Tough new European Union regulations requiring banks to bolster their cybersecurity systems officially come into effect Friday — but many of the bloc’s financial services firms aren’t yet in full compliance with the rules.
The EU’s Digital Operational Resilience Act, or DORA, requires both financial services firms and their technology suppliers to strengthen their IT systems to ensure the industry is resilient in the event of a cyberattack or any other forms of disruption. It entered into effect on Jan. 17.
The penalties for breaches of the new legislation can be substantial. Financial services firms that fall foul of the new rules can face fines of up to 2% of annual global revenue. Individual managers could also be held liable for breaches and face sanctions of as much as 1 million euros ($1 million).
So far, the rate of compliance among financial services firms with the new rules has been mixed, according to Harvey Jang, chief privacy officer and deputy general counsel at IT giant Cisco.
“I think we’ve seen a mixed bag,” Jang told CNBC in an interview. “Of course, the more mature-stage companies are further along looking at this for at least a year — if not longer.”
“We’re really trying to build this compliance program, but it’s so complex. I think that’s the challenge. We saw this too with GDPR and other broad legislation that is subject to interpretation — what does it actually mean to comply? It means different things to different people,” he said.
This lack of a common understanding of what qualifies as robust compliance with DORA has in turn led many institutions to ramp up security standards to the level that they’re actually surpassing the “baseline” of what’s expected of most firms, Jang added.
Are financial institutions ready?
Under DORA, financial firms will be required to undertake rigorous IT risk and incident management, classification and reporting, operational resilience testing, intelligence sharing on cyber threats and vulnerabilities, and measures to manage third-party risks.
Firms will be also be required to conduct assessments of “concentration risk” related to the outsourcing of critical or important operational functions to external companies.
That’s a concern because, even though the U.K. falls outside the European Union now, DORA applies to all financial entities operating within EU jurisdictions — even if they’re based outside the bloc.
“Whilst it is clear that DORA has no legal reach in the U.K., entities based here and operating or providing services to entities in the EU will be subject to the regulation,” Richard Lindsay, principal advisory consultant at Orange Cyberdefense, told CNBC.
He added that the main challenge for many financial institutions when it comes to achieving DORA compliance has been managing their critical third-party IT providers.
“Financial institutions operate within a multi-layered and hugely complex digital ecosystem,” Lindsay said. “Tracking and ensuring that all parts of this system evidentially comply with the relevant elements of DORA will require a new mindset, solutions and resources.”
Banks are also adding higher levels of scrutiny in their contract negotiations with tech suppliers due to DORA’s strict requirements, Jang said.
The Cisco chief privacy officer told CNBC that he thinks there is alignment when it comes to the principles and the spirit of the law. However, he added, “any legislation is a product of compromise and so, as they get more prescriptive, then it becomes challenging.”
“The principles we agree with, but any legislation is a product of compromise, and so as as they get more prescriptive, then it becomes challenging.”
Still, despite the challenges, the broad expectation among experts is that it won’t be long until banks and other financial institutions achieve compliance.
“Banks in Europe already comply with significant regulations which cover the majority of the areas that fall under DORA,” Fabio Colombo, EMEA financial services security lead at Accenture, told CNBC.
“As a result, financial services institutions already have mature governance and compliance capabilities in place, with existing incident reporting processes and solid ICT risk frameworks.”
Risks for IT suppliers
IT providers can also be fined under DORA. The rules threaten levies of as much as 1% of average daily worldwide revenue for up to six months.
“These sanctions are necessary,” Brian Fox, chief technology officer of software supply chain management firm Sonatype, told CNBC. “They are a powerful motivator, pushing leaders to take compliance and operational resilience more seriously than ever.”
Orange Cyberdefense’s Lindsay said there’s a risk longer term that financial services firms end up moving their critical security functions and services in-house.
“Advances in technology may allow financial institutions to move services back in-house, simplifying this aspect and reducing the risk of non-compliance,” he said.
“Either way, existing contracts will need to be updated to ensure compliance is contractually mandated and monitored between entity and provider,” Lindsay added.
“As with any new regulation, there will certainly be a transitionary period as organisations adjust to new requirements and standards,” Sonatype’s Fox told CNBC. “This is the start of a long journey toward improving software security and resilience.”
Rivian made a name for itself when it unveiled one of the first electric pickup trucks, the R1T, in 2018. It followed that up with an SUV built off the same platform, the R1S, and has since built a passionate fan base around a brand that celebrates adventure and the outdoors.
Now it’s preparing for its next chapter with the R2, a smaller spin on the R1S SUV, and the R3, a rally-inspired hatchback.
“A lot of people were surprised on R3” Rivian Chief Design Officer Jeff Hammoud told CNBC. “It’s not something that I think a lot of people would have guessed that Rivian would have done … and that was the key thing we were trying to show, we’re not pigeonholed to one form factor.”
The new vehicles, which were unveiled in March of last year, are part of Rivian’s strategy to reach a broader market for its electric vehicles, which currently start upwards of $70,000.
The R2, which the company says will start around $45,000, is expected to go into production by the end of this year at the company’s Normal, Illinois, manufacturing facility.
“While R1 was designed through addition, we had to look at R2 through subtraction,” Hammoud said. “What are the things we can remove or take away, but still keep the ethos of the product and the brand?”
The R2 and R3 are coming on the heels of a tough time for the automaker.
Weak demand, higher costs and the U.S. cancelling the EV credit could spell trouble for Rivian. But that hasn’t stopped the company from breaking ground on a new $5 billion factory in Georgia, where the next generation vehicles will be built.
“We’re first launching R2 at our facility in Illinois, but this is really the site where we’ll scale global production. We’re building this into a 400,000 unit plant,” Rivian CEO RJ Scaringe told CNBC’s Phil LeBeau at the plant’s construction site in September.
CNBC got rare access inside Rivian’s design lab in Irvine, California, to see how the company shapes its distinctive vehicles. We see how the EV maker approaches design for its adventure-driven EV lineup, which includes the backstory on how it conceived its iconic headlights, a choice that provoked mixed reactions when first unveiled.
“They were controversial,” recalls John Voelcker, contributing editor at Car and Driver. “It took a while for people to get over it. I think it was smart in that it’s harder to make your truck distinctive. So a front end that immediately is like no one else is probably a good thing.”
Watch the video to learn about Rivian’s approach to design and its plans to expand its brand of adventure-themed EVs.
Tesla announced a new version of its full self-driving supervised technology Tuesday morning, but investors are looking for something bigger.
Over the weekend, Elon Musk’s company shared a teaser clip featuring a logo-emblazoned, spinning component that could be anything from a wheel cover to a fan or turbine. The clip ended with the numbers “10/7,” indicating Tuesday’s date for the reveal.
Tesla posted a second clip to X on Sunday showing the outline of a vehicle’s headlights in the dark.
Shares climbed 5% Monday as the buzz grew online over what the announcement would be.
The big reveal could be the long-awaited lower-cost model, or the next-generation Roadster that Musk has promised for years.
Or something else.
The company hasn’t released a new model vehicle for sale since it began shipping the Cybertruck, its angular unpainted steel pickup, in late 2023.
Musk originally promoted the Cybertruck at an “unveiling” event in 2019, where his demo went awry and he shattered a window. The Cybertuck never achieved the level of popularity of Tesla’s Model 3 sedan or Model Y SUVs and has been the subject of at least eight voluntary recalls in the U.S.
Read more CNBC tech news
With its auto sales in a multi-quarter slump, Tesla has been trying to shift investor attention to its future as a robotics and self-driving car business.
The slump has resulted, in part, from a consumer backlash against Musk, his endorsements of far-right political parties and figures, and his incendiary political rhetoric. But it’s also due to an aging lineup and increased competition from companies including Volkswagen and BYD.
In mid-October of last year, Tesla held its invitation-only, “We, Robot” event in Hollywood, where it showed off a low, two-seater Cybercab concept with no steering wheels or pedals. Musk said the driverless car would cost about $30,000.
As of the company’s second-quarter earnings call, it was not yet in production.
At an event in late 2017, Musk promised Tesla would make a next-generation Roadster, but the vehicle has never moved into production. In 2021, Musk promised the Roadster would be able to “fly,” and last year he said the elusive sports car was being redesigned in collaboration with SpaceX, his aerospace and defense contractor.
Musk has been promising to turn existing Tesla EVs into robotaxis with a software update for about a decade.
The company currently has human safety drivers in its Robotaxi-branded test and fleet vehicles, unlike robotaxi rivals like Alphabet’s Waymo and Baidu’s Apollo Go.
In the realm of humanoid robots, Musk has said Tesla’s Optimus robots will be capable of factory work or babysitting your kids, but they’ve yet to hit the market. Meanwhile, competitors like Agility Robotics and Unitree are already selling bipedal, humanoid robots.
Following a brutal first quarter that saw Tesla lose 36% of its value, the stock has been on a tear, jumping 40% in the third quarter. It’s now up 12% for the year. That stock price increase was aided by Musk, who purchased about $1 billion of Tesla stock himself in mid-September.
The company said Tuesday that it’s acquiring Arduino, an electronics maker whose inexpensive programmable circuit boards and computers are common in hardware startups and robotics labs for prototyping.
Qualcomm didn’t announce a price for the transaction, but said the Italy-based company would become an independent subsidiary.
The deal gives Qualcomm direct access to the tinkerers, hobbyists and companies at the lowest levels of the robotics industry. Arduino products can’t be used to build commercial products but, with chips preinstalled, they’re popular for testing out a new idea or proving a concept.
Qualcomm hopes that Arduino can help it gain loyalty and legitimacy among startups and builders as robots and other devices increasingly need more powerful chips for artificial intelligence. When some of those experiments become products, Qualcomm wants to sell them its chips commercially.
“You start to move towards prototyping, proof of concepts, and once you’re ready, you can go commercial, which is something we are obviously very familiar with,” said Nakul Duggal, Qualcomm’s general manager for automotive, industrial, and embedded Internet of Things, or IoT, in an interview.
Qualcomm is also seeking to diversify its revenue away from a concentration in mobile chips and modems as the smartphone market stalls and as Apple starts to move to its own modem chips.
Still, in the most recent quarter, Qualcomm’s IoT business, which includes many of its current chips that can be used for industrial or robotics products, and its automotive business accounted for a combined 30% of overall revenue from chip sales.
To date, it’s been difficult for smaller developers to get access to Qualcomm chips because they typically get sold in large quantities to established enterprises. Rival Nvidia, however, has sold developer kits for its robot chips that can be directly purchased from retailers for as little as $249, and has said that robotics is the company’s biggest growth opportunity after AI.
Duggal said Qualcomm purchased two other companies in the past year, Foundries.io and Edge Impulse, in an effort to become more essential to robotics developers. He added that Qualcomm hopes to eventually help power humanoid robots, which are similar to self-driving cars in how much AI computing power they require.
Tuesday’s announcement said Arduino will, for the first time, release a board with a Qualcomm chip. It’s called the Uno Q and, priced at $45 to $55, comes equipped with a Qualcomm Dragonwing QRB2210 processor.
Qualcomm’s chip can run Linux, along with Arduino software, and can even do computer vision, which deciphers what a camera sees and translates it into software.
Current Arduino boards, which use lighter processors called microcontrollers, aren’t powerful enough to do a lot of cutting-edge AI. Those boards use chips from companies including STMicroelectronics, Renesas Electronics, Microchip and NXP Semiconductors. Qualcomm will continue to sell those chips through Arduino.
That’s part of Qualcomm’s plan to not make any significant changes to Arduino’s operations, management or its developer community.
“My success criteria is that the Arduino ecosystem doesn’t even feel that there is any change in ownership here,” Duggal said.