Cyber incidents across borders: the Cyber Solidarity Act

The legal framework

The Cyber Solidarity Act is Regulation (EU) 2025/38 of 19 December 2024 "laying down measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cyber threats and incidents". It was published in the Official Journal on 15 January 2025 and entered into force on 4 February 2025 (Article 26). It is funded through the Digital Europe Programme, Regulation (EU) 2021/694, which it amends (Article 22).

Unlike NIS2 or the Cyber Resilience Act, this Regulation imposes almost no duties on companies. It builds public capacity: tools, a reserve of incident responders and a review process. It matters to business in two ways. Entities covered by NIS2 can receive help when a serious incident hits, and providers of managed security services can be hired into the Reserve. The Regulation works on top of the NIS2 structures: it reuses NIS2's definitions of incident, significant incident and large-scale incident, and its tools feed the CSIRTs network and EU-CyCLONe, the network of national cyber crisis authorities (Article 1(4) and Article 2).

Three building blocks

Article 1(1) sets out three mechanisms.

1. The European Cybersecurity Alert System (Articles 3 to 9). A pan-European network of National Cyber Hubs and Cross-Border Cyber Hubs that Member States join on a voluntary basis (Article 3). A National Cyber Hub is a single entity under the authority of a Member State, such as a CSIRT. It collects and analyses information on threats and incidents and may cooperate with private entities, including sectoral communities of essential and important entities. Where appropriate and lawful, it may request or receive telemetry, sensor and logging data (Article 4(3)). A Cross-Border Cyber Hub brings together the hubs of at least three Member States under a written consortium agreement (Article 5). Hubs share information such as indicators of compromise, vulnerabilities and alerts, anonymised where appropriate (Article 6(1)). When they learn of a potential or ongoing large-scale incident, they warn Member States and the Commission through EU-CyCLONe and the CSIRTs network without undue delay (Article 7(2)). ENISA had to issue interoperability guidelines by 5 February 2026 (Article 6(4)).

2. The Cybersecurity Emergency Mechanism (Articles 10 to 20). It supports three types of action (Article 11):

• preparedness: voluntary coordinated preparedness testing of entities in the sectors of high criticality of NIS2 Annex I, such as penetration testing and threat assessment (Article 12), and other preparedness actions such as vulnerability monitoring, exercises and training, also for Annex II sectors (Article 13);
• response: the EU Cybersecurity Reserve of trusted managed security service providers (Article 14);
• mutual assistance: grants for technical help from one Member State to another affected by a significant or large-scale incident (Article 18).

3. The European Cybersecurity Incident Review Mechanism (Article 21). At the request of the Commission or EU-CyCLONe, and with the approval of the Member States concerned, ENISA reviews a significant or large-scale incident and reports on causes, known exploitable vulnerabilities and lessons learned (Article 21). It may consult affected entities. The report must not contain details of actively exploited vulnerabilities that remain unpatched, data can be anonymised on request, and a public version only contains reliable public information or information released with consent.

The EU Cybersecurity Reserve in detail

Who can ask. Not companies directly. The users are Member States' cyber crisis management authorities and CSIRTs, CERT-EU for the EU institutions, and authorities of third countries associated with the Digital Europe Programme where their agreement allows it (Article 14(3)). Member State users send their request through the NIS2 single point of contact (Article 15(3)).

For what. Response to, and initial recovery from, significant cybersecurity incidents, large-scale cybersecurity incidents and, for EU institutions and associated third countries, large-scale-equivalent incidents (Article 15(1)). A large-scale incident is one that exceeds a Member State's capacity to respond or has a significant impact on at least two Member States (NIS2, Article 6, point (7)). For Member State users, the services may only be used for entities in the NIS2 sectors of Annexes I and II (Article 16(8)).

Conditions. The user must take all appropriate measures to mitigate the incident itself (Article 15(2)). The request describes the affected entity, the potential impact including spillover to other Member States, the service needed and the mitigation already taken (Article 15(5)).

Speed and priority. The contracting authority (the Commission, or ENISA where the operation is entrusted to it) answers requests from Member State and EU users without delay and in any event within 48 hours (Article 16(1)). It weighs the scale and severity of the incident, the type of entity, with higher priority for essential entities under NIS2, the impact, the cross-border nature and risk of spillover, and the measures the user already took (Article 16(3)).

Contracts and liability. Services are delivered under specific agreements between the provider and the user, possibly also with the affected entity. Those agreements must include liability conditions and are based on ENISA templates (Article 16(5) and (6)). The Commission, ENISA and the users bear no contractual liability for damage caused to third parties by the services (Article 16(7)). Within two months after the support ends, the user reports on the service, results and lessons learned (Article 16(9)).

Joining the Reserve as a provider

Managed security service providers are selected through public procurement. The procurement documents must require, among other things (Article 17(2)):

• personnel with the highest professional integrity, independence and technical competence;
• protection of confidential and classified information, also by subsidiaries and subcontractors;
• a transparent governance structure without conflicts of interest;
• security clearance where a Member State requires it, and a relevant level of IT security;
• hardware and software without known exploitable vulnerabilities, with the latest security updates and in line with the Cyber Resilience Act;
• experience with national authorities or entities in critical sectors, and the ability to deploy quickly and in the required languages;
• certification under a European scheme for managed security services within two years of that scheme applying, once such a scheme exists;
• conditions for converting unused response services into preparedness services, such as exercises or training.

In practice

A Belgian hospital group suffers a ransomware attack that takes down patient systems in Belgium and a clinic it runs in Luxembourg. It notifies its CSIRT under NIS2 within 24 hours. The national authorities judge the incident large-scale because it affects two Member States, and request support from the EU Cybersecurity Reserve through the single point of contact, describing the mitigation the hospital has already done. Within 48 hours they hear whether the request is granted. A trusted provider is deployed under an agreement with the CSIRT and the hospital. The hospital remains responsible for its own GDPR and NIS2 notifications.

A mid-sized managed security service provider in Ghent wants to join the Reserve. It prepares for the tender by documenting its incident response team's experience with critical-sector clients, its confidentiality arrangements with subcontractors, its own security level and its patching. It plans for the certification requirement once a European scheme for managed security services applies.

An energy distribution company is invited to take part in coordinated preparedness testing in its sector. Participation is voluntary. If the test leads to recommendations, the national authority may review how the company follows them up (Article 12(7)).

Practical steps

1. Keep your NIS2 incident reporting sharp: Reserve support starts from an incident the authorities know about.
2. Know your national single point of contact and CSIRT, and how to escalate.
3. Prepare to work alongside an external response team: access rights, evidence handling, confidentiality and a named internal lead.
4. Check your cyber insurance and incident response retainers for how they interact with outside help.
5. If you are a security provider, map your offer against Article 17(2) before calls for tenders appear.

Contracts

If Reserve responders work on your systems, the agreement may be three-way, with the CSIRT and the provider. Check the liability conditions in the ENISA template carefully, because the Commission, ENISA and the users carry no contractual liability towards third parties. Align your own service contracts: your retained incident response provider and your outsourcing partners should accept cooperation with outside responders and access to logs.

Frequently asked questions

Can my company ask the EU Cybersecurity Reserve for help?

Not directly. The request comes from your Member State's cyber crisis management authority or CSIRT, sent through the NIS2 single point of contact (Articles 14(3) and 15(3)).

Does the Cyber Solidarity Act add reporting duties for companies?

No. Reporting duties come from NIS2, the Cyber Resilience Act and the GDPR. The Cyber Solidarity Act uses the information that flows through the NIS2 bodies.

Do we have to share data with a National Cyber Hub?

The Regulation provides for cooperation and information sharing with private entities, and hubs may request or receive telemetry, sensor and logging data where appropriate and lawful (Article 4(3)). It does not itself impose a general duty on companies to share.

Is preparedness testing mandatory?

No. Coordinated preparedness testing is voluntary for Member States and is supported through grants (Article 12(3) and (4)).

How this connects

When an incident crosses borders, timing and consistency matter. Our data breach response team coordinates the NIS2, CRA and GDPR notifications, and the breach workflow keeps the incident record that authorities and outside responders rely on. Our commercial contracts team reviews response agreements and outsourcing terms, and the rights and obligations register keeps track of cooperation and confidentiality duties.

At a glance

Provisions cited: Regulation (EU) 2025/38, Articles 1 to 7, 11 to 18, 21, 22 and 26; Directive (EU) 2022/2555, Article 6, point (7).

Key dates: adopted 19 December 2024; published 15 January 2025; in force 4 February 2025; ENISA interoperability guidelines by 5 February 2026; first Commission evaluation by 5 February 2027 (Article 25).

Related: the NIS2 Directive, the 2026 cybersecurity package, Cyber Resilience Act II, vulnerability handling and reporting and the 72-hour rule for personal data breaches.