An AI agent cyber attack raises three questions that EU law now answers in three different places, namely which reporting duties are triggered and on what timetable, which liability regime governs the damage once it is done, and which documents a claimant can obtain before it has proved anything at all.
Cybersecurity liability for the supermarket freezer attacks that hit France in October and northern Europe on 1 November 2026 will turn on what each operator did in the three weeks between the two waves, and the questions it raises, from NIS2 scope to food law and insurance, must be answered in the usual emergency, just as CRA reporting, national cyber laws and the new product liability regime land on the same companies.
NIS 2 Italy has moved from registration to enforcement. Entities listed in April 2025 have reached the 18-month deadline for the basic security measures this month, incident notification has been mandatory since January, and the annual cycle of declarations and updates now runs whether boards pay attention to it or not.
