EU Cybersecurity and Critical Infrastructure Resilience

Cybersecurity crosses internal-market, security and national-security boundaries. Much EU legislation uses Article 114 TFEU because divergent national requirements can fragment the internal market. Article 16 supports data-protection rules, Article 196 supports civil-protection cooperation and Article 222 contains the solidarity clause for disasters and terrorist attacks. National security remains the sole responsibility of each Member State under Article 4(2) TEU. EU cyber law therefore raises common civilian resilience without creating an EU intelligence service or transferring all incident command to Brussels.

The working model has four stages: reduce risk before an incident, detect and share relevant information, coordinate response when impacts cross borders, and restore services. Member States designate competent authorities, single points of contact and computer security incident response teams. The Commission oversees EU law and may adopt specified implementing acts. ENISA—the European Union Agency for Cybersecurity—supports expertise, exercises, vulnerability coordination and cooperation. EU-CyCLONe links national crisis-management authorities for large-scale incidents; the CSIRTs Network supports technical operational cooperation.

Directive (EU) 2022/2555, known as NIS2, seeks a high common level of cybersecurity across the Union. It expands covered sectors and divides covered organisations into essential and important entities. The classification affects the supervisory regime, not the basic need to manage risk. Sectors include energy, transport, health, digital infrastructure, public administration, drinking water, wastewater, postal services, manufacturing of certain critical products and digital providers. Size thresholds and specific inclusions or exclusions matter; not every small organisation is automatically covered.

Entities must use proportionate technical, operational and organisational measures. The directive lists incident handling, business continuity, supply-chain security, vulnerability handling, encryption where appropriate, access control, asset management and staff awareness. Management bodies approve and oversee measures and can be held accountable under national transposition. Significant incidents follow a staged notification model: an early warning within 24 hours of awareness, an incident notification within 72 hours and a final report normally within one month. Candidates should not collapse these into one deadline.

NIS2 is a directive. Member States had to transpose it by 17 October 2024 and apply national measures from 18 October 2024. Rights and duties are enforced principally through national law. Incomplete transposition does not turn the directive into a regulation; it creates an implementation problem subject to EU-law remedies and possible infringement action.

Regulation (EU) 2024/2847—the Cyber Resilience Act or CRA—takes a product-market approach. It covers hardware and software products with digital elements placed on the EU market, subject to defined exclusions and interactions with sectoral law. Manufacturers must design and produce secure products, assess cyber risks, manage vulnerabilities and provide security updates for the support period. Importers and distributors have verification duties. Conformity assessment and CE marking connect cyber requirements to normal Single Market product enforcement.

Entry into force is not the same as full application. The CRA entered into force on 10 December 2024. Rules on notifying conformity-assessment bodies applied from 11 June 2026. Article 14 reporting duties for actively exploited vulnerabilities and severe incidents apply from 11 September 2026. Most obligations apply from 11 December 2027. On this briefing’s update date, the September reporting duties were imminent but not yet applicable.

Directive (EU) 2022/2557, the Critical Entities Resilience or CER Directive, addresses the ability of identified entities to prevent, protect against, respond to, resist, mitigate, absorb, accommodate and recover from incidents. Its all-hazards scope includes natural hazards, accidents, public-health emergencies, sabotage and terrorism. Member States conduct risk assessments, adopt strategies and identify critical entities in listed sectors. Identified entities then assess risks, take proportionate measures and notify disruptive incidents.

CER and NIS2 were designed to work together. CER focuses mainly on non-cyber resilience; NIS2 focuses on network and information systems. National authorities must cooperate and exchange relevant information. The directives do not mean that every entity in a listed sector has identical obligations. Identification, size rules, sectoral provisions and national transposition determine coverage.

Regulation (EU) 2025/38, the Cyber Solidarity Act, has applied since 4 February 2025. It establishes a European Cybersecurity Alert System, preparedness measures and an EU Cybersecurity Reserve of trusted incident-response providers. It also supports review of significant or large-scale incidents. The reserve supplements, rather than replaces, national capabilities. Requests, eligibility, contracting and confidentiality follow the regulation and its implementation arrangements.

Crisis language must be precise. A significant incident under NIS2 concerns serious disruption, loss or damage for an entity or others. A large-scale incident exceeds one Member State’s capacity or significantly affects at least two Member States. Political coordination may also use the Council’s Integrated Political Crisis Response arrangements. The EU’s 2019 cyber-diplomacy toolbox can support external-relations responses, including restrictive measures, but attribution and sanctions are political and legal decisions, not ENISA technical findings.

On 20 January 2026 the Commission proposed a revision of the 2019 Cybersecurity Act. The proposal aims to streamline EU certification, address security risks in information and communication technology supply chains and reinforce ENISA. It was still subject to Parliament and Council examination on 17 August 2026. Existing Regulation (EU) 2019/881 remained the applicable Cybersecurity Act unless and until amended.

On 7 July 2026 the Commission presented an action plan on advanced artificial intelligence and cybersecurity. It covers model evaluation, structured access to advanced models for defenders, secure testing with ENISA and the Joint Research Centre, faster vulnerability remediation and stronger European AI capability. The action plan builds on existing law; it is not itself a new regulation. Separately, implementation work continued for the CRA reporting platform, the Cybersecurity Reserve and national NIS2 frameworks.

Ask what is being protected. For a covered service provider, start with NIS2. For connected hardware or software placed on the market, start with the CRA. For physical and all-hazards resilience of an identified critical entity, start with CER. For cross-border detection and emergency support, consider the Cyber Solidarity Act. Then identify whether the responsible actor is a manufacturer, regulated entity, Member State authority, CSIRT, ENISA, Commission or co-legislator. Finish by checking whether the rule was proposed, in force or already applicable on the relevant date.