ItalySanctions under the EU cybersecurity certification framework
Art. 10, Decreto legislativo 3 agosto 2022, n. 123
In force since .
A product security requirements rule binding public and private bodies.
- Obligation class
- Security, Reporting, Governance
What it requires
- If you take part in the EU cybersecurity certification scheme as a manufacturer or supplier of an ICT product, ICT service, ICT process or managed security service, as a holder of a European cybersecurity certificate, as a conformity assessment body or as an applicant for certification, Article 10 sanctions your breaches of the certification framework; joining the scheme is voluntary unless Union or national law says otherwise (Legislative Decree 123/2022, Article 6, paragraph 3 and Article 10).
- Do not issue an EU declaration of conformity that does not conform, and revise or revoke a non-conforming declaration within thirty days of the Agency's finding, telling the Agency and ENISA (Article 7, paragraph 3 and Article 10, paragraph 3).
- Where an EU declaration of conformity or a cybersecurity certificate is mandatory, do not make an ICT product, ICT service or managed security service available on the market without it (Article 10, paragraph 4).
- If you hold a European cybersecurity certificate, notify the vulnerabilities or irregularities you find in the certified products or services, as Article 56, paragraph 8 of Regulation (EU) 2019/881 requires (Article 10, paragraph 8).
- Do not give false data or leave out information needed for certification (Article 10, paragraph 12).
These lines are LexLint's reading of the law's text.
If you get it wrong
Private right of actionNo
Penalty structure
Article 10, paragraph 16 states that the maximum of 5,000,000 euro for the sanction holds even where the minimum and maximum values of the fines in paragraphs 2 to 15 are tripled. Under paragraph 15, a person with a turnover of at least 200,000,000 euro that does not comply with an Agency order or warning faces 0.3 to 1.5 per cent of turnover, within the same 5,000,000 euro maximum.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 5,000,000
Who enforces it
Enforcement body
The National Cybersecurity Agency (the Agency), which imposes the fines and accessory sanctions (Article 10, paragraph 1; Article 3, paragraph 1, letter h).
Settledness
- As of
What this law does
Joining the EU cybersecurity certification scheme is voluntary unless Union or national law says otherwise, and Article 10 of Legislative Decree 123/2022 sets the sanctions for breaching the obligations of the framework, which fall on those who take part in it: manufacturers and suppliers of ICT products, ICT services, ICT processes and managed security services, holders of European cybersecurity certificates, the conformity assessment bodies that issue them, and applicants for certification.
A conformity assessment body that issues a non-conforming cybersecurity certificate faces a fine of 15,000 to 75,000 euro, and so does a manufacturer or supplier that issues a non-conforming voluntary EU declaration of conformity.
Where an EU declaration of conformity or a cybersecurity certificate has been made mandatory, a manufacturer or supplier that makes an ICT product, ICT service or managed security service available on the market without it, or with a non-conforming declaration, faces a fine of 30,000 to 150,000 euro.
In those cases the National Cybersecurity Agency, which the decree calls the Agency, orders the product withdrawn or the service stopped at the manufacturer's or supplier's expense, and a manufacturer that does not recall a withdrawn product faces a fine of 60,000 to 300,000 euro. A holder of a European cybersecurity certificate that does not notify the vulnerabilities or irregularities it finds in the certified products or services faces a fine of 60,000 to 300,000 euro.
An applicant for certification who knowingly supplies false data, information or documents, or leaves out information needed for the certification, faces a fine of 90,000 to 450,000 euro. A conformity assessment body that operates without the Agency's authorization faces a fine of 120,000 to 600,000 euro, and a person that does not comply with an Agency order or warning faces a fine of 200,000 to 1,000,000 euro.
Where the order or warning concerns a person with a turnover of at least 200,000,000 euro, the fine is 0.3 to 1.5 per cent of turnover, within the 5,000,000 euro maximum. The fines in paragraphs 2 to 15 of Article 10 are tripled, within a ceiling of 5,000,000 euro, where the violation concerns a certificate issued under a scheme intended for use with a service provided by an essential entity under Legislative Decree 138/2024.
Legislative Decree 191/2026, in force from , amended Article 10 to extend it to managed security services.
When LexLint raises it
When your app profile says your app distributes a software product.
Back to the example · Lint your app
Page updated .