Pier Giorgio Chiara

The swift proliferation of connected devices in the Internal Market brought attention to their weak cybersecurity standard, reflected by widespread and oftentimes unpatched vulnerabilities and successful cyberattacks. Attacks on cyber-physical systems have a critical impact not only on the Union’s economy but also on consumers’ health, safety, and fundamental rights. Against the background of the failure of the cybersecurity market of connected devices, the 10 December 2024 entered into force Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act, CRA). After casting light on the three regulatory foundational choices underpinning this EU legal act in the field of cybersecurity (ie, horizontal approach, risk-based approach, product safety approach), the article investigates the extent to which the CRA enhances the protection of fundamental rights, as claimed in the Explanatory Memorandum of the Commission’s proposal.

On 28 April 2023 the EU Commission presented a new proposal for a regulation in the field of cybersecurity, that is, the so-called ‘Cyber Solidarity Act’ (CSoA). This legislative proposal is the last piece in the rapidly-evolving jigsaw of EU cybersecurity law, which has seen the 2020 Cybersecurity Strategy for the Digital Decade – and in the legislation that resulted afterwards – as a significant turning point. Against this background, this article aims to cast light on the often-silent turf war between the EU and Member States in governing and regulating cybersecurity-related issues. In particular, a critical analysis of the CSoA proposal may serve to unravel three main legal and political challenges underlying turf battles in the governance of cybersecurity in the European Union. They regard: i) how the Commission and Member States differently decline the broad and vague concept of ‘cybersecurity’; ii) possible overlaps between CSoA mechanisms and existing cybersecurity structures having a bearing on national security; and iii) the complex relationship between cybersecurity and national security. We conclude that the Cyber Solidarity Act can be seen as yet another step toward greater EU action in areas where Member States historically jealously held their own competence.

One of the winning teams of the EU AI Act Grand Challenge analyzes how the AI Act will regulate robots.

This article aims to cast light on the emergence of a new policy area in EU law, that is, ‘Cybersecurity law’ by engaging in scholarly debate on the introduction of a new fundamental right to cybersecurity in EU law. In particular, the analytical analysis focuses on three legal challenges posed by a theoretical framework for development of a new right to cybersecurity. They regard: i) the need for such a new right against the background of the existing fundamental right to security (Art. 6 EU Charter of Fundamental Rights, CFR); ii) the actual content of this new right; and, iii) the actors that should implement a new right to cybersecurity. The article concludes by advocating for the need of acknowledging a new right to cybersecurity in EU law.

The EU Commission presented on 15 September 2022 the proposal for a ‘Regulation on horizontal cybersecurity requirements for products with digital elements amending Regulation (EU) 2019/1020’ (Cyber Resilience Act, CRA). This long-awaited piece of legislation would complement EU cybersecurity acquis by laying down horizontal cybersecurity requirements for all products with digital elements. This article sheds light on the ‘horizontal’ character of the CRA proposal by highlighting its main pillars. In particular, the contribution takes into account the new set of obligations placed on economic operators, the conformity assessment procedures as well as the market surveillance framework and the interplay with other legislative initiatives, both in the policy area and outside EU cybersecurity law. Against the backdrop of the sectoral regulatory approach adopted thus far by the Commission vis-à-vis cybersecurity requirements for products, horizontal intervention is needed to ensure legal certainty, avoiding duplicative obligations and further market fragmentation.