Briefing - Revision of the Cybersecurity Act - 12-06-2026
newsare.net
The IA underpins the revision of ENISA's mandate to adapt it to the evolving cybersecurity threat landscape and the main stakeholder needs. It also supports: the revision of the ECCF to expand and clarify its scope and improve its governance and procedures; tBriefing - Revision of the Cybersecurity Act - 12-06-2026
The IA underpins the revision of ENISA's mandate to adapt it to the evolving cybersecurity threat landscape and the main stakeholder needs. It also supports: the revision of the ECCF to expand and clarify its scope and improve its governance and procedures; targeted amendments to the NIS2 Directive to facilitate and align compliance across the internal market; the filling of regulatory gaps by setting up an EU-level framework to enhance ICT supply chain security against non-technical risks. The IA effectively substantiates the need for a revision of the Cybersecurity Act. It presents a well-evidenced problem definition and identifies the initiative's general and specific objectives, which broadly meet the S.M.A.R.T. criteria (specific, measurable, achievable, relevant and time-bound), though not fully, and it does not include operational objectives. The IA provides a well-structured intervention logic linking the specific objectives with the identified problems, drivers, proposed policy options and key measures. The need for EU action is sufficiently justified, but, despite the initiative's political significance, the IA is not supported by a subsidiarity grid, and it does include a distinct section on proportionality. The IA considers four areas of intervention, each with a set of three policy options considered in view of the specific objectives. Each policy option consists of a set of key measures linked to the identified problems, their underlying drivers, and the specific objectives. However, the design and description of options and the choice of the preferred package raise some questions, which are presented in the dedicated section of this analysis. The IA considers, qualitatively and quantitatively, economic, social, and environmental impacts, although it analyses economic impacts more than the others. The analysis includes an SME test to examine the initiative's direct and indirect impacts on SMEs, and the IA addresses impacts on competitiveness systematically. Overall, the IA presents its key methodological considerations and is transparent about the evidence and analytical methods used, including limitations and underlying assumptions. The feedback from stakeholder consultation activities could have been given more consideration in the IA, particularly regarding the available policy options and their potential impacts. The IA presents a non-exhaustive list of monitoring indicators linked to each specific objective and suggests carrying out an evaluation to assess the initiative's effectiveness. The Regulatory Scrutiny Board issued a positive opinion with reservations on the draft IA after initially issuing a negative opinion due to serious shortcomings. The Board's recommendations have largely been addressed in the final IA, with some issues remaining. Finally, it appears that both proposals are mostly in line with the preferred option of the IA, with a couple of issues remaining. Source : © European Union, 2026 - EP Read more









