Advertise on podcast: Diritto al Digitale

What should a company do when it discovers a vulnerability in a product covered by the EU Cyber Resilience Act? And what happens when that vulnerability becomes a cybersecurity incident? In this episode, Giulio Coraggio, a technology and data lawyer, discusses with the journalist Antonio Ravenna how companies should deal with vulnerabilities and cybersecurity incidents under the Cyber Resilience Act (CRA), including the new reporting obligations, the role of ENISA and the CRA Single Reporting Platform, and the importance of having the right internal processes in place before an incident occurs. We look at the key practical questions companies need to address: when does a vulnerability have to be reported, when does an incident trigger a notification, what are the applicable deadlines, and who needs to be involved? The CRA is changing the way manufacturers need to approach cybersecurity, moving from reactive incident response towards continuous vulnerability management and security throughout the product lifecycle. If you manufacture, distribute or work with products with digital elements, understanding these obligations is becoming increasingly important.  Send us Fan Mail

What incidents and vulnerabilities must be reported under the Cyber Resilience Act (CRA)? Since 11 September 2026, the CRA reporting obligations are in force, with companies required to assess and report certain cybersecurity incidents and actively exploited vulnerabilities through the ENISA reporting platform. In this video, I explain: * What events and vulnerabilities need to be reported * How companies should assess whether a report is required * What internal processes should be put in place * What companies need to do to comply with the CRA And yes, there is also a brief appearance by my Neapolitan horn socks. 😉  Send us Fan Mail

The September 11 deadline under the Cyber Resilience Act has passed, and the reporting platform is already operational. Companies within the CRA’s scope need to understand what the new reporting obligations mean and what action is required. Watch my latest video for a practical overview of the CRA reporting requirements and the key implications for companies. Send us Fan Mail

Prediction markets are expanding rapidly, allowing users to trade contracts linked to the outcome of future events, from elections and sports competitions to economic and other real-world events. But how should these platforms be qualified under European gambling laws? In this episode of Diritto al Digitale, Giulio Coraggio, a technology, data and gambling lawyer, looks together with the journalist Antonio Ravenna at the regulatory question that is becoming increasingly relevant for prediction market operators: when does a prediction market become gambling in Europe? The qualification is far from being merely theoretical. Whether a platform falls within the scope of gambling regulation can affect licensing requirements, consumer protection obligations, advertising restrictions, AML requirements and the regulatory exposure of both operators and other businesses involved in the ecosystem. I discuss the key elements that European regulators and courts may consider when assessing these platforms, including the role of chance, the user's stake, the nature of the underlying event and the way the platform is structured. For operators entering the European market, the legal classification of the product can therefore become one of the first regulatory questions to address. Are prediction markets the next frontier of gambling regulation in Europe? Watch the episode to find out. Send us Fan Mail

The EDPB has issued its new Guidelines on Anonymisation, and they could have major implications for AI systems, AI training data and GDPR compliance. In this episode of the Legal Break, Giulio Coraggio discusses the new EDPB Guidelines with journalist Antonio Ravenna and explains what they mean in practice for organisations developing or deploying AI. Among the key issues discussed: • When can data really be considered anonymous under the GDPR? • Why anonymisation is relative and context-dependent • The EDPB's three criteria: No Record Isolation, No Linkage and No Inference • Why AI models and synthetic data create new re-identification risks • How AI can make inference and re-identification easier • Why simply removing names and identifiers may not be enough • What the Guidelines mean for AI developers and businesses using personal data • Why organisations should periodically reassess whether data remains anonymous • The relationship between the EDPB's anonymisation guidance and its approach to AI and web scraping The EDPB Guidelines 02/2026 were adopted in July 2026 and are currently open for public consultation until 30 October 2026. The key message: anonymisation is no longer something organisations can assume; it needs to be demonstrated, tested and reassessed. 📌 Read the full analysis: https://www.gamingtechlaw.com/2026/07/edpb-anonymisation-guidelines-ai/ Send us Fan Mail

The Digital Omnibus has postponed the obligations on high-risk AI systems, but it has not modified the general date of application of the AI Act. As a consequence, as of the 2nd of August 2026, the enforcement powers on general purpose AI models, the transparency obligations under Article 50 and the entire sanctioning framework become fully enforceable.  In this episode of Diritto al Digitale, Giulio Coraggio, technology and data lawyer, reviews what is actually applicable as of today, the operational implications of the requalification from deployer into provider, what Regulation (EU) 2026/1744 has postponed to December 2027 and August 2028, and why the actual obstacle to compliance is not the legal text, but the absence of an allocated accountability. With a concrete five-point board paper for in-house legal functions. Send us Fan Mail

As of 19 June 2026, withdrawing from a contract concluded online should become as simple as signing up for it. In this episode, journalist Antonio Ravenna interviews Federico Toscani of DLA Piper to unpack the new Article 54-bis of the Italian Consumer Code (Legislative Decree 206/2005), introduced by Legislative Decree 209/2025. At the heart of the conversation is a new obligation for businesses selling at a distance: they must provide a clear, visible, and easily accessible digital withdrawal function — effectively a "withdrawal button" placed on the same online interface used to enter into the contract. Over the course of the interview, Federico Toscani and Antonio Ravenna discuss: 1. the rationale behind the rule, and why it exists to rebalance the ease of purchase against the difficulty of cancelling; 2. what the withdrawal function must actually include (button wording, the withdrawal declaration, and the details identifying the consumer and the contract); 3. the confirmation step and the acknowledgment of receipt sent on a durable medium; 4. the moment at which withdrawal is deemed validly exercised in relation to the statutory deadline (paragraph 7); 5. what companies should do right now to bring their websites, apps, and customer journeys into compliance and avoid disputes. A valuable episode for e-commerce operators, legal departments, compliance teams, and anyone working in the digital market who wants to align their withdrawal process with the transparency and accessibility standards required under the new regime. Send us Fan Mail

In this episode of Legal Break, Giulio Coraggio, location head of the Italian Intellectual Property & Technology Law group at the law firm DLA Piper and the journalist Antonio Ravenna explain an important Italian court decision about DPO liability, GDPR, and cyber fraud. A company lost €390,000 in a Business Email Compromise (BEC) attack: criminals sent fake payment instructions and the money went to the wrong bank account. The company tried to blame its external DPO, but the Court of Florence (Decision No. 3034 of 29 May 2026) said no. Giulio and Antonio explain, in clear and simple words, why the DPO’s job under the GDPR is to advise and monitor, not to make security decisions, and why the duty to put real security measures in place stays with the company. They also share practical lessons: why good documentation is the DPO’s best defense, why ignoring the DPO’s advice can create liability for the company, and why naming a DPO is not a replacement for real cybersecurity.  Send us Fan Mail

Is your organization truly ready for NIS 2? Italy transposed the NIS 2 Directive through Legislative Decree 138/2024 — but implementation is complex, obligations are strict, and the criticalities are real. In this episode of The Legal Break, Giulio Coraggio and the journalist Antonio Ravenna give a clear, practical breakdown of what NIS 2 means for companies operating in Italy today. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 📌 KEY TOPICS COVERED ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ✔ NIS 2 Directive (EU 2022/2555) — what changed vs. NIS 1 ✔ Italian transposition via Legislative Decree 138/2024 ✔ 18 sectors in scope, including 11 "highly critical" sectors ✔ Essential vs. important entities: how to determine your category ✔ Registration obligations with ACN (Agenzia per la Cybersicurezza Nazionale) ✔ Technical and organizational security measures ✔ Incident notification timelines and requirements ✔ Supply chain and third-party vendor risk ✔ Management body accountability and personal liability ✔ Sanctions up to 0.1% of global turnover for essential entities ✔ Remaining open questions and compliance roadmap ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 👥 SPEAKERS ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🔹 Giulio Coraggio    LinkedIn:   / giulio-coraggio     Blog: https://www.gamingtechlaw.com 🔹 Antonio Ravenna — Legal Journalist ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🔗 USEFUL RESOURCES ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 📄 D.Lgs. 138/2024 (Official text): https://www.normattiva.it 🌐 ACN – Agenzia per la Cybersicurezza Nazionale: https://www.acn.gov.it 🌐 DLA Piper Technology & Data practice: https://www.dlapiper.com ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🎙️ ABOUT THE LEGAL BREAK ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ The Legal Break is DLA Piper's podcast series where legal experts decode the most relevant regulatory and legal developments for business — clearly, concisely, and without the jargon. 🔔 Subscribe so you never miss an episode. 👍 Like this video if you found it useful. 💬 Have a question about NIS 2 compliance? Drop it in the comments. Send us Fan Mail

Italy just became the first EU country to pass a comprehensive national AI law — and the real game-changer is what comes next. In the time it takes to finish your coffee, Giulio Coraggio and journalist Antonio Ravenna break down how Italy's Law No. 132/2025 plugs into the EU AI Act, and why the upcoming implementing decrees could reshape compliance for anyone building or deploying AI in Italy. No 40-page memos. No jargon. Just the essentials — in one coffee break. ☕ In this episode:  🇮🇹 Why Italy moved first in Europe — and what Law No. 132/2025 actually changes  ⚖️ How the Italian framework is designed to sit inside the EU AI Act (not on top of it)  📜 The implementing decrees coming by October 2026 — and what they'll cover  🏥 Sector hotspots: healthcare, employment, professional services, justice & deepfakes  🚨 The compliance traps companies need to watch now Whether you're in-house counsel, a compliance lead, or a founder shipping AI products, this is the short briefing you didn't know you needed. 🎧 Follow The Legal Break wherever you listen — new episodes unpack the legal topics that matter, one coffee at a time.  💬 Got a topic you want us to cover? Let us know.  ⭐ Enjoying the show? Leave a rating and review — it helps more listeners find us. Send us Fan Mail

The European Union is already revisiting the AI Act before many companies have even completed their first compliance assessments. In this episode, Giulio Coraggio and Antonio Ravenna discuss the impact of the changes introduced by the EU Digital Omnibus package and what businesses should expect next from the evolving European AI regulatory framework. The conversation explores: • why the European Commission proposed changes to the AI Act • the simplification measures affecting high-risk AI systems • the relationship between the AI Act and machinery legislation • the new timelines and delegated acts expected from the Commission • whether the reforms will simplify compliance or increase uncertainty • what companies should do now to prepare for AI governance obligations Giulio Coraggio is a technology and data lawyer at the global law firm DLA Piper, where he focuses on artificial intelligence, privacy, cybersecurity, digital regulation, and technology transactions. He regularly advises international companies on AI governance and compliance strategies. Antonio Ravenna is a journalist focused on artificial intelligence, innovation, and digital transformation, regularly covering the evolution of AI regulation and its impact on businesses and society. As AI becomes embedded in everyday business operations, AI governance can no longer be postponed. The regulatory framework may evolve, but the need for responsible AI management remains critical. Subscribe for more insights on artificial intelligence regulation, privacy, cybersecurity, technology law, and digital innovation. Send us Fan Mail

The European Union has agreed on major changes to the AI Act to reduce overlap with machinery, product safety, and sector-specific regulation. But is this just simplification — or the beginning of a broader rethink of AI regulation in Europe? In this episode of Diritto al Digitale, Giulio Coraggio, technology and data lawyer, analyzes the latest AI Act amendments, the delay of high-risk AI obligations, the impact on industrial AI, medical devices, robotics, and what companies must do now to prepare for AI compliance, cybersecurity, and governance challenges. Send us Fan Mail

Why are 82% of companies investing in artificial intelligence, yet 81% fail to generate real business value? In this episode of Diritto al Digitale, hosted by Giulio Coraggio, technology and data lawyerr, we explore the growing AI value gap and its profound legal and strategic implications for businesses. The episode provides a detailed legal analysis of why artificial intelligence initiatives often remain isolated and fail to scale, focusing on critical issues such as AI governance, AI Act compliance, and GDPR risks. It explains why treating AI as a simple technological tool—rather than a regulated system—creates both missed opportunities and significant exposure to liability. We also examine the implications of high-risk AI systems under the AI Act, the regulatory challenges posed by AI agents and autonomous decision-making, and how evolving legal frameworks are shaping the future of AI adoption in Europe and globally. A key focus is on governance: how companies can design structured AI governance models to enable scalability, ensure compliance, and turn AI into a true competitive advantage rather than a legal risk. This episode is designed for legal professionals, in-house counsel, compliance officers, and business leaders dealing with AI regulation, data protection, and digital transformation. Key topics include: AI value gap, AI governance frameworks, AI Act requirements, GDPR and automated decision-making, AI agents regulation, legal risk management, and scalable AI adoption. If you are advising on or implementing AI strategies, this episode will help you understand why the real challenge is not the technology itself—but how it is governed, structured, and legally managed. Send us Fan Mail

The global race to regulate artificial intelligence is accelerating—and companies can no longer afford to ignore it. In this episode of Diritto al Digitale, Giulio Coraggio, Technology and Data Lawyer, analyzes the growing divergence between the EU AI Act and the US AI Policy Framework, two competing models that are reshaping AI governance, compliance, and innovation strategies worldwide. The European Union is advancing a risk-based regulatory framework under the AI Act, reinforced by the latest developments of the Digital Omnibus package, introducing stricter obligations for high-risk AI systems, data governance, and compliance by design. At the same time, the United States is pursuing a more flexible, policy-driven approach based on soft law, voluntary standards, and ex post enforcement. What does this mean in practice for companies operating globally? This episode explores: - The latest updates on the EU AI Act and Digital Omnibus - The structure and impact of the US National AI Policy Framework - Key differences between ex ante compliance and ex post enforcement models - Legal, operational, and reputational risks for businesses using AI - Why AI governance is no longer optional for organizations If your business is developing, deploying, or integrating artificial intelligence, understanding these regulatory dynamics is critical to managing risk and staying competitive. Listen now to gain practical insights into AI regulation, compliance strategies, and the future of global AI governance. Send us Fan Mail

Artificial intelligence, semiconductors, satellites, robotics. Most people see them as civilian technologies powering the digital economy. But many of these innovations also have a military dimension. They are what regulators call dual-use technologies — technologies that can serve both civilian and defence purposes. As geopolitical tensions rise and global defence spending reaches record levels, these technologies are becoming strategic assets for governments and industry. And this shift is triggering a rapid expansion of European regulation, from export controls to foreign investment screening, sanctions regimes and industrial policy initiatives such as the European Defence Fund and the EU Chips Act. In this episode of Diritto al Digitale, Giulio Coraggio explores: what qualifies as a dual-use technologythe EU legal frameworks governing these technologieswhy companies developing AI, chips, robotics and aerospace technologies are increasingly affected by defence regulationthe industrial opportunities for European and Italian companies in this rapidly evolving sectorand the growing intersection between technology, law and geopoliticsIf you work in technology law, compliance, defence, AI, semiconductors or export control, this is a conversation you cannot afford to miss. Because the future of innovation in Europe will increasingly depend on technologies that are both civilian and military at the same time. Send us Fan Mail