What is on the table

Following a call for evidence and public consultation from 11 April to 20 June 2025 on the mandate of ENISA, the European Cybersecurity Certification Framework (ECCF), ICT supply chain security and simplification of cybersecurity rules, the Commission adopted its cybersecurity package on 20 January 2026: a proposal for a Regulation revising the Cybersecurity Act („Cybersecurity Act 2″) together with a targeted directive amending the NIS2 Directive on simplification and alignment. The feedback period on the CSA 2 proposal ran from 5 February to 16 April 2026. The legislative procedure is ongoing in the European Parliament (Committee on Industry, Research and Energy) and the Council.

• ENISA: a strengthened role in supporting Member States in managing cyber threats, plus a new Article 7a tasking the agency with independent cybersecurity impact assessments of Union legislative acts – identifying risks, assessing coherence and evaluating compliance burdens.
• ICT supply chain: a first EU-level framework for ICT supply chain security, with references to the DNS and the availability and integrity of the public core of the open Internet.
• ECCF: an overhaul of the certification framework against its stalled implementation – only the EUCC scheme has been adopted to date.
• Debated in the feedback: voluntary versus mandatory certification in critical sectors; sovereignty criteria (large providers criticising „non-technical criteria“); and ENISA’s role in standardisation, where the European Standardisation Organisations warn against parallel standards and conflicts of interest.

GISAD’s assessment

1. The revision is overdue – and its own evaluation proves it. Only one scheme adopted, 30 EUCC certificates issued, 28 of them re-certifications of products already certified elsewhere. When two genuinely new certificates are all that the framework has moved, the ECCF does not measure structure – it measures stagnation.

2. Provenance belongs in the certificate. The draft introduces supply chain security as a certification subject for the first time – but the decisive step is missing if the ownership, operator and legal jurisdiction of the provider remain unmeasured. The criticism of „non-technical criteria“ as subjective turns the relationship upside down: a criterion that excludes US hyperscalers from critical infrastructure and accounts for CLOUD Act exposure is not a matter of taste – it is the measurable answer to a measurable threat. An EUCS without a provenance measure certifies CLOUD Act dependence along with the product.

3. The state of one day versus the state of every day. The revision improves scheme development but remains attached to the event-based certificate. What is needed is concept-fidelity in operation: sample-based audits during operation, re-certification triggers, and measurement outside the manipulable area.

4. Article 7a is progress – with a catch. Independent impact assessments of Union legislation correspond to the GISAD logic of measurement by an independent, read-only layer. But ENISA is simultaneously scheme developer, assessor, operator of the Single Reporting Platform and now impact assessor. A mandate expansion is only acceptable with role separation – the warning against parallel standards and against the agency drafting specifications while assessing harmonised standards confirms exactly this.

5. Demand instead of supply. Certificates are created through procurement, not catalogues. The public sector as anchor customer turns certification into a market mechanism – public money, public code. Mandatory certification narrowly confined to critical sectors is the right signal in that direction.

6. One report instead of many. The Single Reporting Platform and the de-duplication of reporting duties are a genuine simplification gain: redundancy belongs in the decentralised infrastructure, information belongs where responsibility lies.

7. Deadlines. EUCS and 5G need binding, realistic timelines. Years of non-decision are themselves a security risk – deadlines do not protect, structure protects.