your own company’s AI agent is hacked, who is liable for what happens next? This is a question I expect to hear much more often as companies give AI agents access to internal systems, business applications, customer data and, increasingly, the ability to take actions without a human approving every step.
A data breach caused by an AI agent has now been notified for the first time to a European data protection authority, with the Spanish AEPD receiving the first notification of a personal data breach allegedly carried out using an AI agent.
GDPR data subject rights are becoming a significant enforcement risk for companies, even a single complaint can lead to large fines if it reveals weaknesses in the way personal data is managed across different systems, teams and business processes.
AI Act investigations have begun, with the European Commission using its enforcement powers for the first time to order leading AI developers to detail their practices on cybersecurity, safety and copyright through information requests.
The Data Act access by design obligation becomes applicable on 12 September 2026 to connected products and related services placed on the market after that date.
