The EU Cybersecurity Act 2 – Security Certifies Products, Resilience Measures Structure

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation

GISAD supports the Cybersecurity Act 2. That the Union is creating a horizontal framework for ICT supply chain security for the first time, and is relying on Union-wide certification instead of fragmented national rules, is overdue. Yet the proposal stands or falls with one question: will high-risk designations and cyber posture certificates be measured, or merely asserted?

Measure origin, do not designate politically

The new regime for third countries and high-risk suppliers is right – but only if designation is bound to measurable structural criteria: origin, depth of dependency, single-source share, and replaceability. A certificate that does not measure origin merely certifies dependency. A risk list without measured criteria becomes an instrument of trade policy; with measured criteria, it becomes resilience. And the phase-out of high-risk suppliers must not lead into the next single-source dependency: whoever phases out one supplier must measure the diversification that follows, not the replacement of one dominant vendor by the next two corporations.

The cyber posture must not become a corporate profile

Certifying the overall cyber posture of an organisation is an advance over piecemeal product testing – concept fidelity is created not by examples, but by measurement. But the assessment must remain limited to the state of security: what is security-relevant gets examined; what the organisation’s operations otherwise reveal is not the assessor’s business. The credential of a company must not become a movement profile of its conduct.

Whoever verifies must itself be verifiable

With the Cybersecurity Reserve, the single reporting platform, the European Vulnerability Database and early warnings, ENISA gains de facto power over everyone else’s visibility. A budget increase of more than 75 per cent is justified only by measurable output – and by reciprocity of transparency: the central assessment and reporting authority must itself keep a verifiable record of what it collects, stores and passes on. Central coordination is right, but it does not replace decentralised response capability. Decentralised digitalisation does not replace a single cable – but it takes the catastrophe out of every cable break.

Certify the watchers

Managed security services monitor the systems of others around the clock. The EUMSS scheme must therefore apply to its own industry the principle it imposes on everyone else: measure structure, measure origin, and keep assessment auditable. Whoever guards the security of others must itself remain verifiable.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: European Commission – Have your say: The EU Cybersecurity Act · European Commission – EU Cybersecurity Act · EUR-Lex – COM(2026) 11