November 7, 2026

Newsletter

The European Post

Policy • Diplomacy • strategic insight

LATEST
Teacher Shortages Put The EU Teachers Agenda To The TestKingspan Fine And KKR Charge Put EU Merger Control To WorkMEPs Near First Vote On EU Space Act In Parliament Industry CommitteeMercosur Safeguard Rules Let EU Curb Surges In Car And Goods ImportsMontenegro And Albania Receive EU Accession Roadmaps From CommissionHelsinki Presses Washington Over Paid-For Patriot InterceptorsMeloni Letter Exposes The EU Single Voice Problem On UkraineEmissions Trading Link Defines The EU-UK Summit Agenda For 20 NovemberAddis Ababa Talks Test The EU-African Union Partnership PlanDark Patterns Face Reform As Digital Fairness Act NearsLong-Term EU Budget Talks Face A December DeadlineReturn Hubs Plan Reshapes EU Deportation Rules After DealFishing Sector Gets Vision 2040 Fisheries Strategy With €2bn FloorNominations Open For The Next European Research Council PresidentInvestFrontier Launch Pulls Private Capital Into Humanitarian AidYoung Farmers Targeted By 10 Share In Post-2027 CAP PlanCOP17 Biodiversity Deal Leaves Nature Finance Gap OpenParliament Backs High-Speed Rail Network Linking CapitalsEnergy And Tyre Labelling Gets Simpler Rules In Council MandateEU Defence Readiness Goal For 2030 Slips Despite €418 Billion OutlayTeacher Shortages Put The EU Teachers Agenda To The TestKingspan Fine And KKR Charge Put EU Merger Control To WorkMEPs Near First Vote On EU Space Act In Parliament Industry CommitteeMercosur Safeguard Rules Let EU Curb Surges In Car And Goods ImportsMontenegro And Albania Receive EU Accession Roadmaps From CommissionHelsinki Presses Washington Over Paid-For Patriot InterceptorsMeloni Letter Exposes The EU Single Voice Problem On UkraineEmissions Trading Link Defines The EU-UK Summit Agenda For 20 NovemberAddis Ababa Talks Test The EU-African Union Partnership PlanDark Patterns Face Reform As Digital Fairness Act NearsLong-Term EU Budget Talks Face A December DeadlineReturn Hubs Plan Reshapes EU Deportation Rules After DealFishing Sector Gets Vision 2040 Fisheries Strategy With €2bn FloorNominations Open For The Next European Research Council PresidentInvestFrontier Launch Pulls Private Capital Into Humanitarian AidYoung Farmers Targeted By 10 Share In Post-2027 CAP PlanCOP17 Biodiversity Deal Leaves Nature Finance Gap OpenParliament Backs High-Speed Rail Network Linking CapitalsEnergy And Tyre Labelling Gets Simpler Rules In Council MandateEU Defence Readiness Goal For 2030 Slips Despite €418 Billion Outlay
November 7, 2026

Newsletter

The European Post

Policy • Diplomacy • strategic insight

LATEST
Teacher Shortages Put The EU Teachers Agenda To The TestKingspan Fine And KKR Charge Put EU Merger Control To WorkMEPs Near First Vote On EU Space Act In Parliament Industry CommitteeMercosur Safeguard Rules Let EU Curb Surges In Car And Goods ImportsMontenegro And Albania Receive EU Accession Roadmaps From CommissionHelsinki Presses Washington Over Paid-For Patriot InterceptorsMeloni Letter Exposes The EU Single Voice Problem On UkraineEmissions Trading Link Defines The EU-UK Summit Agenda For 20 NovemberAddis Ababa Talks Test The EU-African Union Partnership PlanDark Patterns Face Reform As Digital Fairness Act NearsLong-Term EU Budget Talks Face A December DeadlineReturn Hubs Plan Reshapes EU Deportation Rules After DealFishing Sector Gets Vision 2040 Fisheries Strategy With €2bn FloorNominations Open For The Next European Research Council PresidentInvestFrontier Launch Pulls Private Capital Into Humanitarian AidYoung Farmers Targeted By 10 Share In Post-2027 CAP PlanCOP17 Biodiversity Deal Leaves Nature Finance Gap OpenParliament Backs High-Speed Rail Network Linking CapitalsEnergy And Tyre Labelling Gets Simpler Rules In Council MandateEU Defence Readiness Goal For 2030 Slips Despite €418 Billion OutlayTeacher Shortages Put The EU Teachers Agenda To The TestKingspan Fine And KKR Charge Put EU Merger Control To WorkMEPs Near First Vote On EU Space Act In Parliament Industry CommitteeMercosur Safeguard Rules Let EU Curb Surges In Car And Goods ImportsMontenegro And Albania Receive EU Accession Roadmaps From CommissionHelsinki Presses Washington Over Paid-For Patriot InterceptorsMeloni Letter Exposes The EU Single Voice Problem On UkraineEmissions Trading Link Defines The EU-UK Summit Agenda For 20 NovemberAddis Ababa Talks Test The EU-African Union Partnership PlanDark Patterns Face Reform As Digital Fairness Act NearsLong-Term EU Budget Talks Face A December DeadlineReturn Hubs Plan Reshapes EU Deportation Rules After DealFishing Sector Gets Vision 2040 Fisheries Strategy With €2bn FloorNominations Open For The Next European Research Council PresidentInvestFrontier Launch Pulls Private Capital Into Humanitarian AidYoung Farmers Targeted By 10 Share In Post-2027 CAP PlanCOP17 Biodiversity Deal Leaves Nature Finance Gap OpenParliament Backs High-Speed Rail Network Linking CapitalsEnergy And Tyre Labelling Gets Simpler Rules In Council MandateEU Defence Readiness Goal For 2030 Slips Despite €418 Billion Outlay

Cybersecurity Act Revision Puts High-Risk Suppliers on Notice

Erika Salumäe
Senior Analyst, Digital and Technology

The Cybersecurity Act revision proposed by the European Commission on 20 January 2026 would, for the first time, let the Union restrict suppliers on grounds that are political as much as technical. Nearly ten months on, the file deserves attention from every operator of critical infrastructure, because it changes how supply chain risk is judged under the NIS2 Directive.

The package has two parts: a rewritten Cybersecurity Act and targeted amendments to NIS2. Published summaries stress that the proposal is meant to strengthen resilience against cyber and hybrid threats to essential services and democratic institutions, while also trimming compliance costs for smaller firms.

How the Cybersecurity Act revision defines high-risk suppliers

The central novelty is a horizontal framework for trusted ICT supply chains across the sectors covered by NIS2. Law-firm analysis describes it as the first attempt in EU law to address non-technical risks, such as undue foreign interference and critical dependencies.

Through implementing acts, the Commission would designate third countries that pose cybersecurity concerns, high-risk suppliers linked to those countries, and key ICT assets used by regulated entities. Consequences for a designated supplier could include exclusion from procurement for key components, exclusion from EU funding, and a bar on obtaining EU cybersecurity certification. Operators of electronic communications networks would have to avoid relying on such suppliers for critical assets. Breaches could draw fines of up to 7 percent of worldwide turnover, according to one published summary.

This design of the Cybersecurity Act revision matters because it moves decisions from national toolboxes, such as those used for 5G, to a single Union procedure. Supporters see consistency. Sceptics will ask how objective criteria can be when designation depends on a supplier’s relationship with a country.

A stronger ENISA and a wider certification scheme

The proposal gives the EU Agency for Cybersecurity, ENISA, a much larger operational role. Its budget would rise by more than 75 percent, and each member state would name two liaison officers. ENISA would manage European repositories of threats and incidents, issue EU-wide early warnings, coordinate exercises and operate the single incident-notification platform foreseen in other digital legislation.

Certification also changes under the Cybersecurity Act revision. Entities could certify their overall cybersecurity posture, not only products and services, and such certificates could help show conformity with NIS2. ENISA would normally have 12 months to prepare a candidate scheme after a Commission request. Certification stays voluntary in principle, yet procurement rules and market expectations could make it close to mandatory in practice.

NIS2 amendments and compliance costs

The NIS2 changes that travel with the Cybersecurity Act revision aim to reduce friction. A new category of small mid-cap enterprises would carry lighter obligations, jurisdiction rules would be simplified, and ransomware data collection would be streamlined. The scope would extend, regardless of size, to providers of digital and business wallets, submarine infrastructure operators and dual-use infrastructure, with clarifications for electricity above 1 megawatt, hydrogen, healthcare and chemicals. Member states would also need policies for migration to post-quantum cryptography.

What happens next

The sources reviewed for this article date from February and March 2026, and none confirms a Council general approach or a Parliament position, so readers should check the legislative tracker for current status. Three questions will shape the outcome for the Cybersecurity Act revision. Will co-legislators accept implementing-act designation of suppliers, or demand a role for member states? Will the 7 percent ceiling survive? And will the scope extensions be reconciled with the simplification promised to small mid-caps?

Until those answers arrive, companies in energy, transport, health and telecoms can start by mapping where critical ICT assets come from. If the Cybersecurity Act revision passes in anything like its present form, supplier concentration will become a compliance issue as much as a commercial one.

Comments