AI-driven disinformation and IoT weaknesses: operational cyber management, legal compliance and resilience strategies

This presentation examines the intersection between AI-driven disinformation campaigns and cyber vulnerabilities in IoT-enabled environments and proposes an integrated operational and regulatory framework for resilient legal protection. Recent EU instruments impose stronger obligations on organisational prudent conduct and on delivery of goods and services that create systemic digital risk: the NIS2 framework raises management accountability and requires formalised cyber risk assessments and governance. The Digital Operational Resilience Act mandates ICT risk-management and resilience testing for financial actors. At the same time, the Cyber Resilience Act sets horizontal security requirements for products with digital elements, including IoT devices. Simultaneously, the Digital Services Act increases platform responsibilities to mitigate systemic risks such as misinformation. Against this regulatory backdrop, the doctrine analyses three vectors by which automated content generation, adversarial machine-learning techniques and compromised IoT endpoints are combined to magnify information sabotage and data exfiltration. Using two short case studies that illustrate (i) coordinated deepfake-driven manipulation amplified via compromised IoT endpoints, and (ii) supply-chain exploitation of edge devices to bypass detection, our research illustrates and assesses gaps in current operational practices and regulatory implementation. We conclude by proposing an actionable set of governance measures, including elevating cybersecurity to board-level oversight, designating and empowering a CISO function with clear reporting duties, integrating adversarial testing into security assurance for AI systems and IoT products, and harmonising incident reporting and platform mitigation playbooks with legal obligations. This approach aims to bridge technical controls, organisational accountability and regulatory compliance to reduce the tactical effectiveness of information sabotage, while preserving legitimate digital services. References to recent EU regulatory developments and implementation guidance will be provided during the paper presentation.