Why Cybersecurity Needs the Law, Not Just Better Technology

Expert insight by Dr Pavel Loutocký
| Masaryk University, Czechia

Cybersecurity is often treated as a purely technical challenge. Organisations invest in stronger systems, better software and more sophisticated tools to protect their networks and information.

But technology alone cannot solve every cybersecurity problem. Even the most advanced security measures operate within a wider environment of legal responsibilities, regulatory obligations and cross-border relationships.

As Dr Pavel Loutocký explains, cybersecurity law is sometimes perceived as unnecessary bureaucracy. In reality, effective regulation can help establish trust, encourage greater accountability and make the digital environment safer for everyone.

Why the Market Alone Cannot Guarantee Security

Consider the number of connected devices used in everyday life and business operations. Home routers, security cameras, smart devices and industrial control systems can all introduce vulnerabilities.

Some products are sold with weak default passwords, limited update options or security weaknesses that manufacturers never fully address.

Attackers can exploit these weaknesses to disrupt websites, spread malicious software or gain access to corporate networks.

Often, the consequences extend well beyond the owner of the compromised device. Businesses may experience service disruptions, sensitive information may be exposed and other organisations may become targets.

These rules can also benefit responsible manufacturers by creating clearer expectations and more consistent standards across the European market.

Why Transparency Matters in Cybersecurity

For many years, organisations experiencing cybersecurity incidents had limited incentives to share information about what had happened.

Today, European regulatory frameworks place greater emphasis on incident notification, information sharing and accountability.

The General Data Protection Regulation (GDPR) introduced obligations concerning the reporting of certain personal data breaches. The NIS2 Directive strengthened incident reporting requirements for important and critical sectors, while the Cyber Resilience Act establishes additional obligations for manufacturers of products with digital elements.

These measures are not simply about regulatory compliance. Information about incidents and vulnerabilities can help other organisations identify similar threats before they become victims.

Greater transparency also gives organisations a stronger incentive to invest in prevention, prepare for incidents and demonstrate responsible security management.

Cybercrime, Data Sovereignty and Cross-Border Evidence

Cybersecurity law is not limited to the obligations placed on businesses. It also plays an important role in enabling the investigation and prosecution of cybercrime.

Digital evidence frequently crosses national borders. An investigation taking place in one EU Member State may involve data stored in another country or managed by an international service provider.

This raises important questions about jurisdiction, access to information, data protection and the procedures authorities must follow.

European rules concerning electronic evidence are designed to improve cooperation and establish clearer procedures for requesting and obtaining information relevant to criminal investigations.

At the same time, safeguards remain essential. Organisations and authorities must understand what information may be requested, who can authorise access and how electronic evidence should be handled to preserve its integrity.

Emerging Challenges: AI and Digital Identity

As digital technologies evolve, cybersecurity law must address new challenges relating to artificial intelligence, electronic identity and the management of digital information.

AI systems raise questions about responsibility, transparency and the appropriate handling of data. Electronic identity and digital documentation introduce additional considerations around trust, authentication and legal recognition.

Understanding the interaction between these technologies and existing regulatory frameworks is increasingly valuable for cybersecurity, legal and compliance professionals.

Good Rules Need People Who Understand Them

Regulation is not automatically effective simply because it exists. Poorly designed or poorly understood requirements can create administrative work without delivering meaningful security improvements.

What organisations need are professionals who understand both the technical and legal dimensions of cybersecurity.

A Chief Information Security Officer who understands the purpose of a regulation can translate its requirements into practical security measures. Equally, a legal or compliance professional with technical knowledge is better equipped to recognise whether an organisation’s policies address the risks it actually faces.

If the answers are unclear, addressing these questions proactively with cybersecurity, legal and compliance colleagues can help strengthen organisational readiness.