What the Proposed Cybersecurity Act 2 Would Change
On January 20, 2026, the European Commission presented its proposal for a new Cybersecurity Act. The regulation would fully replace the Cybersecurity Act (CSA) of 2019 and bring one fundamental change: for the first time, it would set up a binding framework for the security of ICT supply chains. This has direct consequences for telecommunications providers and, in the longer term, for all critical sectors.
Contents
The context
EU cybersecurity regulation has changed fundamentally since 2019. With NIS2, the Cyber Resilience Act, the Digital Operational Resilience Act (DORA), and many sector-specific rules, a complex web of regulation has emerged. Later legislation kept assigning new tasks to ENISA without adjusting its original mandate. The only certification scheme adopted so far, the EUCC, did not arrive until early 2024, almost five years after the CSA entered into force. This shows the need for reform.
At the same time, the threat situation has worsened. The Commission points to the Draghi report, which identifies reducing dependencies as a central field of action. It also points to the ProtectEU and Preparedness Union strategies, which put cybersecurity at the center of Europe's resilience agenda.
The four pillars of the proposal
The proposal covers four areas. The ENISA reform is about a consolidated mandate. The agency would operate an early warning system, set up a ransomware helpdesk in cooperation with Europol, and take on the single reporting platform from the CRA. The proposal provides for an 81.5% budget increase and 118 additional full-time positions.
The certification framework, the European Cybersecurity Certification Framework (ECCF), would be fundamentally revised so that new schemes can be developed within 12 months. Of particular interest is the planned addition of “cyber posture” certification for operators, described below.
To simplify compliance, targeted amendments to NIS2 would ease the burden on around 28,700 companies. The Commission estimates the possible savings at €14.6 billion.
The real novelty, however, is the proposed ICT supply chain framework: a horizontal framework that addresses non-technical risks in supply chains for the first time.
The supply chain framework
The framework targets entities under Annexes I and II of NIS2. They would no longer be allowed to use components from high-risk suppliers in so-called “key ICT assets”. Manufacturers would not be addressed directly. In practice, though, they would lose their European market as soon as they are classified as a high-risk supplier.
The proposal sets out a multi-step process. Coordinated EU risk assessments would identify third countries that pose a “serious and structural non-technical risk” to ICT supply chains. The criteria in the proposal include laws that require companies to report vulnerabilities to state authorities, a lack of democratic checks and balances, and proven activity by state-controlled threat actors.
If a country is classified this way, companies based there or controlled from there would face far-reaching consequences. They could not receive EU funding, take part in public procurement, obtain ECCF certification, or contribute to EU cybersecurity standards.
For 5G, fixed, and satellite networks, the proposal goes especially far. Its Annex II defines which components count as key ICT assets, from core network functions and radio access networks to cryptographic products for satellite telemetry. For these assets, the proposal requires a mandatory phase-out of high-risk components, within 36 months for 5G. The Commission could set similar requirements for other sectors by implementing act.
Certification in two directions
The proposal clearly distinguishes between manufacturers and operators. For manufacturers, it provides for product certification that is explicitly linked to the CRA: ECCF certificates could serve as evidence of conformity. The proposal leaves open whether established standards such as IEC 62443-4-1 will feed into future schemes.
For operators, the planned cyber posture certification offers a new option. They could demonstrate NIS2 compliance with a certificate, regardless of which products they use. That would be a paradigm shift: away from purely technical product certification and toward certifying organizational security measures.
Strategic assessment
The proposal would effectively codify the 5G Toolbox approach, whose voluntary implementation the Commission considers insufficient. No countries are named explicitly, but the criteria clearly target jurisdictions such as China and Russia.
The economic impact would be considerable. The Commission estimates the costs for mobile network operators at €3.4 billion to €4.3 billion per year. At the same time, it expects investments of up to €2 billion per year in trusted European suppliers, a market that would open up for companies with the right positioning.
What companies can do now
Telecommunications providers would be directly affected. An inventory of the components in use and their origin already makes sense. The direct supplier is not the only thing that counts: a European integrator with a Chinese parent company would also fall under the rules.
Other NIS2 entities would have more time, but they should analyze their supply chains for dependencies on suppliers from critical jurisdictions. In the medium term, the planned cyber posture certification could open an efficient route to compliance.
Manufacturers would be affected indirectly, through lost sales markets. If you can position yourself as a trusted supplier and document this through certification, you would have a clear competitive advantage. An existing IEC 62443 certification provides a solid basis for this.
Outlook
Experience suggests the legislative procedure will take 18 to 24 months, and the supply chain framework in particular is likely to meet resistance. Whatever the final text looks like, the direction is clear. The EU is moving from voluntary coordination to binding requirements, and companies that prepare early will be in a better position.
This article is based on the proposal for a regulation COM(2026) 11 final, its annexes, and the impact assessment SWD(2026) 11 published by the European Commission on January 20, 2026. The final rules may still change during the legislative procedure.
Further information:
