Israeli Tech Firms Navigate Strict EU Cyber Laws and US Privacy Shifts

Israeli technology companies are facing increasingly complex international regulatory demands, spanning from stringent European cybersecurity mandates to sweeping privacy litigation in the United States. While local firms adapt to the enforcement powers and heavy fines introduced by Amendment 13 to Israel's Privacy Protection Law, the global arena presents compliance challenges that are just as demanding.

Enforcement within the European Union regarding extensive reporting obligations is governed by the Cyber Resilience Act (CRA). According to the legislation, any manufacturer of products with digital components marketed within the EU must report security incidents to cybersecurity authorities initially within 24 hours of discovering a vulnerability, regardless of the company's geographic location.

This means that Israeli companies falling into this category are legally bound by these strict timelines. Within 72 hours, the company must submit a more detailed notification to authorities, followed by a final report within two weeks for actively exploited vulnerabilities or within a month for severe security incidents. These obligations apply to manufacturers of products with digital components marketed in the EU single market, including mobile applications, internet services, hardware components, and integrated hardware-software products.

"An Additional Layer of Legislation"

Adv. Dotan Hammer, partner and head of the international privacy practice at Pearl Cohen, explains that the objective is to strengthen the cybersecurity of digital products marketed in the EU, enabling authorities and users to receive rapid alerts regarding tangible risks. "Unlike reporting obligations concerning personal data breaches, the obligations under the Cyber Resilience Act are not triggered by the presence of personal data, but by the mere existence of an exploited vulnerability or a severe security incident," Hammer notes.

Adv. Idan Zur, head of international AI and data at Dan Chai & Co., highlights that this is part of a much broader legislative trend emanating from Brussels. "This is an additional layer in the wave of European regulation seen in recent years, from the GDPR to the DSA and the DMA, characterized by a distinct and exceptionally broad extra-territorial reach," Zur explains.

Relief in California

On the other side of the Atlantic, California remains a primary destination for Israeli high-tech startups. However, hundreds of Israeli-founded companies operating in the state have recently found themselves under severe legal attack due to California's Invasion of Privacy Act (CIPA). Originally enacted to prevent wiretapping, the statute has been weaponized by private plaintiffs filing mass lawsuits against websites simply for utilizing standard tracking pixels and analytics tools.

Recently, however, California lawmakers approved a legislative amendment eliminating the private right of action, restricting enforcement authority exclusively to the state Attorney General. Governor Gavin Newsom signed the legislation, which is set to take effect on January 1, 2027, offering significant relief to foreign and domestic tech companies alike.