Diritto al Digitale

How to deal with a vulnerability and an incident under the Cyber Resilience Act?

What should a company do when it discovers a vulnerability in a product covered by the EU Cyber Resilience Act? And what happens when that vulnerability becomes a cybersecurity incident? In this episode, Giulio Coraggio, a technology and data lawyer, discusses with the journalist Antonio Ravenna how companies should deal with vulnerabilities and cybersecurity incidents under the Cyber Resilience Act (CRA), including the new reporting obligations, the role of ENISA and the CRA Single Reporting Platform, and the importance of having the right internal processes in place before an incident occurs. We look at the key practical questions companies need to address: when does a vulnerability have to be reported, when does an incident trigger a notification, what are the applicable deadlines, and who needs to be involved? The CRA is changing the way manufacturers need to approach cybersecurity, moving from reactive incident response towards continuous vulnerability management and security throughout the product lifecycle. If you manufacture, distribute or work with products with digital elements, understanding these obligations is becoming increasingly important. Send us Fan Mail

• Transcript

Cyber Resilience Act: What Incidents and Vulnerabilities Must Be Reported?

What incidents and vulnerabilities must be reported under the Cyber Resilience Act (CRA)? Since 11 September 2026, the CRA reporting obligations are in force, with companies required to assess and report certain cybersecurity incidents and actively exploited vulnerabilities through the ENISA reporting platform. In this video, I explain: * What events and vulnerabilities need to be reported * How companies should assess whether a report is required * What internal processes should be put in place * What companies need to do to comply with the CRA And yes, there is also a brief appearance by my Neapolitan horn socks. 😉 Send us Fan Mail

• Transcript

Cyber Resilience Act: What Does the September 11 Deadline Mean?

The September 11 deadline under the Cyber Resilience Act has passed, and the reporting platform is already operational. Companies within the CRA’s scope need to understand what the new reporting obligations mean and what action is required. Watch my latest video for a practical overview of the CRA reporting requirements and the key implications for companies. Send us Fan Mail

• Transcript

Prediction Markets in Europe: Are They Gambling?

Prediction markets are expanding rapidly, allowing users to trade contracts linked to the outcome of future events, from elections and sports competitions to economic and other real-world events. But how should these platforms be qualified under European gambling laws? In this episode of Diritto al Digitale, Giulio Coraggio, a technology, data and gambling lawyer, looks together with the journalist Antonio Ravenna at the regulatory question that is becoming increasingly relevant for prediction market operators: when does a prediction market become gambling in Europe? The qualification is far from being merely theoretical. Whether a platform falls within the scope of gambling regulation can affect licensing requirements, consumer protection obligations, advertising restrictions, AML requirements and the regulatory exposure of both operators and other businesses involved in the ecosystem. I discuss the key elements that European regulators and courts may consider when assessing these platforms, including the role of chance, the user's stake, the nature of the underlying event and the way the platform is structured. For operators entering the European market, the legal classification of the product can therefore become one of the first regulatory questions to address. Are prediction markets the next frontier of gambling regulation in Europe? Watch the episode to find out. Send us Fan Mail

• Transcript

EDPB Anonymisation Guidelines: What They Mean for AI Systems & GDPR

The EDPB has issued its new Guidelines on Anonymisation, and they could have major implications for AI systems, AI training data and GDPR compliance. In this episode of the Legal Break, Giulio Coraggio discusses the new EDPB Guidelines with journalist Antonio Ravenna and explains what they mean in practice for organisations developing or deploying AI. Among the key issues discussed: • When can data really be considered anonymous under the GDPR? • Why anonymisation is relative and context-dependent • The EDPB's three criteria: No Record Isolation, No Linkage and No Inference • Why AI models and synthetic data create new re-identification risks • How AI can make inference and re-identification easier • Why simply removing names and identifiers may not be enough • What the Guidelines mean for AI developers and businesses using personal data • Why organisations should periodically reassess whether data remains anonymous • The relationship between the EDPB's anonymisation guidance and its approach to AI and web scraping The EDPB Guidelines 02/2026 were adopted in July 2026 and are currently open for public consultation until 30 October 2026. The key message: anonymisation is no longer something organisations can assume; it needs to be demonstrated, tested and reassessed. 📌 Read the full analysis: https://www.gamingtechlaw.com/2026/07/edpb-anonymisation-guidelines-ai/ Send us Fan Mail

• Transcript

The EU AI Act from 2 August 2026: what actually applies and what to report to the board

The Digital Omnibus has postponed the obligations on high-risk AI systems, but it has not modified the general date of application of the AI Act. As a consequence, as of the 2nd of August 2026, the enforcement powers on general purpose AI models, the transparency obligations under Article 50 and the entire sanctioning framework become fully enforceable. In this episode of Diritto al Digitale, Giulio Coraggio, technology and data lawyer, reviews what is actually applicable as of today, the operational implications of the requalification from deployer into provider, what Regulation (EU) 2026/1744 has postponed to December 2027 and August 2028, and why the actual obstacle to compliance is not the legal text, but the absence of an allocated accountability. With a concrete five-point board paper for in-house legal functions. Send us Fan Mail

• Transcript

How Online Withdrawal Rights Are Changing in Italy

As of 19 June 2026, withdrawing from a contract concluded online should become as simple as signing up for it. In this episode, journalist Antonio Ravenna interviews Federico Toscani of DLA Piper to unpack the new Article 54-bis of the Italian Consumer Code (Legislative Decree 206/2005), introduced by Legislative Decree 209/2025. At the heart of the conversation is a new obligation for businesses selling at a distance: they must provide a clear, visible, and easily accessible digital withdrawal function — effectively a "withdrawal button" placed on the same online interface used to enter into the contract. Over the course of the interview, Federico Toscani and Antonio Ravenna discuss: 1. the rationale behind the rule, and why it exists to rebalance the ease of purchase against the difficulty of cancelling; 2. what the withdrawal function must actually include (button wording, the withdrawal declaration, and the details identifying the consumer and the contract); 3. the confirmation step and the acknowledgment of receipt sent on a durable medium; 4. the moment at which withdrawal is deemed validly exercised in relation to the statutory deadline (paragraph 7); 5. what companies should do right now to bring their websites, apps, and customer journeys into compliance and avoid disputes. A valuable episode for e-commerce operators, legal departments, compliance teams, and anyone working in the digital market who wants to align their withdrawal process with the transparency and accessibility standards required under the new regime. Send us Fan Mail

• Transcript

Is the DPO Responsible for a Cyber Attack?

In this episode of Legal Break, Giulio Coraggio, location head of the Italian Intellectual Property & Technology Law group at the law firm DLA Piper and the journalist Antonio Ravenna explain an important Italian court decision about DPO liability, GDPR, and cyber fraud. A company lost €390,000 in a Business Email Compromise (BEC) attack: criminals sent fake payment instructions and the money went to the wrong bank account. The company tried to blame its external DPO, but the Court of Florence (Decision No. 3034 of 29 May 2026) said no. Giulio and Antonio explain, in clear and simple words, why the DPO’s job under the GDPR is to advise and monitor, not to make security decisions, and why the duty to put real security measures in place stays with the company. They also share practical lessons: why good documentation is the DPO’s best defense, why ignoring the DPO’s advice can create liability for the company, and why naming a DPO is not a replacement for real cybersecurity. Send us Fan Mail

• Transcript

NIS 2 in Italy: Is Your Company Ready? The Cybersecurity Rules You Can't Ignore

Is your organization truly ready for NIS 2? Italy transposed the NIS 2 Directive through Legislative Decree 138/2024 — but implementation is complex, obligations are strict, and the criticalities are real. In this episode of The Legal Break, Giulio Coraggio and the journalist Antonio Ravenna give a clear, practical breakdown of what NIS 2 means for companies operating in Italy today. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 📌 KEY TOPICS COVERED ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ✔ NIS 2 Directive (EU 2022/2555) — what changed vs. NIS 1 ✔ Italian transposition via Legislative Decree 138/2024 ✔ 18 sectors in scope, including 11 "highly critical" sectors ✔ Essential vs. important entities: how to determine your category ✔ Registration obligations with ACN (Agenzia per la Cybersicurezza Nazionale) ✔ Technical and organizational security measures ✔ Incident notification timelines and requirements ✔ Supply chain and third-party vendor risk ✔ Management body accountability and personal liability ✔ Sanctions up to 0.1% of global turnover for essential entities ✔ Remaining open questions and compliance roadmap ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 👥 SPEAKERS ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🔹 Giulio Coraggio LinkedIn: / giulio-coraggio Blog: https://www.gamingtechlaw.com 🔹 Antonio Ravenna — Legal Journalist ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🔗 USEFUL RESOURCES ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 📄 D.Lgs. 138/2024 (Official text): https://www.normattiva.it 🌐 ACN – Agenzia per la Cybersicurezza Nazionale: https://www.acn.gov.it 🌐 DLA Piper Technology & Data practice: https://www.dlapiper.com ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🎙️ ABOUT THE LEGAL BREAK ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ The Legal Break is DLA Piper's podcast series where legal experts decode the most relevant regulatory and legal developments for business — clearly, concisely, and without the jargon. 🔔 Subscribe so you never miss an episode. 👍 Like this video if you found it useful. 💬 Have a question about NIS 2 compliance? Drop it in the comments. Send us Fan Mail

• Transcript

Italy's New AI Law: What the Decrees Mean for Your Business

Italy just became the first EU country to pass a comprehensive national AI law — and the real game-changer is what comes next. In the time it takes to finish your coffee, Giulio Coraggio and journalist Antonio Ravenna break down how Italy's Law No. 132/2025 plugs into the EU AI Act, and why the upcoming implementing decrees could reshape compliance for anyone building or deploying AI in Italy. No 40-page memos. No jargon. Just the essentials — in one coffee break. ☕ In this episode: 🇮🇹 Why Italy moved first in Europe — and what Law No. 132/2025 actually changes ⚖️ How the Italian framework is designed to sit inside the EU AI Act (not on top of it) 📜 The implementing decrees coming by October 2026 — and what they'll cover 🏥 Sector hotspots: healthcare, employment, professional services, justice & deepfakes 🚨 The compliance traps companies need to watch now Whether you're in-house counsel, a compliance lead, or a founder shipping AI products, this is the short briefing you didn't know you needed. 🎧 Follow The Legal Break wherever you listen — new episodes unpack the legal topics that matter, one coffee at a time. 💬 Got a topic you want us to cover? Let us know. ⭐ Enjoying the show? Leave a rating and review — it helps more listeners find us. Send us Fan Mail

• Transcript

AI Act Changes Explained: What the EU Digital Omnibus Means for Businesses

The European Union is already revisiting the AI Act before many companies have even completed their first compliance assessments. In this episode, Giulio Coraggio and Antonio Ravenna discuss the impact of the changes introduced by the EU Digital Omnibus package and what businesses should expect next from the evolving European AI regulatory framework. The conversation explores: • why the European Commission proposed changes to the AI Act • the simplification measures affecting high-risk AI systems • the relationship between the AI Act and machinery legislation • the new timelines and delegated acts expected from the Commission • whether the reforms will simplify compliance or increase uncertainty • what companies should do now to prepare for AI governance obligations Giulio Coraggio is a technology and data lawyer at the global law firm DLA Piper, where he focuses on artificial intelligence, privacy, cybersecurity, digital regulation, and technology transactions. He regularly advises international companies on AI governance and compliance strategies. Antonio Ravenna is a journalist focused on artificial intelligence, innovation, and digital transformation, regularly covering the evolution of AI regulation and its impact on businesses and society. As AI becomes embedded in everyday business operations, AI governance can no longer be postponed. The regulatory framework may evolve, but the need for responsible AI management remains critical. Subscribe for more insights on artificial intelligence regulation, privacy, cybersecurity, technology law, and digital innovation. Send us Fan Mail

• Transcript

AI Act Changes: Is Europe Rewriting Its AI Regulation Strategy?

The European Union has agreed on major changes to the AI Act to reduce overlap with machinery, product safety, and sector-specific regulation. But is this just simplification — or the beginning of a broader rethink of AI regulation in Europe? In this episode of Diritto al Digitale, Giulio Coraggio, technology and data lawyer, analyzes the latest AI Act amendments, the delay of high-risk AI obligations, the impact on industrial AI, medical devices, robotics, and what companies must do now to prepare for AI compliance, cybersecurity, and governance challenges. Send us Fan Mail

• Transcript

AI Value Gap and AI Act: Why 81% of Companies Fail to Turn AI into Real Business Value

Why are 82% of companies investing in artificial intelligence, yet 81% fail to generate real business value? In this episode of Diritto al Digitale, hosted by Giulio Coraggio, technology and data lawyerr, we explore the growing AI value gap and its profound legal and strategic implications for businesses. The episode provides a detailed legal analysis of why artificial intelligence initiatives often remain isolated and fail to scale, focusing on critical issues such as AI governance, AI Act compliance, and GDPR risks. It explains why treating AI as a simple technological tool—rather than a regulated system—creates both missed opportunities and significant exposure to liability. We also examine the implications of high-risk AI systems under the AI Act, the regulatory challenges posed by AI agents and autonomous decision-making, and how evolving legal frameworks are shaping the future of AI adoption in Europe and globally. A key focus is on governance: how companies can design structured AI governance models to enable scalability, ensure compliance, and turn AI into a true competitive advantage rather than a legal risk. This episode is designed for legal professionals, in-house counsel, compliance officers, and business leaders dealing with AI regulation, data protection, and digital transformation. Key topics include: AI value gap, AI governance frameworks, AI Act requirements, GDPR and automated decision-making, AI agents regulation, legal risk management, and scalable AI adoption. If you are advising on or implementing AI strategies, this episode will help you understand why the real challenge is not the technology itself—but how it is governed, structured, and legally managed. Send us Fan Mail

• Transcript

AI Act vs US AI Policy Framework: Regulatory Divergence and Its Impact on Global AI Governance

The global race to regulate artificial intelligence is accelerating—and companies can no longer afford to ignore it. In this episode of Diritto al Digitale, Giulio Coraggio, Technology and Data Lawyer, analyzes the growing divergence between the EU AI Act and the US AI Policy Framework, two competing models that are reshaping AI governance, compliance, and innovation strategies worldwide. The European Union is advancing a risk-based regulatory framework under the AI Act, reinforced by the latest developments of the Digital Omnibus package, introducing stricter obligations for high-risk AI systems, data governance, and compliance by design. At the same time, the United States is pursuing a more flexible, policy-driven approach based on soft law, voluntary standards, and ex post enforcement. What does this mean in practice for companies operating globally? This episode explores: - The latest updates on the EU AI Act and Digital Omnibus - The structure and impact of the US National AI Policy Framework - Key differences between ex ante compliance and ex post enforcement models - Legal, operational, and reputational risks for businesses using AI - Why AI governance is no longer optional for organizations If your business is developing, deploying, or integrating artificial intelligence, understanding these regulatory dynamics is critical to managing risk and staying competitive. Listen now to gain practical insights into AI regulation, compliance strategies, and the future of global AI governance. Send us Fan Mail

• Transcript

Dual-Use Technologies: The Hidden Military Side of Europe’s AI, Chips and Space Industry

Artificial intelligence, semiconductors, satellites, robotics. Most people see them as civilian technologies powering the digital economy. But many of these innovations also have a military dimension. They are what regulators call dual-use technologies — technologies that can serve both civilian and defence purposes. As geopolitical tensions rise and global defence spending reaches record levels, these technologies are becoming strategic assets for governments and industry. And this shift is triggering a rapid expansion of European regulation, from export controls to foreign investment screening, sanctions regimes and industrial policy initiatives such as the European Defence Fund and the EU Chips Act. In this episode of Diritto al Digitale, Giulio Coraggio explores: what qualifies as a dual-use technology the EU legal frameworks governing these technologies why companies developing AI, chips, robotics and aerospace technologies are increasingly affected by defence regulation the industrial opportunities for European and Italian companies in this rapidly evolving sector and the growing intersection between technology, law and geopolitics If you work in technology law, compliance, defence, AI, semiconductors or export control, this is a conversation you cannot afford to miss. Because the future of innovation in Europe will increasingly depend on technologies that are both civilian and military at the same time. Send us Fan Mail

• Transcript

Digital Law Predictions for 2026: AI Governance, GDPR, Cybersecurity & Crypto

In this episode of Diritto al Digitale, Giulio Coraggio hosts a roundtable with colleagues to share their predictions on the legal developments that will most impact digital business in 2026. Rather than looking at regulation in isolation, the discussion focuses on how EU digital rules will increasingly converge in practice, and what companies should expect as enforcement, supervision, and accountability intensify. 🎙️ Predictions from the roundtable speakers: Vincenzo Giuffré on cloud computing and digital transformation Predictions on cloud contract risk allocation, Data Act portability, ACN certification for Italian public entities, and continued uncertainty around EU–US data transfers. Tommaso Ricci on artificial intelligence Why 2026 will be the year when internal AI governance frameworks become unavoidable as AI systems move from experimentation to operations. Roxana Smeria on data protection and GDPR Expected enforcement trends, AI training scrutiny, and how the debate on legitimate interest will shape compliance strategies. Federico Toscani on cybersecurity Why cyber incidents under GDPR, NIS2 and DORA will increasingly trigger top-management accountability, with stricter Italian incident reporting expectations. Giulio Napolitano on crypto and payments How MiCA, stablecoins, crypto payments and the interaction with PSD3 will push crypto further into the realm of regulated financial infrastructure. The key prediction for 2026: Companies will no longer be assessed on compliance in silos. Success will depend on how well they integrate AI, data protection, cybersecurity, cloud and payments regulation into a coherent governance model. 📩 Share your views or suggest future topics: giulio.coraggio@dlapiper.com 🔔 Follow Diritto al Digitale on your favorite podcast platform ⭐ If you found this episode useful, please leave a rating or review If you want, I can also: Turn this into a “Top 5 predictions for 2026” executive-style description Shorten it for Spotify’s mobile preview Align it word-for-word with the YouTube description for cross-platform consistency Send us Fan Mail

AI Training and Copyright: Is “Fair Use” Still a Viable Legal Shield?

A new US lawsuit brought by authors against leading AI developers reopens a core legal question: can large-scale AI training on copyrighted books systematically qualify as fair use? In this episode of Diritto al Digitale, Giulio Coraggioanalyzes the legal strategy behind the case, compare the US and EU copyright frameworks, and explore the practical implications for AI developers, deployers, and corporate governance under the AI Act. Send us Fan Mail

AI Governance: Innovation, Privacy and the EU AI Act with Oliver Patel of AstraZeneca

Artificial intelligence is rapidly transforming the pharmaceutical and life sciences sector — but innovation in this field comes with some of the highest regulatory, ethical, and governance expectations. In this episode of Legal Leaders Insights from Diritto al Digitale, Giulio Coraggio speaks with Oliver Patel, Head of Enterprise AI Governance at AstraZeneca, about how AI governance is implemented in practice within a global pharmaceutical company. The conversation covers: What enterprise AI governance looks like in the life sciences sector How to balance AI innovation with privacy, intellectual property, and compliance The concrete implications of the EU AI Act for pharmaceutical companies Practical governance approaches to enable responsible and scalable AI This episode is particularly relevant for legal professionals, compliance teams, in-house counsel, data leaders, and executives working in highly regulated industries. Diritto al Digitale is the podcast where law, technology, and digital regulation intersect with real business challenges. Send us Fan Mail

Digital Omnibus Explained: How the EU Wants to Fix GDPR, AI Act and Cyber Rules

The EU’s new Digital Omnibus proposal aims to simplify and align Europe’s most important digital laws — from the GDPR and AI Act to the Data Act, NIS2 and the Cyber Resilience Act. But will it really make compliance easier, or create even more complexity? In this episode of Diritto al Digitale, Giulio Coraggio from the law firm DLA Piper breaks down the Digital Omnibus in simple, clear language, explaining: •what changes for AI training, GDPR, cookies and legitimate interest, •how the EU wants to create a single incident-reporting portal, •what the major updates mean for AI providers, privacy teams and cybersecurity leaders, •and whether the Omnibus can truly “correct” today’s fragmented EU digital rules. Perfect for legal, tech and business professionals who want a fast and easy explanation of one of the EU’s most important upcoming reforms. Listen now to understand how the Digital Omnibus may reshape your AI, data and cybersecurity strategy in 2025 and beyond Send us Fan Mail

Legitimate Interest to Save AI? Europe’s Bold GDPR Reform

The European Commission is preparing to codify “legitimate interest” as a lawful basis for AI training — a reform that could become the most significant update to the GDPR since 2018. In this episode, Giulio Coraggio, Technology & Data Lawyer at DLA Piper, explores how this proposal could reshape the legal foundations of AI development, bridging the gap between data protection and innovation. 🎙️ We’ll discuss: •Why this reform matters for AI developers and data controllers; •How it aligns with the EU AI Act; •The safeguards that will still protect personal data; •And whether this move truly strikes the balance between fundamental rights and technological progress. 💬 Share your thoughts with Giulio at giulio.coraggio@dlapiper.com, subscribe to Diritto al Digitale, and don’t forget to leave ⭐⭐⭐⭐⭐ if you enjoyed the episode. Send us Fan Mail