Diritto al Digitale

What should a company do when it discovers a vulnerability in a product covered by the EU Cyber Resilience Act? And what happens when that vulnerability becomes a cybersecurity incident?

In this episode, Giulio Coraggio, a technology and data lawyer, discusses with the journalist Antonio Ravenna how companies should deal with vulnerabilities and cybersecurity incidents under the Cyber Resilience Act (CRA), including the new reporting obligations, the role of ENISA and the CRA Single Reporting Platform, and the importance of having the right internal processes in place before an incident occurs.

We look at the key practical questions companies need to address: when does a vulnerability have to be reported, when does an incident trigger a notification, what are the applicable deadlines, and who needs to be involved?

The CRA is changing the way manufacturers need to approach cybersecurity, moving from reactive incident response towards continuous vulnerability management and security throughout the product lifecycle.

If you manufacture, distribute or work with products with digital elements, understanding these obligations is becoming increasingly important. 

Send us Fan Mail

What incidents and vulnerabilities must be reported under the Cyber Resilience Act (CRA)?

Since 11 September 2026, the CRA reporting obligations are in force, with companies required to assess and report certain cybersecurity incidents and actively exploited vulnerabilities through the ENISA reporting platform.

In this video, I explain:

* What events and vulnerabilities need to be reported
* How companies should assess whether a report is required
* What internal processes should be put in place
* What companies need to do to comply with the CRA

And yes, there is also a brief appearance by my Neapolitan horn socks. 😉 

Send us Fan Mail

The September 11 deadline under the Cyber Resilience Act has passed, and the reporting platform is already operational. Companies within the CRA’s scope need to understand what the new reporting obligations mean and what action is required.

Watch my latest video for a practical overview of the CRA reporting requirements and the key implications for companies.

Send us Fan Mail

Prediction markets are expanding rapidly, allowing users to trade contracts linked to the outcome of future events, from elections and sports competitions to economic and other real-world events.

But how should these platforms be qualified under European gambling laws?

In this episode of Diritto al Digitale, Giulio Coraggio, a technology, data and gambling lawyer, looks together with the journalist Antonio Ravenna at the regulatory question that is becoming increasingly relevant for prediction market operators: when does a prediction market become gambling in Europe?

The qualification is far from being merely theoretical. Whether a platform falls within the scope of gambling regulation can affect licensing requirements, consumer protection obligations, advertising restrictions, AML requirements and the regulatory exposure of both operators and other businesses involved in the ecosystem.

I discuss the key elements that European regulators and courts may consider when assessing these platforms, including the role of chance, the user's stake, the nature of the underlying event and the way the platform is structured.

For operators entering the European market, the legal classification of the product can therefore become one of the first regulatory questions to address.

Are prediction markets the next frontier of gambling regulation in Europe?

Watch the episode to find out.

Send us Fan Mail

The EDPB has issued its new Guidelines on Anonymisation, and they could have major implications for AI systems, AI training data and GDPR compliance.

In this episode of the Legal Break, Giulio Coraggio discusses the new EDPB Guidelines with journalist Antonio Ravenna and explains what they mean in practice for organisations developing or deploying AI.

Among the key issues discussed:

• When can data really be considered anonymous under the GDPR?
• Why anonymisation is relative and context-dependent
• The EDPB's three criteria: No Record Isolation, No Linkage and No Inference
• Why AI models and synthetic data create new re-identification risks
• How AI can make inference and re-identification easier
• Why simply removing names and identifiers may not be enough
• What the Guidelines mean for AI developers and businesses using personal data
• Why organisations should periodically reassess whether data remains anonymous
• The relationship between the EDPB's anonymisation guidance and its approach to AI and web scraping

The EDPB Guidelines 02/2026 were adopted in July 2026 and are currently open for public consultation until 30 October 2026.

The key message: anonymisation is no longer something organisations can assume; it needs to be demonstrated, tested and reassessed.

📌 Read the full analysis:
https://www.gamingtechlaw.com/2026/07/edpb-anonymisation-guidelines-ai/

Send us Fan Mail

The Digital Omnibus has postponed the obligations on high-risk AI systems, but it has not modified the general date of application of the AI Act. As a consequence, as of the 2nd of August 2026, the enforcement powers on general purpose AI models, the transparency obligations under Article 50 and the entire sanctioning framework become fully enforceable. 

In this episode of Diritto al Digitale, Giulio Coraggio, technology and data lawyer, reviews what is actually applicable as of today, the operational implications of the requalification from deployer into provider, what Regulation (EU) 2026/1744 has postponed to December 2027 and August 2028, and why the actual obstacle to compliance is not the legal text, but the absence of an allocated accountability. With a concrete five-point board paper for in-house legal functions.

Send us Fan Mail

As of 19 June 2026, withdrawing from a contract concluded online should become as simple as signing up for it. In this episode, journalist Antonio Ravenna interviews Federico Toscani of DLA Piper to unpack the new Article 54-bis of the Italian Consumer Code (Legislative Decree 206/2005), introduced by Legislative Decree 209/2025.

At the heart of the conversation is a new obligation for businesses selling at a distance: they must provide a clear, visible, and easily accessible digital withdrawal function — effectively a "withdrawal button" placed on the same online interface used to enter into the contract.

Over the course of the interview, Federico Toscani and Antonio Ravenna discuss:

1. the rationale behind the rule, and why it exists to rebalance the ease of purchase against the difficulty of cancelling;
2. what the withdrawal function must actually include (button wording, the withdrawal declaration, and the details identifying the consumer and the contract);
3. the confirmation step and the acknowledgment of receipt sent on a durable medium;
4. the moment at which withdrawal is deemed validly exercised in relation to the statutory deadline (paragraph 7);
5. what companies should do right now to bring their websites, apps, and customer journeys into compliance and avoid disputes.

A valuable episode for e-commerce operators, legal departments, compliance teams, and anyone working in the digital market who wants to align their withdrawal process with the transparency and accessibility standards required under the new regime.

Send us Fan Mail

In this episode of Legal Break, Giulio Coraggio, location head of the Italian Intellectual Property & Technology Law group at the law firm DLA Piper and the journalist Antonio Ravenna explain an important Italian court decision about DPO liability, GDPR, and cyber fraud.

A company lost €390,000 in a Business Email Compromise (BEC) attack: criminals sent fake payment instructions and the money went to the wrong bank account. The company tried to blame its external DPO, but the Court of Florence (Decision No. 3034 of 29 May 2026) said no.

Giulio and Antonio explain, in clear and simple words, why the DPO’s job under the GDPR is to advise and monitor, not to make security decisions, and why the duty to put real security measures in place stays with the company. They also share practical lessons: why good documentation is the DPO’s best defense, why ignoring the DPO’s advice can create liability for the company, and why naming a DPO is not a replacement for real cybersecurity. 

Send us Fan Mail

Is your organization truly ready for NIS 2? Italy transposed the NIS 2 Directive through
Legislative Decree 138/2024 — but implementation is complex, obligations are strict, and
the criticalities are real.

In this episode of The Legal Break, Giulio Coraggio and the journalist Antonio Ravenna give a clear, practical breakdown of what NIS 2 means for companies operating in Italy today.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📌 KEY TOPICS COVERED
━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✔ NIS 2 Directive (EU 2022/2555) — what changed vs. NIS 1
✔ Italian transposition via Legislative Decree 138/2024
✔ 18 sectors in scope, including 11 "highly critical" sectors
✔ Essential vs. important entities: how to determine your category
✔ Registration obligations with ACN (Agenzia per la Cybersicurezza Nazionale)
✔ Technical and organizational security measures
✔ Incident notification timelines and requirements
✔ Supply chain and third-party vendor risk
✔ Management body accountability and personal liability
✔ Sanctions up to 0.1% of global turnover for essential entities
✔ Remaining open questions and compliance roadmap

━━━━━━━━━━━━━━━━━━━━━━━━━━━━
👥 SPEAKERS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔹 Giulio Coraggio
   LinkedIn:   / giulio-coraggio 
   Blog: https://www.gamingtechlaw.com

🔹 Antonio Ravenna — Legal Journalist

━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔗 USEFUL RESOURCES
━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📄 D.Lgs. 138/2024 (Official text): https://www.normattiva.it
🌐 ACN – Agenzia per la Cybersicurezza Nazionale: https://www.acn.gov.it
🌐 DLA Piper Technology & Data practice: https://www.dlapiper.com

━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🎙️ ABOUT THE LEGAL BREAK
━━━━━━━━━━━━━━━━━━━━━━━━━━━━
The Legal Break is DLA Piper's podcast series where legal experts decode the most relevant regulatory and legal developments for business — clearly, concisely, and without the jargon.

🔔 Subscribe so you never miss an episode.
👍 Like this video if you found it useful.
💬 Have a question about NIS 2 compliance? Drop it in the comments.

Send us Fan Mail

Italy just became the first EU country to pass a comprehensive national AI law — and the real game-changer is what comes next.

In the time it takes to finish your coffee, Giulio Coraggio and journalist Antonio Ravenna break down how Italy's Law No. 132/2025 plugs into the EU AI Act, and why the upcoming implementing decrees could reshape compliance for anyone building or deploying AI in Italy.

No 40-page memos. No jargon. Just the essentials — in one coffee break. ☕

In this episode:
 🇮🇹 Why Italy moved first in Europe — and what Law No. 132/2025 actually changes
 ⚖️ How the Italian framework is designed to sit inside the EU AI Act (not on top of it)
 📜 The implementing decrees coming by October 2026 — and what they'll cover
 🏥 Sector hotspots: healthcare, employment, professional services, justice & deepfakes
 🚨 The compliance traps companies need to watch now

Whether you're in-house counsel, a compliance lead, or a founder shipping AI products, this is the short briefing you didn't know you needed.

🎧 Follow The Legal Break wherever you listen — new episodes unpack the legal topics that matter, one coffee at a time.
 💬 Got a topic you want us to cover? Let us know.
 ⭐ Enjoying the show? Leave a rating and review — it helps more listeners find us.

Send us Fan Mail