Obblighi di cybersecurity tra NIS2 e tutela del consumatore

The article examines the transformation of cybersecurity into a structural principle of European digital private law through the interaction between the NIS2 Directive, consumer protection, and the AI Act. It argues that digital resilience increasingly operates as a legally enforceable organizational duty, shaping standards of professional diligence, governance, and liability. In this perspective, cybersecurity compliance becomes both a parameter for assessing organizational conduct and a foundation for consumer protection in digital markets. The paper further explores how failures in security-by-design and governance-by-design may generate forms of «vulnerability by design», exposing consumers to technical, informational, and decisional risks. Ultimately, the study highlights the emergence of an integrated European framework in which cybersecurity, AI governance, and consumer law converge to safeguard trust, autonomy, and reliability in digitally mediated markets.