Loading...
Proposal to amend Regulation (EU) 2019/881 (Cybersecurity Act)
The proposed Cybersecurity Act 2.0 expands the original Cybersecurity Act with a focus on ICT supply chain security, high-risk third-country supplier restrictions, expanded EUCS certification, and enhanced ENISA powers. It introduces mandatory security assessments for key ICT assets and restricts high-risk suppliers from standardisation and certification activities.
150+
Projected Articles
50K+
Organizations Affected
27+EEA
Member States
2027-28
Expected
20 January 2026
Commission proposes CSA 2.0 (COM(2026) 11)
Q1 2026
European Parliament and Council begin legislative procedure
2026-2027
Trilogue negotiations (projected)
2027-2028
Expected implementation phase (projected)
Identification of key ICT assets by Commission risk assessments, designation of high-risk supplier countries, restrictions on high-risk suppliers in key asset procurement, supplier diversification mandates.
Exclusion from EU standardisation work, cybersecurity certification functions, public procurement for key ICT assets, restrictions on sensitive data transfers.
EUCS elevated from voluntary to compliance instrument, 5G certification scheme expansion, organizational cybersecurity posture certification, simplified SME processes.
Security-by-design principles for ICT products, vulnerability disclosure and patching timelines, testing and validation requirements, manufacturer liability for security design failures.
EUR 10 million or 2-3% turnover (est.)
High-risk supplier usage, failure to implement mitigation measures
EUR 5-10 million or 1-2% turnover (est.)
Inaccurate certification, false conformity declarations
EUR 5-20 million or 2-5% turnover (est.)
Distribution with known vulnerabilities, failure to patch
We provide structured preparation and compliance support for CSA 2.0.
Schedule a consultation with our regulatory experts to assess your CSA 2.0 compliance posture and build a practical roadmap.