The European Cybersecurity Act adopted in 2019 established a permanent mandate for the European Union Agency for Cybersecurity (ENISA) and introduced a European cybersecurity certification framework to strengthen trust and resilience across the Union. Its implementation faced a fast-evolving cybersecurity landscape since the Act’s adoption, marked by a 150% increase in cyberattacks in 2024 and an expanding regulatory landscape, including the network and information systems Directive, the Cyber Resilience Act, and the Cyber Solidarity Act. These parallel developments have expanded ENISA’s responsibilities putting strains on its resources and coordination capacity. Over recent years, ENISA has become an established actor within the EU’s cybersecurity landscape. It has supported Member States in policy development, contributed to building technical and operational capabilities, and promoted exchanges of good practice and awareness-raising initiatives. Its role in facilitating cooperation and providing expertise has been widely acknowledged. At the same time, the broadening of ENISA’s mandate has created challenges in defining priorities, allocating resources and coordinating with other EU and national bodies. Stakeholders have underlined the need for clearer task definition, more systematic planning and stronger coordination mechanisms to avoid overlaps. The European Cybersecurity Certification Framework has advanced more slowly than initially foreseen. According to stakeholders, progress in developing certification schemes has been limited, with several delays and concerns regarding process transparency and predictability. The absence of a regularly updated Union Rolling Work Programme has made long-term planning more difficult for both public authorities and industry. Source : © European Union, 2026 - EP Read more