Toulouse: Satellite operators in Europe’s biggest space cluster spent the summer waiting on a negotiation in Brussels that will decide how the Space Act treats their cybersecurity obligations, and the three institutions still disagree on the answer.
The Commission tabled the Space Act in June 2025 as a single rulebook for authorisation, registration and supervision of space activities across the Union. Today twenty-seven national regimes govern who may launch, who may operate and who carries the liability. The Commission wants one licence, one register and one supervisory logic, and it wants the rules to reach non-EU operators who sell services into the single market.
Council ministers filed their first tranche of amendments in December 2025. Parliament’s industry committee answered in March 2026. Since then negotiators have worked through the technical annexes, and the file has narrowed to a handful of genuinely contested questions.
Cybersecurity is the sharpest of them. The Commission wrote dedicated provisions into the Space Act covering threat-led penetration testing, cryptographic requirements and supply chain security for ground segments and satellites alike. Parliament’s rapporteurs want those articles deleted. Their argument is procedural rather than permissive: the NIS2 directive already regulates essential entities, space operators already fall inside its scope, and a second bespoke regime invites contradictory audits.
Operators can see the logic on both sides. NIS2 was drafted for hospitals, banks and cloud providers, and it says nothing about telemetry links, uplink jamming or what happens when an adversary takes command of a spacecraft. A regime written for terrestrial networks may simply miss the attack surface that matters in orbit. Equally, nobody in the industry wants to answer two regulators asking overlapping questions in different formats.
Debris rules have proved less divisive. The proposal obliges operators to plan disposal at end of life, to limit fragmentation risk and to carry insurance proportionate to the hazard they create. Constellation operators dislike the compliance cost but rarely dispute the principle, because a cascade in low Earth orbit destroys their business faster than any regulator could.
Market access remains the quiet battleground. The Commission’s text applies to any operator providing services in the Union, which pulls American and Asian constellations into a European authorisation process for the first time. Council drafts have softened the equivalence machinery, allowing third-country regimes deemed comparable to substitute for full EU authorisation. How generous that carve-out ends up will determine whether the Space Act reads as a genuine single market instrument or as a soft trade barrier.
The Commission’s own file page still describes the proposal in its original form, which tells you how much of the negotiation has happened out of public view. Parliament’s legislative train entry tracks the procedural steps but not the compromise texts.
For a sector that competes on launch cadence, the timing matters more than the drafting. Every quarter the Space Act spends in trilogue is a quarter in which European start-ups plan around rules nobody can quote. Investors price that uncertainty, and they price it against jurisdictions where the licensing question was settled years ago.
