Common Incident Reporting Templates under the NIS2 Directive – One Form Is Not One Door

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation

GISAD welcomes the planned implementing act: uniform reporting fields for all Member States are structure – and structure is what NIS2 has lacked so far, where 27 national forms ask the same incident 27 different ways. The NIS2 Cooperation Group adopted the common templates on 26 May 2026; the implementing act will make them binding across the Union, as part of the Commission’s simplification agenda. Yet the harmonisation must not stop at the paper form.

Uniform fields are necessary, but not sufficient

Uniform fields without a uniform entry point are half a structure. A company operating in five Member States still has to serve five national portals after an incident – merely with identical forms. The Single Entry Point of the Digital Omnibus is the second, decisive step: one notification that fulfils all obligations. The implementing act should therefore be explicitly tied to the Single Entry Point, with a binding timetable.

Measure what matters, not what fills fields

The form must keep its questions measurable: affected users, outage duration, cross-border impact, origin of the incident. What does not flow into assessment does not belong in the form. A reporting form that collects data nobody evaluates breeds reporting fatigue – and reporting fatigue is a security gap.

The report is sensitive

An incident report describes the weakness of a system – often while it is still open. Whoever verifies must itself be verifiable: access to reported data must be logged, limited and bound to a purpose. Uniform fields must not turn into a central vulnerability database that itself becomes a target.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: European Commission – Have your say: Common incident reporting templates under the NIS2 Directive · European Commission – NIS2 Cooperation Group adopts common templates for incident reporting

AI Act Implementing Act – Articles 75c-75d: Procedure Is Structure

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation

GISAD welcomes the draft implementing regulation in principle: an enforcement authority without procedural rules would be arbitrariness on letterhead. Through the Digital Omnibus, the EU AI Office has been given the competence to rule over the AI systems of the largest platforms and model houses – procedural rules for that task are structure, not bureaucracy. Yet three provisions of the draft invert procedural protection into its opposite.

The restartable clock

Six investigative steps, from a request for information to a structured dialogue, each restart the five-year limitation period – capped at ten years, and suspensions can push it beyond. This is not limitation but a negotiating lever: the authority decides when the clock runs again. A deadline that binds only the investigated party, and never the investigator, is structurally one-sided. Interruptions must be tied to formal procedural acts, not to every request. And the ten-year cap must be an absolute cap.

Defence only for corporate budgets

Broad access to confidential file material is reserved for external advisers – the in-house engineers who know the system best are excluded. A small model provider cannot afford a firm of expensive experts; a corporation can. The result is a two-tier defence, graded by bank balance rather than by the merits. The circle of access should be extended to bound internal technical staff, or access must be structurally enabled for small and mid-sized operators – otherwise the procedure protects precisely those it is meant to restrain.

Whoever verifies must itself be verifiable

The AI Office investigates, decides and imposes fines – and recovers its own investigation costs from the operator, without functional separation between investigation and decision. That is an incentive structure which demands to be measured: auditable procedural records, and the obligation to publish decisions (Article 75d(4) – welcome) complemented by an annual enforcement report with measured indicators. And the preamble must cite Regulation (EU) 2026/1744 – a legal act that omits its own legal basis creates no legal certainty.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: European Commission – Have your say: AI Act Implementing Act – Articles 75c-75d · EUR-Lex – Regulation (EU) 2026/1744 (Digital Omnibus on AI)

The EU Cybersecurity Act 2 – Security Certifies Products, Resilience Measures Structure

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation

GISAD supports the Cybersecurity Act 2. That the Union is creating a horizontal framework for ICT supply chain security for the first time, and is relying on Union-wide certification instead of fragmented national rules, is overdue. Yet the proposal stands or falls with one question: will high-risk designations and cyber posture certificates be measured, or merely asserted?

Measure origin, do not designate politically

The new regime for third countries and high-risk suppliers is right – but only if designation is bound to measurable structural criteria: origin, depth of dependency, single-source share, and replaceability. A certificate that does not measure origin merely certifies dependency. A risk list without measured criteria becomes an instrument of trade policy; with measured criteria, it becomes resilience. And the phase-out of high-risk suppliers must not lead into the next single-source dependency: whoever phases out one supplier must measure the diversification that follows, not the replacement of one dominant vendor by the next two corporations.

The cyber posture must not become a corporate profile

Certifying the overall cyber posture of an organisation is an advance over piecemeal product testing – concept fidelity is created not by examples, but by measurement. But the assessment must remain limited to the state of security: what is security-relevant gets examined; what the organisation’s operations otherwise reveal is not the assessor’s business. The credential of a company must not become a movement profile of its conduct.

Whoever verifies must itself be verifiable

With the Cybersecurity Reserve, the single reporting platform, the European Vulnerability Database and early warnings, ENISA gains de facto power over everyone else’s visibility. A budget increase of more than 75 per cent is justified only by measurable output – and by reciprocity of transparency: the central assessment and reporting authority must itself keep a verifiable record of what it collects, stores and passes on. Central coordination is right, but it does not replace decentralised response capability. Decentralised digitalisation does not replace a single cable – but it takes the catastrophe out of every cable break.

Certify the watchers

Managed security services monitor the systems of others around the clock. The EUMSS scheme must therefore apply to its own industry the principle it imposes on everyone else: measure structure, measure origin, and keep assessment auditable. Whoever guards the security of others must itself remain verifiable.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: European Commission – Have your say: The EU Cybersecurity Act · European Commission – EU Cybersecurity Act · EUR-Lex – COM(2026) 11

The Union Position for the World Radiocommunication Conference 2027

Statement by GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation

GISAD supports the creation of a common Union position for the World Radiocommunication Conference 2027. A single market that, through the Digital Networks Act, is establishing a Union spectrum strategy and an EU-level satellite spectrum authorisation for the first time must also negotiate globally with one voice. The conference in Shanghai, from 18 October to 12 November 2027, will revise the international treaty that governs the use of radio spectrum and satellite orbits, and its decisions will directly affect Union law and programmes, including Copernicus and IRIS2.

A negotiating position is not a strategy

A common position only becomes a strategy when it ties spectrum allocation to measurable structural criteria rather than asserted demand. The debate on the 6G candidate bands shows the problem: those who demand additional frequencies without measuring interoperability, coverage and resilience beyond the market are selling bandwidth as the future. Bandwidth is not resilience. The Union position should therefore define, for every allocation it supports, what will be measured afterwards: actual use, coexistence with incumbent services, and the degree to which services remain functional when individual systems fail.

Direct-to-device: complement, not replacement

Satellite direct-to-device connectivity must not become an alibi for neglecting terrestrial and local network structures. What arrives from orbit must be measured as a complement to decentralised infrastructure – against the yardstick of what continues to work without any single operator. GISAD calls on the Union position to fix origin and availability criteria for the selection of direct-to-device partners. A certificate that does not measure origin merely certifies dependency.

Regulation without profiling

WRC-27 will decide on the coordination of earth stations and on the identification of user devices. The Union position must draw a clear line here: technical coordination of radio use is legitimate; networked recording of users and their movements is not. Whoever verifies must itself be verifiable. Radio use must not become a movement profile.

Interoperability is not chaining

Global harmonisation of bands lowers equipment costs – but it must not lead to supply chains that depend on a few manufacturers and a few constellations. The Union position should bind spectrum harmonisation to the same criterion that the Chips Act 2.0 establishes for semiconductor supply chains: no single source. Whoever triples capacity without measuring the operator triples dependency.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: European Commission – Have your say: The Union Position for the World Radiocommunication Conference 2027 · European Commission – Commission collects feedback to define the EU’s position for WRC-27