Implementing Regulation (EU) 2024/2690

Commission Implementing Regulation (EU) 2024/2690 of October 17, 2024, published in the Official Journal on October 18, covers the digital providers that Directive (EU) 2022/2555 watches closely. They are DNS (Domain Name System) services, top-level domain registries, cloud computing, data centers, content delivery networks, managed service and managed security service providers, online marketplaces, search engines, social networks and trust services. It spells out the technical requirements for risk-management measures and, most relevant to insurance, when an incident becomes significant. Article 3 sets general criteria, any one of which is enough. The first is a direct financial loss above €500,000 or 5% of total annual turnover in the preceding financial year, whichever is lower. Next come exfiltration of trade secrets as defined in Directive (EU) 2016/943 and the death of a natural person; further criteria cover considerable damage to a natural person's health and a successful, suspectedly malicious and unauthorized access capable of causing severe operational disruption. Article 4 aggregates recurring incidents: at least two within six months, the same apparent root cause, and together above the financial threshold. Then come the sector thresholds. For cloud, Article 7 counts a service completely unavailable for more than 30 minutes, or availability limited for more than 5% of users in the Union or more than one million of them, whichever is smaller, for more than one hour. For the underwriter, these thresholds are low by policy standards. Thirty minutes of downtime at a cloud provider makes a significant incident, while its customers' contingent business interruption cover often starts only after several hours. The regulatory record will therefore document outages the market does not pay for, and that is accumulation data the models never had. One caveat: the €500,000 threshold is measured at the provider, and its customers' aggregated losses sit outside that count.