Article by authors from the Institute of IT Law and IP Law published in the prestigious European Journal of Risk Regulation
October 29, 2025
An article entitled “Rethinking Cybersecurity Research Governance: Lessons from the Act on Digital Services?” has been published in the prestigious scientific journal European Journal of Risk Regulation, issued by Cambridge University Press.
The authors of the article are Michal Rampášek and doc. JUDr. Matúš Mesarčík, PhD., LL.M., both affiliated with the Institute of Information Technology Law and Intellectual Property Law at the Faculty of Law, Comenius University in Bratislava.
In the article, the authors examine the legal status and role of cybersecurity researchers in the context of the current European Union regulatory framework. Particular attention is paid to the Digital Services Act, the Cyber Resilience Act and the NIS2 Directive. The article focuses especially on the legal uncertainty surrounding the status of cybersecurity researchers, the conditions for data access and auditing under the DSA, as well as the limits of the so-called vetted researcher model.
The publication highlights the need for a more systematic and sustainable legal framework for cybersecurity research in the EU. The authors argue that although the DSA introduces new instruments of external oversight over very large online platforms, cybersecurity research also requires consideration of more flexible mechanisms, particularly coordinated vulnerability disclosure and bug bounty programmes.
Link to the article:
https://doi.org/10.1017/err.2025.10060