The proposal in brief

Following the call for evidence on the evaluation of the European Chips Act, the Commission adopted the proposal for a Chips Act 2.0 (COM(2026) 504) on 3 June 2026 as part of the European Technological Sovereignty Package, replacing Regulation (EU) 2023/1781. The first Chips Act mobilised more than €52 billion and created competence centres, five pilot lines and a design platform, but its headline ambition – doubling the EU’s global market share to 20 % by 2030 – was judged highly unlikely by the European Court of Auditors, which forecast a share of 11.7 %; the EU produces about 10 % of the world’s semiconductors and almost none of the leading AI chips. The new proposal keeps the three pillars but rebalances towards demand and industrial deployment: a reinforced Chips for Europe Initiative, European Semiconductor Technology Initiatives and Grand Challenges for AI chips; strategic projects including an open flagship foundry for advanced manufacturing; permitting capped at twelve months and a Semiconductor Regions of Excellence label; Demand Accelerators connecting European chipmakers with industrial buyers, security-of-supply declarations in tenders and Union added-value criteria favouring chips designed, manufactured or controlled in the EU; expanded supply-chain monitoring with early-warning indicators and a sharper crisis-response mechanism; a European Chips Skills Academy; and a target of around €120 billion in investment by 2035. The file is under negotiation: Parliament’s ITRE committee leads with rapporteur Oliver Schenk, and political agreement is targeted for the second quarter of 2027. Open questions remain on funding – no headline budget is attached, with post-2027 resources depending on the 2028–2034 Multiannual Financial Framework – as well as on talent, with 350,000 additional workers needed by 2030, on energy costs, and on the foundry gap at the most advanced nodes.

Five points GISAD recommends for the negotiations

1. A market-share target is not a strategy – a supply chain without single sources is one. The Court of Auditors‘ lesson: percentage targets without structure evaporate. GISAD recommends structure indicators instead of market share: the proportion of critical European systems running on EU chips, the number of eliminated single-source dependencies, and design sovereignty. The evaluation must measure structure, not spending.

2. Origin, measurably, in procurement. The Union added-value criteria – chips designed, manufactured or controlled in the EU – are the hardware sibling of the assurance levels in the Cloud and AI Development Act; both acts must follow the same measurement logic. A chip that runs in foreign data centres strengthens no sovereignty: Demand Accelerators and the CADA procurement levels should be interlocked so that public buyers demand EU chips in EU-controlled infrastructure.

3. The honesty rule. No region in the world controls every stage of the semiconductor value chain; selective technological sovereignty is realistic, autarky is not. GISAD recommends stating in the law which dependencies can be fully replaced and which can only be cushioned. Misallocating resources because targets are misdeclared costs time Europe does not have.

4. An open foundry that prevents gatekeepers. The flagship project is right – but only with binding access for European design houses, SMEs and research. A foundry that serves only corporate orders trades external gatekeepers for internal ones. And the Chips Skills Academy must follow a participation logic: 350,000 workers by 2030 are created through training access, not through poaching.

5. Binding funds in the Multiannual Financial Framework. Indicative post-2027 figures are not a planning basis. GISAD recommends committing the funds for the Chips for Europe Initiative 2.0 and strategic projects in the 2028–2034 MFF – otherwise the size of national budgets, not European strategy, decides the outcome.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: European Commission – Have your say: Chips Act 2 · European Commission – Chips Act 2.0 · Proposal COM(2026) 504 (EUR-Lex)

The proposal in brief

Following a call for evidence from April to July 2025, the Commission adopted the proposal for the Cloud and AI Development Act (COM(2026) 502) on 3 June 2026 as the centrepiece of the European Technological Sovereignty Package, alongside the revised Chips Act, an EU Open Source Strategy and a roadmap for AI in the energy system. It is not yet law: the file is under negotiation by Parliament and Council, with a rapporteur appointed in mid-2026, adoption expected by the end of 2027 and estimated entry into force in the second quarter of 2029. The act pursues three objectives: research and innovation for next-generation cloud and AI technologies; capacity, with Member States designating data centre acceleration zones and a target of at least tripling EU data centre capacity within five to seven years; and autonomy, through a single EU-wide assessment framework with four assurance levels for public procurement – from EU-located infrastructure (level 1) to demonstrated third-country independence (level 2), EU ownership, control and personnel (level 3), and full supply-chain transparency without third-country interference (level 4). The most critical functions, including defence, are reserved for the highest levels. The proposal also establishes the EuroCloud Federation, open-source obligations for the public sector, a recognition procedure, and a one-year cloud usage mapping for each Member State; operators in NIS2-critical sectors are at first assessed voluntarily, with the Commission empowered to make assessment mandatory by delegated act. The Commission’s diagnosis is blunt: three US providers hold about 70 % of the European cloud market, and the US CLOUD Act as well as the risk that an external actor could disrupt essential services remain the driving concerns.

Five points GISAD recommends for the trilogue negotiations

1. Whoever triples capacity without measuring the operator triples dependence. The tripling target and the acceleration zones apply to anyone who builds – including US hyperscalers erecting data centres in the EU while remaining subject to the CLOUD Act. An EU location alone (level 1) must not count as sovereignty. The measure must be the operator and its legal-order and control anchoring – otherwise the capacity of dependence is tripled.

2. Measure sovereignty instead of declaring it. The level-3 criteria – EU ownership, control and personnel – must be demonstrable economically and technically; shareholding structures are the best-known circumvention route. Verification in operation, recertification upon substantial change, measurement outside the manipulable area. The level-3 recognition clause for third-country providers is the key variable of the negotiations.

3. Critical infrastructure without opt-out. Leaving NIS2-critical operators to voluntary assessment leaves the largest exposure open. GISAD recommends making the assessment mandatory for critical infrastructure from entry into force – not deferring it to a later delegated act.

4. A EuroCloud Federation open to medium-sized providers. Gigafactories and corporate alliances are one path – decentralised medium-sized nodes are the more resilient one. Public administrations as anchor customers should give planning certainty also to smaller European providers, not only to the large ones. A sovereignty framework that only corporate consortia can satisfy trades US hyperscalers for European oligopolies.

5. The four-year evaluation must measure structure, not spending. GISAD recommends as indicators the share of critical public workloads on level-3-plus infrastructure, the origin distribution of operators, and the share of independent European providers – not the number of gigafactories built.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: European Commission – Have your say: AI Continent: new Cloud and AI Development Act · European Commission – Cloud and AI Development Act · Proposal COM(2026) 502 (EUR-Lex)

The network code in brief

Adopted on 11 March 2024 as Commission Delegated Regulation (EU) 2024/1366 and in force since 13 June 2024, the Network Code on Cybersecurity (NCCS) establishes a risk-based framework for the cybersecurity aspects of cross-border electricity flows, aligned with NIS2. It was drafted by ENTSO-E and the EU DSO Entity with the support of ACER, following public consultation. Its core elements: a recurring risk assessment cycle combining a top-down Union-wide assessment with a bottom-up assessment from entities to national and regional level; the classification of entities into critical-impact, high-impact and small or micro entities with graduated controls; cybersecurity management systems verified through certification or national verification schemes; harmonised cybersecurity procurement requirements compatible with Union certification schemes such as EUCS and ICCS; SOC capabilities and reporting of critical or high-gravity cyber-attacks to CSIRTs within four hours; crisis management plans, an early warning system and exercises at entity, national and regional level; protection of exchanged information; and supply chain security reaching suppliers and equipment manufacturers. Implementation is ongoing: ACER has established a European Stakeholder Committee on electricity cybersecurity, and consultations are running on the cyber-attack classification scale and procurement recommendations for substation gateways.

What GISAD welcomes

A common risk assessment cycle, uniform minimum requirements, reporting through the existing CSIRT structures instead of new parallel bureaucracy, exercises, and supply chain security – this is structure, not paperwork. The alignment with NIS2 and the delegation to the network operator associations under ACER supervision is the right division of roles: those who operate the grid lead the process. Whoever bears responsibility in daily operation must have the information.

Five points GISAD recommends for the implementation phase

1. The network code secures the interconnected grid – what must also be measured is what works without it. The risk assessment cycle evaluates threats to the grid. It should be complemented by an autonomy indicator: how long can an entity keep operating without central control and communication systems – islanding capability, decentralised generation, micro-grids? Decentralised structure reduces the catastrophic effect of every outage. Autonomy is a measurable risk reduction, not a romantic ideal.

2. Exercises without the grid. The exercise framework is right – but scenarios must include the failure of the entities‘ own communication and coordination, not only rehearse the reporting chain. An exercise that presupposes functioning systems tests administration, not resilience. Measuring outside the manipulable area applies here as well.

3. Origin measurement in the procurement requirements. Harmonised procurement requirements compatible with EUCS and ICCS are the right lever – but a certificate that does not measure origin certifies dependence. The requirements should include a measurable operator and legal-order criterion: no US hyperscalers in critical infrastructure. Control and switching technology whose manufacturers and operations lie in third countries carries the attack risk into the grid.

4. Concept fidelity in operation instead of the certificate state of a single day. Verification schemes are point-in-time checks. GISAD recommends sample-based verification in operation with event-based triggers and recertification upon substantial change – consistent with its positions on EUCS and the Cybersecurity Act revision.

5. Do not leave small entities alone. Basic hygiene for small and micro entities is proportionate, but the code must not create two classes of resilience: shared SOC offerings, open standards and model documentation – also for aggregators and demand-response providers of small size but high impact – enable participation instead of thresholds. Sanitised and anonymised information sharing is the right approach; withholding information must not become a gatekeeper instrument of individual CSIRTs.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: European Commission – Have your say: EU electricity supply – sector-specific rules on cybersecurity (network code) · Commission Delegated Regulation (EU) 2024/1366 (EUR-Lex) · European Commission – New network code on cybersecurity for EU electricity sector · GISAD study “2039 – Resilience through decentralised networking” – publication scheduled for calendar week 48/2026 at www.finders.de

The review in brief

Under Article 53, the Commission was required to evaluate the DMA by 3 May 2026 and every three years thereafter. A public consultation opened on 3 July 2025, followed by a call for evidence and a dedicated AI questionnaire published on 26 August 2025 with feedback until late September; 319 consultation contributions, 63 call-for-evidence submissions and 96 AI questionnaire responses were received. The Commission published its summary on 8 January 2026, recording broad support for the DMA’s objectives alongside calls for stronger interoperability, data access and data portability, more support for SMEs, and in some contributions an extension of scope to AI and cloud services – while gatekeepers criticised proportionality and user experience.

The review report COM(2026) 178 final, published on 28 April 2026, concludes that the DMA is fit for purpose and proposes no legislative amendment and no change to the list of core platform services. Cloud computing and artificial intelligence are named as the next enforcement focus; messaging interoperability continues without extension to social networks. The report credits the regulation with tangible benefits: the ability to withhold consent to cross-service data combination, data portability, uninstall rights, alternative app stores and browsers, and the first DMA fines against Apple and Meta on 23 April 2025. The accompanying staff document, however, also records persistent problems: advertisers still face insufficiently granular and comparable data, alternative app stores and payment methods show mixed results due to technical and contractual barriers, and interoperability mandates carry high compliance costs.

What GISAD acknowledges

Two years of full application have produced real achievements: consent against cross-service data combination, portability, the right to uninstall, choice screens, and the first fines. These are not symbolic. GISAD also welcomes the decision to name cloud and AI as the next enforcement focus – the regulation is looking in the right direction. What the review does not deliver is a measurement of what the DMA exists to produce: markets in which the gatekeepers‘ position no longer decides the outcome.

Four points GISAD recommends

1. The DMA disciplines the gatekeepers – structure makes them dispensable. The review confirms the gatekeeper position as given and makes it bearable through regulation. Access to a market is no substitute for alternatives in the market. Structural alternatives – independent European providers per discipline, category-based search instead of algorithmic feeds – are the way to make gatekeepers not merely tamer, but unnecessary. A choice screen is not a choice as long as all candidates live in the same house.

2. Measure contestability, not compliance. The review’s logic is asymmetric: successes count immediately, while shortfalls are always „too early to judge“. GISAD recommends measurable contestability indicators instead of compliance indicators – shifts in market shares, the survival rate of independent alternatives, demand and refusal figures. Whoever measures must measure outside the manipulable area.

3. Measure AI as a future gatekeeper before it is one. Cloud and AI as enforcement priorities are correct. But the AI assistant is becoming a gateway before the designation criteria capture it: whoever controls the answer controls access. GISAD recommends measuring attention and answer control as designation criteria instead of waiting for turnover thresholds. Interoperability of AI assistants is necessary – but interoperability is not linkability: open interfaces must not create a re-linking of user profiles across services.

4. Access without demand is a one-way street. The SME contributions report delaying tactics, circumvention and choice interfaces designed to fail. Rights are worthless without viable alternatives. GISAD recommends procurement as an enforcement lever: public administrations and businesses as anchor customers of independent European providers – measured by the criterion that no US hyperscalers operate the critical infrastructure. This turns DMA access into real contestability.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: European Commission – Have your say: Review of the Digital Markets Act · DMA Review Report COM(2026) 178 final · European Commission – Consultation on the first review of the DMA

What has been decided

On 3 March 2026, the Commission published its draft guidance on the application of the Cyber Resilience Act (Regulation (EU) 2024/2847) under Article 26 CRA, open for feedback until 31 March 2026 – more than 85 contributions were submitted. The final guidance was published on 27 July 2026 as Commission Communication C(2026) 5252 with an annex of more than 80 pages, containing 67 practical examples, use cases and flowcharts, written with microenterprises and SMEs in mind. The guidance is non-binding; only the Court of Justice can interpret the Regulation authoritatively.

• Scope: remote data processing solutions are assessed functionally, not by commercial labels; a dedicated section addresses free and open-source software, distinguishing non-commercial development from commercial products.
• Classification: „important“ and „critical“ follow the product’s core functionality – mislabelling cannot avoid stricter assessment.
• Support periods: five years is a minimum, not a default; the expected lifetime decides.
• Substantial modification: update size is not a proxy – the risk profile decides.
• Open-source feedback themes: dual-track models, transitive SBOMs, the status of forges exercising de facto control, the contractual cascade reaching community projects outside the scope, and the lack of procurement tools for public administrations (Article 5(2)).

Context: CRA reporting obligations have applied since 11 September 2026 via ENISA’s Single Reporting Platform; the main obligations apply from 11 December 2027. Notified bodies have only been operational since June 2026, and their capacity is limited.

GISAD’s assessment

1. Readability is not verification. The examples are a genuine service, especially for small companies. But conformity must be checked in operation – event-driven, sample-based, outside the manipulable area. The guidance describes how the Commission reads the law; it cannot certify that a product lives up to it.

2. The open-source cascade must be stopped. CRA obligations must not flow back through contractual cascades to community projects that lie outside the Regulation’s scope. Open-source contributions are not tax-free volunteer work. The steward regime (Article 24) needs an interpretation that strengthens small structures rather than drowning them – and whoever operates a forge with de facto control over development workflows must be treated by their role, not their self-description. The consequence: European development infrastructure – forges, registries, CI/CD at Stage B – instead of dependence on US platforms with CLOUD Act exposure.

3. Transitive SBOMs – readability without cosmetics. Listing only first-level dependencies would be a step backwards. Open code makes the structure readable – but readable is not owned. Supply-chain transparency must capture the full depth, otherwise the SBOM becomes a fig leaf.

4. Procurement is the missing enforcement motor. The stakeholder feedback is right: public administrations lack the tools to integrate CRA requirements into procurement (Article 5(2)). Public money, public code – the public sector as anchor customer makes guidance effective before products reach the market; market surveillance alone arrives too late.

5. Support periods: security must not become a paywall. Restricting remediation to the latest version is acceptable only where upgrades are genuinely free of cost and obstacles. The limit must be drawn at vulnerable groups: security updates for devices used by older people and those with limited digital access are participation infrastructure.

6. Functional analysis is structural thinking – but the cloud remains invisible. Assessing remote processing by function rather than label is right. Yet the guidance examines the product, not its operating environment: a CRA-compliant product running on US hyperscalers remains exposed to the CLOUD Act. A provenance note (Stage B) belongs in the guidance’s practical application.

7. Timing: deadlines do not protect, structure protects. With notified body capacity limited and demand concentrating before December 2027, a bottleneck near the deadline will produce paper compliance rather than security. Early, staged assessments beat last-minute certificates.

What is on the table

On 21 January 2026, following the White Paper „How to master Europe’s digital infrastructure needs?“ (February 2024) and a call for evidence in summer 2025, the Commission adopted its proposal for a Digital Networks Act (COM(2026) 16) – the most comprehensive reform of EU telecommunications law since the European Electronic Communications Code of 2018. The public feedback period on the proposal has closed; the ordinary legislative procedure is ongoing. The DNA merges four legal acts into one directly applicable Regulation: the EECC, the BEREC Regulation, the Radio Spectrum Policy Programme and the core parts of the Open Internet Regulation – replacing twenty-seven divergent national implementations.

• Single Passport: one notification to one national authority allows providers to operate across the Union, with operations commencing within one week; a Union database of notifications will be publicly accessible. Today, cross-border operators face more than 1,000 distinct authorisation conditions.
• Spectrum: unlimited licence duration by default, EU-level coordination with a 6G focus, and an EU-wide satellite spectrum authorisation replacing 27 national procedures.
• Copper phase-out: mandatory national transition plans by 2029; legacy copper networks to be decommissioned by 31 December 2035.
• Governance: a strengthened BEREC, a new Radio Spectrum Policy Board and an Office for Digital Networks.
• Resilience: obligations to limit dependencies and to coordinate responses to natural disasters, cyberattacks and foreign interference, under a „Union Preparedness Plan for Digital Infrastructures“.
• Criticism: civil rights organisations warn that the draft weakens net neutrality through expanded business-to-business flexibility and „specialised services“.

GISAD’s assessment

1. Bandwidth is not resilience. The DNA measures success in coverage and investment. But a centrally built network is a central vulnerability – the findings on submarine cable sabotage and global IT outages of recent years show what a single break can do. The Union Preparedness Plan must therefore include decentralised structures as a protection objective in their own right: medium-sized decentralised nodes, edge capability, local autonomy – not central coordination alone.

2. Centralisation has a flip side. The Single Passport and consolidated governance are correct simplifications – structure instead of bureaucracy. But the more crisis response is coordinated centrally, the closer a single point of control comes. The Preparedness Plan must not become a central emergency switch. A system is crisis-proof when it also works without the centre – by the honesty rule of resilience planning, the centre itself can fail.

3. Net neutrality must not be the price of simplification. Expanding business-to-business flexibility and specialised services risks creating a two-tier internet. Net neutrality is not bureaucracy – it is the constitution of the open network. Exceptions for satellite and cloud services need narrow, independently auditable limits; otherwise the DNA certifies the erosion of the very openness it is supposed to carry forward.

4. Satellite: simplification yes, dependency blindness no. An EU-wide licence instead of 27 procedures is right. But the findings on satellite dependency – the throttling risk of non-European mega-constellations, GPS spoofing – demand more than procedural relief: provenance and operator diversity as measurable criteria for critical infrastructure, and European alternatives as a target, not an annex.

5. The copper switch-off: deadlines do not protect, structure protects. A deadline-driven decommissioning in 2035 is risky if the successor architecture is defined centrally. Copper should only be switched off where resilient – and decentralised – alternatives demonstrably exist. Protection of vulnerable users must be a structural criterion, not a footnote.

6. One week to operate – speed must not relocate scrutiny into the market. The Single Passport logic is right, but authorisation within one week must not shift verification into ongoing operations. Eligibility must be checked before, through measurement outside the manipulable area – the public Union database of notifications is a welcome transparency instrument.

7. Consumer protection and privacy must survive the merger. The announced high level of consumer protection and the incorporation of the ePrivacy Directive must not be watered down in harmonisation. WAN-anonymous communication is part of network resilience, not its opponent.

What is on the table

Following a call for evidence and public consultation from 11 April to 20 June 2025 on the mandate of ENISA, the European Cybersecurity Certification Framework (ECCF), ICT supply chain security and simplification of cybersecurity rules, the Commission adopted its cybersecurity package on 20 January 2026: a proposal for a Regulation revising the Cybersecurity Act („Cybersecurity Act 2″) together with a targeted directive amending the NIS2 Directive on simplification and alignment. The feedback period on the CSA 2 proposal ran from 5 February to 16 April 2026. The legislative procedure is ongoing in the European Parliament (Committee on Industry, Research and Energy) and the Council.

• ENISA: a strengthened role in supporting Member States in managing cyber threats, plus a new Article 7a tasking the agency with independent cybersecurity impact assessments of Union legislative acts – identifying risks, assessing coherence and evaluating compliance burdens.
• ICT supply chain: a first EU-level framework for ICT supply chain security, with references to the DNS and the availability and integrity of the public core of the open Internet.
• ECCF: an overhaul of the certification framework against its stalled implementation – only the EUCC scheme has been adopted to date.
• Debated in the feedback: voluntary versus mandatory certification in critical sectors; sovereignty criteria (large providers criticising „non-technical criteria“); and ENISA’s role in standardisation, where the European Standardisation Organisations warn against parallel standards and conflicts of interest.

GISAD’s assessment

1. The revision is overdue – and its own evaluation proves it. Only one scheme adopted, 30 EUCC certificates issued, 28 of them re-certifications of products already certified elsewhere. When two genuinely new certificates are all that the framework has moved, the ECCF does not measure structure – it measures stagnation.

2. Provenance belongs in the certificate. The draft introduces supply chain security as a certification subject for the first time – but the decisive step is missing if the ownership, operator and legal jurisdiction of the provider remain unmeasured. The criticism of „non-technical criteria“ as subjective turns the relationship upside down: a criterion that excludes US hyperscalers from critical infrastructure and accounts for CLOUD Act exposure is not a matter of taste – it is the measurable answer to a measurable threat. An EUCS without a provenance measure certifies CLOUD Act dependence along with the product.

3. The state of one day versus the state of every day. The revision improves scheme development but remains attached to the event-based certificate. What is needed is concept-fidelity in operation: sample-based audits during operation, re-certification triggers, and measurement outside the manipulable area.

4. Article 7a is progress – with a catch. Independent impact assessments of Union legislation correspond to the GISAD logic of measurement by an independent, read-only layer. But ENISA is simultaneously scheme developer, assessor, operator of the Single Reporting Platform and now impact assessor. A mandate expansion is only acceptable with role separation – the warning against parallel standards and against the agency drafting specifications while assessing harmonised standards confirms exactly this.

5. Demand instead of supply. Certificates are created through procurement, not catalogues. The public sector as anchor customer turns certification into a market mechanism – public money, public code. Mandatory certification narrowly confined to critical sectors is the right signal in that direction.

6. One report instead of many. The Single Reporting Platform and the de-duplication of reporting duties are a genuine simplification gain: redundancy belongs in the decentralised infrastructure, information belongs where responsibility lies.

7. Deadlines. EUCS and 5G need binding, realistic timelines. Years of non-decision are themselves a security risk – deadlines do not protect, structure protects.