Cyber Law Gaps Shift Liability to Critical Infrastructure

International cyber law is advancing institutionally, but its enforcement limits are leaving private critical infrastructure operators with a growing share of the practical burden. As governments continue negotiating cyber norms and cooperation mechanisms, domestic regulators are moving faster on incident reporting and product-security obligations. The result is a widening gap between diplomatic progress and the day-to-day risk carried by infrastructure operators, manufacturers, and supply-chain firms.

The International Cyber Law Enforcement Gap

Multilateral cyber governance is moving forward, but the current framework remains centered on state cooperation rather than direct protection for private operators. On December 24, 2024, the UN General Assembly adopted Resolution 79/243, establishing the United Nations Convention Against Cybercrime, which remains open for state signatures and ratifications through December 31, 2026 (UNODC).

The UN Open-ended Working Group on ICTs also adopted its consensus final report (A/AC.292/2025/L.1), concluding its mandate and transitioning to a permanent UN Global Mechanism on cybersecurity (UN Digital Library).

These steps matter because they preserve diplomatic channels and formalize cooperation. They do not, however, create an immediate operational shield for companies facing state-linked intrusions, nor do they resolve the practical question of who absorbs losses when deterrence fails.

State-Sponsored Pre-Positioning in Critical Infrastructure

CISA identifies Chinese state-sponsored cyber actors, including Volt Typhoon and Salt Typhoon, as threats to U.S. critical infrastructure. Its threat materials describe the use of living-off-the-land (LOTL) techniques and activity affecting sectors including energy, water, transportation, and communications (CISA).

That matters for operators because LOTL activity can blend into legitimate administrative behavior, making detection and attribution harder than conventional malware-driven attacks. When a campaign is difficult to see, difficult to attribute, and difficult to deter through international mechanisms, the practical burden shifts toward the entity running the network.

This is the same burden-shifting pattern seen in physical supply chains: as Export Controls Shift Critical Mineral Risk to Midstream showed, policy pressure often lands most heavily on companies positioned between geopolitical conflict and end-market demand.

Domestic Regulation Becomes the Enforcement Channel

In the absence of stronger international deterrence, domestic regulators are turning cyber risk into reporting and resilience obligations. In the United States, CISA’s CIRCIA framework requires covered critical infrastructure entities to report covered cyber incidents within 72 hours of reasonable belief and ransom payments within 24 hours (CISA).

In Europe, the Cyber Resilience Act (Regulation (EU) 2024/2847) entered into force in December 2024. The European Commission states that Article 14 reporting obligations will apply from September 11, 2026 (European Commission).

The policy direction is clear: regulators are not waiting for international law to solve state-linked cyber activity. They are requiring affected entities and covered product manufacturers to disclose, document, and manage cyber incidents on fixed timelines.

Insurance Exclusions Increase Retained Risk

At the same time, insurance may not fully absorb the losses that follow state-linked cyber incidents. The Lloyd’s Market Association cyber war underwriting framework sets out clauses addressing losses connected to war, state-backed cyber operations, and significant impairment or failure of critical national infrastructure (Lloyd’s Market Association).

The financial tension is straightforward. A company may face regulatory reporting obligations after a serious cyber incident while also confronting policy language that limits or excludes coverage for state-backed cyber operations. That does not mean every policy will respond the same way, but it does mean operators cannot assume that commercial cyber insurance fully transfers the risk of state-linked disruption.

What Remains Unclear

Several important questions remain unresolved. It is still unclear how aggressively regulators will enforce reporting failures when an intrusion relies on stealthy LOTL techniques. It is also unclear how exclusions tied to state-backed cyber activity will affect capital costs, premiums, deductibles, and retained risk across different infrastructure sectors.

The available evidence supports a cautious conclusion: the burden is shifting, but the full financial scale of that shift is not yet quantified in official macroeconomic data.

Next Watchpoints for Infrastructure Operators

The key European deadline is September 11, 2026, when Article 14 reporting obligations under the Cyber Resilience Act apply. In the United States, operators should continue tracking CISA’s CIRCIA implementation and enforcement posture, especially around the 72-hour incident-reporting requirement and 24-hour ransom-payment reporting requirement.

For critical infrastructure operators, the strategic issue is no longer only whether a state-linked cyber campaign can be prevented. It is whether the organization can detect it, report it, document it, and finance the consequences when international enforcement offers limited practical relief.

Related Analysis

Disclaimer: This article is for informational purposes only and does not constitute financial, legal, or tax advice. This article was researched and drafted with AI assistance. Readers should consult licensed professionals regarding regulatory compliance and insurance underwriting risks.