Skip to content
report parliamentary committee draft

DRAFT REPORT on the proposal for a regulation of the European Parliament and of the Council on the European Union Agency for Cybersecurity (ENISA), the European cybersecurity certification framework, and ICT supply chain security and repealing Regulation (EU) 2019/881 (The Cybersecurity Act 2)

ITRE-PR-792222

Official HTML ↗
✦ In short · AI summary of this text, generated 25 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

This is the rapporteur's draft report on the proposed Cybersecurity Act 2, which would replace Regulation (EU) 2019/881, broaden ENISA's mandate, reform European cybersecurity certification and set Union rules on ICT supply chain security. It proposes a single entry point for incident reporting, an early alert service that reaches national CSIRTs first, and a free Union ransomware helpdesk in all official languages. It would make European cybersecurity certification mandatory unless Union law expressly provides otherwise, with deadlines for certifying entities' cyber posture and for certified ICT components in key assets. It would identify high-risk suppliers through an evaluation matrix, ban them from key ICT assets, phase out their components from mobile networks within 24 months, and set minimum and maximum penalties.

Committee position. The rapporteur welcomes the Commission proposal and supports its three objectives, proposing amendments to make certification mandatory by default, to identify high-risk suppliers through an evidence-based evaluation matrix, and to shorten phase-out periods.

Key points

  1. A new Article 15a would create a single entry point for incident reporting, so one submission fulfils reporting duties under several Union acts, with national authorities and CSIRTs as sole addressees.
  2. Early alerts would go to the CSIRTs concerned before or at the same time as to entities, under a procedure agreed with the CSIRTs network and reviewed every two years.
  3. ENISA would run a free, uniform ransomware helpdesk in all official languages, offering triage, decryption tools, guidance and referral, and reporting annually to Parliament and the Council.
  4. At least 60% of the EU Cybersecurity Reserve's pre-committed capacity would be procured from providers established in the Union and not controlled by a third country.
  5. European cybersecurity certification would become mandatory unless Union law expressly provides otherwise, and certificates at 'substantial' or 'high' level would confer a presumption of conformity with named Union acts.
  6. Entities in Annex I to Directive (EU) 2022/2555 would have to certify their cyber posture within 12 months of a scheme's availability, and key ICT assets would need certified components within 36 months.
  7. These certification duties would start only after the Commission confirms sufficient conformity assessment capacity; SMEs get an extra 12 months and reduced fees.
  8. Member States could not add national certification or conformity assessment for products, services or processes already holding a valid European certificate covering the same subject matter.
  9. ENISA could draft technical specifications only where no harmonised standard exists or a standardisation request has failed, and they would cease to apply once a standard is cited.
  10. The Commission would identify high-risk suppliers using an evaluation matrix in a new annex, based on specific and substantiated evidence, with the right to be heard and judicial remedies.
  11. High-risk suppliers would be banned from key ICT assets, including remote access, and their components phased out of mobile networks within 24 months and fixed and satellite networks within 24 months after a risk assessment.
  12. Penalties would have minimum as well as maximum levels, up to 7% of worldwide annual turnover, plus periodic penalty payments of up to 5% of average daily turnover for continued non-compliance.

Who is affected

  • ENISA gains new tasks, including the single entry point, early alerts, the ransomware helpdesk and certification support, with resources to match.
  • Entities in sectors listed in Annexes I and II to Directive (EU) 2022/2555 face mandatory certification and procurement rules for certified ICT products.
  • Small and medium-sized enterprises get an extra 12 months for certification, reduced fees and free entry-level profiles.
  • Suppliers of ICT components face assessment, listing as high-risk and bans, with rights to be heard and to judicial remedies.
  • Grid operators may be empowered to disconnect installations that do not meet mitigating measures for high-risk components.

Figures and deadlines

  • At least 60% of the EU Cybersecurity Reserve's pre-committed capacity must come from Union-established providers.
  • Certification of cyber posture at 'substantial' level within 12 months of scheme availability, and at 'high' level within 12 months for critical sectors.
  • Certified ICT components in key ICT assets within 36 months of scheme availability.
  • SMEs get an additional 12 months for certification obligations.
  • Candidate certification schemes to be prepared within 24 months of a Commission request, extendable once by no more than 6 months.
  • Phase-out of high-risk supplier components from mobile networks within 24 months, extendable by no more than 12 months.
  • Phase-out for fixed and satellite networks not to exceed 24 months from publication of the relevant high-risk supplier list.
  • Penalties up to 7% of worldwide annual turnover, with minimum 2% or EUR 10 000 000, and periodic payments up to 5% of average daily turnover.

Legal basis: Article 294(2) and Article 114 of the Treaty on the Functioning of the European Union.