The Cybersecurity Act 2: More Threats; More Procedures

The authors of this blog are participating in the EU-funded project CRACY, helping SMEs understand cybersecurity and complying with the Cyber Resilience Act. 

On January 20, 2026, the European Commission announced its proposal for the Cybersecurity Act 2 (‘CSA 2’), a comprehensive update to the 2019 Cybersecurity Act. The proposal reflects the evolution and growth of EU cybersecurity law over the past several years. It aims to address growing challenges in an increasingly hostile digital threat landscape. 

Understanding the CSA2's Role 

The CSA 2, like its predecessor, primarily establishes a cybersecurity regulatory framework rather than imposing direct obligations on individuals and companies. Its main functions are to create structures for future regulation, cybersecurity certification and to define the role and operations of the European Union Agency for Cybersecurity (ENISA). 

However, certain provisions, particularly those concerning supply chain security, will have direct implications for businesses operating in or with the EU. 

The Commission identified four critical issues driving the need for reform: 

1. Misalignment between the existing cybersecurity policy framework and the stakeholder needs, given the evolving threat environment 
2. Slow implementation of the EU cybersecurity certification framework
3. Growing complexity and fragmentation across cybersecurity-related policies 
4. Escalating ICT supply chain risks. 

To address these problems, the CSA 2 proposes changes in the existing Act, namely the mandate and workings of ENISA, as well as the EU Cybersecurity Certification Framework. Moreover, the CSA 2 proposal now contains new provisions on ICT Supply Chains. Below, an overview is provided of all three topics. 

Major Changes Under CSA 

2 Expanded ENISA Mandate 

The proposal significantly reforms ENISA's role, positioning the agency as a reference point not only for EU institutions but also for Member States. This expanded mandate includes market surveillance support relevant to the Cyber Resilience Act (CRA) and incorporates responsibilities found in other European cybersecurity legislation, such as operating the vulnerability database (from NIS2), managing the single reporting platform and vulnerability database for the CRA, and operating the EU Cybersecurity Reserve under the Cyber Solidarity Act. ENISA’s internal working has also been expanded and more strictly defined. This represents in essence a codification of ENISA's duties under other legislation while strengthening the agency's internal capacity to support its broader mandate. 

Evolution of the Certification Framework 

The CSA 2 Proposal expands the European Cybersecurity Certification Framework (ECCF), now allowing for the certification of entities themselves, rather than limiting certification to ICT products, services, and processes under the CSA. This change should directly support NIS 2 compliance needs. 

Note that implementation still requires the creation of new certification schemes. To put that into context, after almost five years of the original CSA, only one cybersecurity certification scheme was approved under its framework. In the proposal for CSA 2, the procedure to create and adopt a certification scheme has been streamlined and tightened up. This should simplify the adoption of new certification schemes. 

The proposal also establishes better integration with existing legislation. Certification schemes must now explicitly specify which piece of legislation’s requirements (such as the CRA or NIS2) the scheme addresses. Achieving certification creates a presumption of conformity, though not proof of conformity, with the listed legislative requirements. 

Trusted ICT Supply Chain

Framework Perhaps most significantly for private companies, the CSA 2 introduces a new Title IV establishing a “trusted ICT supply chain framework”. This framework builds on risk assessments done under the NIS 2, which are risk assessments done at the EU level. Once such an EU-coordinated risk assessment is done, the CSA 2 proposal contains three major components: the Commission is empowered to implement mitigating measures against the discovered risks, it can identify key ICT assets, and it can identify high risk countries and suppliers. This new section of the CSA 2 crucially addresses non-technical risks in the critical sectors defined under NIS 2. This appears to complement the mitigation of technical security risks, which are already covered under the NIS 2 framework. 

The most important of these new powers is for the EU to designate certain countries as “posing cybersecurity concerns” after the risk assessment. This has as its consequence that any entity established in such a designated country is automatically classified as a high-risk supplier, which carries substantial consequences: 

• Ineligibility for EU cybersecurity certifications 
• Exclusion from public procurement processes involving ICT components for key ICT assets 
• Inability to participate in EU funding programs related to ICT components for key ICT assets

This classification is not absolute, as high-risk suppliers may seek exemptions through a reasoned request to the European Commission. As the designation as high-risk supplier stems from the country of origin being designated as posing cybersecurity concerns, the concerned entity will have to prove that this third country will not exercise any undue interference in their operations. The burden of proof in this matter seems high and more clarity on this subject would be appreciated as the proposal moves forward. However, this arrangement is in line with the European approach of strengthened digital sovereignty. 

The CSA 2 Proposal also allows for the identification of “key ICT assets”. This is aimed to happen through implementing acts made by the Commission, after a supply chain risk assessment. Once something is designated a key ICT asset, it becomes the focal point for binding mitigation measures decided by the Commission. The Commission can require targeted mitigation steps, for example supplier transparency to authorities, limits on third-country data transfers or remote processing, audited technical controls, or diversification. These mitigation measures will also have to be detailed in an implementing act. For electronic communications networks specifically, key ICT assets are identified in Annex II and include core network functions of 5G mobile communications networks, satellite communications networks, and fixed electronic communications networks. 

Next Steps 

As this is a proposal, the legislative process will now proceed through the ordinary legislative procedure, involving the European Parliament and the Council. This means the text is unfinished and is still subject to change. For example, there is currently no Title V. The text jumps from Title IV on the Supply Chain Framework directly to Title VI on the Final Provisions. Moreover, the bulk of importance of the CSA 2 will arrive through delegated and implenting acts, which will clarify actual legal obligations. These would be published even further into the future, as the text of the CSA 2 needs to become law first. 

Organizations affected by these provisions should monitor developments closely and consider how potential high-risk supplier designations might impact their operations and supply chain relationships. 

If you have questions on cybersecurity compliance within your business, contact info@timelex.eu for tailored advice.