What is on the table

On 21 January 2026, following the White Paper „How to master Europe’s digital infrastructure needs?“ (February 2024) and a call for evidence in summer 2025, the Commission adopted its proposal for a Digital Networks Act (COM(2026) 16) – the most comprehensive reform of EU telecommunications law since the European Electronic Communications Code of 2018. The public feedback period on the proposal has closed; the ordinary legislative procedure is ongoing. The DNA merges four legal acts into one directly applicable Regulation: the EECC, the BEREC Regulation, the Radio Spectrum Policy Programme and the core parts of the Open Internet Regulation – replacing twenty-seven divergent national implementations.

• Single Passport: one notification to one national authority allows providers to operate across the Union, with operations commencing within one week; a Union database of notifications will be publicly accessible. Today, cross-border operators face more than 1,000 distinct authorisation conditions.
• Spectrum: unlimited licence duration by default, EU-level coordination with a 6G focus, and an EU-wide satellite spectrum authorisation replacing 27 national procedures.
• Copper phase-out: mandatory national transition plans by 2029; legacy copper networks to be decommissioned by 31 December 2035.
• Governance: a strengthened BEREC, a new Radio Spectrum Policy Board and an Office for Digital Networks.
• Resilience: obligations to limit dependencies and to coordinate responses to natural disasters, cyberattacks and foreign interference, under a „Union Preparedness Plan for Digital Infrastructures“.
• Criticism: civil rights organisations warn that the draft weakens net neutrality through expanded business-to-business flexibility and „specialised services“.

GISAD’s assessment

1. Bandwidth is not resilience. The DNA measures success in coverage and investment. But a centrally built network is a central vulnerability – the findings on submarine cable sabotage and global IT outages of recent years show what a single break can do. The Union Preparedness Plan must therefore include decentralised structures as a protection objective in their own right: medium-sized decentralised nodes, edge capability, local autonomy – not central coordination alone.

2. Centralisation has a flip side. The Single Passport and consolidated governance are correct simplifications – structure instead of bureaucracy. But the more crisis response is coordinated centrally, the closer a single point of control comes. The Preparedness Plan must not become a central emergency switch. A system is crisis-proof when it also works without the centre – by the honesty rule of resilience planning, the centre itself can fail.

3. Net neutrality must not be the price of simplification. Expanding business-to-business flexibility and specialised services risks creating a two-tier internet. Net neutrality is not bureaucracy – it is the constitution of the open network. Exceptions for satellite and cloud services need narrow, independently auditable limits; otherwise the DNA certifies the erosion of the very openness it is supposed to carry forward.

4. Satellite: simplification yes, dependency blindness no. An EU-wide licence instead of 27 procedures is right. But the findings on satellite dependency – the throttling risk of non-European mega-constellations, GPS spoofing – demand more than procedural relief: provenance and operator diversity as measurable criteria for critical infrastructure, and European alternatives as a target, not an annex.

5. The copper switch-off: deadlines do not protect, structure protects. A deadline-driven decommissioning in 2035 is risky if the successor architecture is defined centrally. Copper should only be switched off where resilient – and decentralised – alternatives demonstrably exist. Protection of vulnerable users must be a structural criterion, not a footnote.

6. One week to operate – speed must not relocate scrutiny into the market. The Single Passport logic is right, but authorisation within one week must not shift verification into ongoing operations. Eligibility must be checked before, through measurement outside the manipulable area – the public Union database of notifications is a welcome transparency instrument.

7. Consumer protection and privacy must survive the merger. The announced high level of consumer protection and the incorporation of the ePrivacy Directive must not be watered down in harmonisation. WAN-anonymous communication is part of network resilience, not its opponent.