# EU Introduces Mandatory Cyber Resilience Label for Digital Devices New Italian legislation aligns with EU standards to enforce cybersecurity throughout product lifecycles. - **Source:** [Il Sole 24 Ore – Mondo](https://www.ilsole24ore.com/sez/mondo) - **Published:** 2026-11-08 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/e02c1385-e59b-4118-b94e-21e5794ee440 ## New Cybersecurity Regulatory Framework The Italian Parliament is finalizing a legislative decree to implement the European Cyber Resilience Act. This regulation mandates strict cybersecurity requirements for hardware and software products that connect to networks. It covers the entire lifecycle of digital devices, ensuring protection against unauthorized access, malicious cyberattacks, and potential system malfunctions. ## Scope of Digital Compliance The regulation applies to all products with digital elements, including hardware and software that connect directly or indirectly to networks. Furthermore, the rules extend to systems classified as high-risk artificial intelligence. By December 2027, these compliance obligations will become fully enforceable, requiring manufacturers to meet rigorous security standards for market access. ## Role of National Authorities The National Cybersecurity Agency (ACN) is designated as the primary notification authority for conformity assessments. The ACN will oversee market surveillance in coordination with the Bank of Italy, Consob, Ivass, and the Privacy Guarantor. These bodies are empowered to issue guidelines, recommendations, and best practices to ensure industry-wide adherence to standards. ## Certification and Testing Processes Manufacturers must apply to the ACN for an accreditation certificate to receive the CE cyber-resilience label. Applicants are required to pay fees covering the actual costs of these services. Additionally, a regulatory sandbox environment is established, allowing companies to test innovative products for compliance before their official market release under supervision. ## Support for Smaller Enterprises The legislative framework includes specific measures tailored to support micro-enterprises, small and medium-sized enterprises, and startups. These provisions aim to facilitate compliance for smaller players while maintaining high security standards. By offering testing environments and structured guidance, the regulation seeks to prevent market exclusion for less resource-heavy innovative technology firms. ## Severe Financial Penalties Non-compliance carries significant financial consequences for producers. Serious violations can result in fines up to 15 million euros or 2.5 percent of total annual global turnover. Lesser infractions carry penalties of 10 million euros or 2 percent, while providing misleading information to authorities can trigger fines up to 5 million euros. ## Reinvestment of Penalty Revenue Revenue generated from these administrative sanctions will be directly allocated to the National Cybersecurity Agency. This mechanism ensures that funds collected from non-compliant entities are reinvested into the agency's budget. This financial structure aims to strengthen the operational capacity of the ACN as it enforces these new digital security mandates. ## Strategic Shift in Security This legislation marks a transition toward mandatory security-by-design principles for all digital products within the European market. By aligning national laws with EU-wide standards, Italy aims to create a unified defense against cyber threats. The move forces manufacturers to prioritize long-term resilience over rapid deployment, fundamentally altering the digital ecosystem. ## Sources covering this story - https://www.ilsole24ore.com/art/arriva-bollino-ue-anti-hacker-come-saranno-nuove-regole-i-dispositivi-digitali-AJZm4R9B — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._