--- title: "Cyber incidents across borders: the Cyber Solidarity Act" description: "What Regulation (EU) 2025/38 sets up, the European Cybersecurity Alert System, the Cybersecurity Emergency Mechanism with the EU Cybersecurity Reserve and the…" url: https://pitch.law/academy/cyber-solidarity-act --- [pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [Data](https://pitch.law/academy/topics/information-technology) # Cyber incidents across borders: the Cyber Solidarity Act What Regulation (EU) 2025/38 sets up, the European Cybersecurity Alert System, the Cybersecurity Emergency Mechanism with the EU Cybersecurity Reserve and the incident review mechanism, how a company hit by a major incident can benefit, and what it means for managed security service providers. - - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law - 13 November 2026 - Updated 13-11-2026 ## The legal framework The Cyber Solidarity Act is [Regulation (EU) 2025/38](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025R0038) of 19 December 2024 "laying down measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cyber threats and incidents". It was published in the Official Journal on 15 January 2025 and entered into force on 4 February 2025 ([Article 26](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0038#art_26)). It is funded through the Digital Europe Programme, [Regulation (EU) 2021/694](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021R0694), which it amends ([Article 22](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0038#art_22)). Unlike NIS2 or the Cyber Resilience Act, this Regulation imposes almost no duties on companies. It builds public capacity: tools, a reserve of incident responders and a review process. It matters to business in two ways. Entities covered by [NIS2](https://pitch.law/academy/the-nis2-directive-towards-a-firmer-eu-wide-cybersecurity-framework) can receive help when a serious incident hits, and providers of managed security services can be hired into the Reserve. The Regulation works on top of the NIS2 structures: it reuses NIS2's definitions of incident, significant incident and large-scale incident, and its tools feed the CSIRTs network and EU-CyCLONe, the network of national cyber crisis authorities ([Article 1(4)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0038#art_1) and [Article 2](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0038#art_2)). ### Three building blocks Article 1(1) sets out three mechanisms. **1. The European Cybersecurity Alert System (Articles 3 to 9).** A pan-European network of National Cyber Hubs and Cross-Border Cyber Hubs that Member States join on a voluntary basis ([Article 3](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0038#art_3)). A National Cyber Hub is a single entity under the authority of a Member State, such as a CSIRT. It collects and analyses information on threats and incidents and may cooperate with private entities, including sectoral communities of essential and important entities. Where appropriate and lawful, it may request or receive telemetry, sensor and logging data ([Article 4(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0038#art_4)). A Cross-Border Cyber Hub brings together the hubs of at least three Member States under a written consortium agreement ([Article 5](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0038#art_5)). Hubs share information such as indicators of compromise, vulnerabilities and alerts, anonymised where appropriate ([Article 6(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0038#art_6)). When they learn of a potential or ongoing large-scale incident, they warn Member States and the Commission through EU-CyCLONe and the CSIRTs network without undue delay ([Article 7(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0038#art_7)). ENISA had to issue interoperability guidelines by 5 February 2026 (Article 6(4)). **2. The Cybersecurity Emergency Mechanism (Articles 10 to 20).** It supports three types of action ([Article 11](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0038#art_11)): - **preparedness:** voluntary coordinated preparedness testing of entities in the sectors of high criticality of NIS2 Annex I, such as penetration testing and threat assessment ([Article 12](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0038#art_12)), and other preparedness actions such as vulnerability monitoring, exercises and training, also for Annex II sectors ([Article 13](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0038#art_13)); - **response:** the **EU Cybersecurity Reserve** of trusted managed security service providers ([Article 14](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0038#art_14)); - **mutual assistance:** grants for technical help from one Member State to another affected by a significant or large-scale incident ([Article 18](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0038#art_18)). **3. The European Cybersecurity Incident Review Mechanism (Article 21).** At the request of the Commission or EU-CyCLONe, and with the approval of the Member States concerned, ENISA reviews a significant or large-scale incident and reports on causes, known exploitable vulnerabilities and lessons learned ([Article 21](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0038#art_21)). It may consult affected entities. The report must not contain details of actively exploited vulnerabilities that remain unpatched, data can be anonymised on request, and a public version only contains reliable public information or information released with consent. ### The EU Cybersecurity Reserve in detail **Who can ask.** Not companies directly. The users are Member States' cyber crisis management authorities and CSIRTs, CERT-EU for the EU institutions, and authorities of third countries associated with the Digital Europe Programme where their agreement allows it (Article 14(3)). Member State users send their request through the NIS2 single point of contact ([Article 15(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0038#art_15)). **For what.** Response to, and initial recovery from, significant cybersecurity incidents, large-scale cybersecurity incidents and, for EU institutions and associated third countries, large-scale-equivalent incidents (Article 15(1)). A large-scale incident is one that exceeds a Member State's capacity to respond or has a significant impact on at least two Member States ([NIS2, Article 6, point (7)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2555#art_6)). For Member State users, the services may only be used for entities in the NIS2 sectors of Annexes I and II ([Article 16(8)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0038#art_16)). **Conditions.** The user must take all appropriate measures to mitigate the incident itself (Article 15(2)). The request describes the affected entity, the potential impact including spillover to other Member States, the service needed and the mitigation already taken (Article 15(5)). **Speed and priority.** The contracting authority (the Commission, or ENISA where the operation is entrusted to it) answers requests from Member State and EU users without delay and in any event within **48 hours** (Article 16(1)). It weighs the scale and severity of the incident, the type of entity, with higher priority for essential entities under NIS2, the impact, the cross-border nature and risk of spillover, and the measures the user already took (Article 16(3)). **Contracts and liability.** Services are delivered under specific agreements between the provider and the user, possibly also with the affected entity. Those agreements must include liability conditions and are based on ENISA templates (Article 16(5) and (6)). The Commission, ENISA and the users bear no contractual liability for damage caused to third parties by the services (Article 16(7)). Within two months after the support ends, the user reports on the service, results and lessons learned (Article 16(9)). ### Joining the Reserve as a provider Managed security service providers are selected through public procurement. The procurement documents must require, among other things ([Article 17(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0038#art_17)): - personnel with the highest professional integrity, independence and technical competence; - protection of confidential and classified information, also by subsidiaries and subcontractors; - a transparent governance structure without conflicts of interest; - security clearance where a Member State requires it, and a relevant level of IT security; - hardware and software without known exploitable vulnerabilities, with the latest security updates and in line with the Cyber Resilience Act; - experience with national authorities or entities in critical sectors, and the ability to deploy quickly and in the required languages; - certification under a European scheme for managed security services within two years of that scheme applying, once such a scheme exists; - conditions for converting unused response services into preparedness services, such as exercises or training. ## In practice A Belgian hospital group suffers a ransomware attack that takes down patient systems in Belgium and a clinic it runs in Luxembourg. It notifies its CSIRT under NIS2 within 24 hours. The national authorities judge the incident large-scale because it affects two Member States, and request support from the EU Cybersecurity Reserve through the single point of contact, describing the mitigation the hospital has already done. Within 48 hours they hear whether the request is granted. A trusted provider is deployed under an agreement with the CSIRT and the hospital. The hospital remains responsible for its own GDPR and NIS2 notifications. A mid-sized managed security service provider in Ghent wants to join the Reserve. It prepares for the tender by documenting its incident response team's experience with critical-sector clients, its confidentiality arrangements with subcontractors, its own security level and its patching. It plans for the certification requirement once a European scheme for managed security services applies. An energy distribution company is invited to take part in coordinated preparedness testing in its sector. Participation is voluntary. If the test leads to recommendations, the national authority may review how the company follows them up (Article 12(7)). ### Practical steps 1. Keep your NIS2 incident reporting sharp: Reserve support starts from an incident the authorities know about. 2. Know your national single point of contact and CSIRT, and how to escalate. 3. Prepare to work alongside an external response team: access rights, evidence handling, confidentiality and a named internal lead. 4. Check your cyber insurance and incident response retainers for how they interact with outside help. 5. If you are a security provider, map your offer against Article 17(2) before calls for tenders appear. ### Contracts If Reserve responders work on your systems, the agreement may be three-way, with the CSIRT and the provider. Check the liability conditions in the ENISA template carefully, because the Commission, ENISA and the users carry no contractual liability towards third parties. Align your own service contracts: your retained incident response provider and your outsourcing partners should accept cooperation with outside responders and access to logs. ## Frequently asked questions ### Can my company ask the EU Cybersecurity Reserve for help? Not directly. The request comes from your Member State's cyber crisis management authority or CSIRT, sent through the NIS2 single point of contact (Articles 14(3) and 15(3)). ### Does the Cyber Solidarity Act add reporting duties for companies? No. Reporting duties come from NIS2, the Cyber Resilience Act and the GDPR. The Cyber Solidarity Act uses the information that flows through the NIS2 bodies. ### Do we have to share data with a National Cyber Hub? The Regulation provides for cooperation and information sharing with private entities, and hubs may request or receive telemetry, sensor and logging data where appropriate and lawful (Article 4(3)). It does not itself impose a general duty on companies to share. ### Is preparedness testing mandatory? No. Coordinated preparedness testing is voluntary for Member States and is supported through grants (Article 12(3) and (4)). ## How this connects When an incident crosses borders, timing and consistency matter. Our [data breach response](https://pitch.law/solutions/data-breach-response-enforcement) team coordinates the NIS2, CRA and GDPR notifications, and the [breach workflow](https://pitch.law/technologies/breach-response-workflow) keeps the incident record that authorities and outside responders rely on. Our [commercial contracts](https://pitch.law/solutions/commercial-contracts-transactions) team reviews response agreements and outsourcing terms, and the [rights and obligations register](https://pitch.law/technologies/contract-obligations) keeps track of cooperation and confidentiality duties. ### At a glance **Provisions cited:** Regulation (EU) 2025/38, Articles 1 to 7, 11 to 18, 21, 22 and 26; Directive (EU) 2022/2555, Article 6, point (7). **Key dates:** adopted 19 December 2024; published 15 January 2025; in force 4 February 2025; ENISA interoperability guidelines by 5 February 2026; first Commission evaluation by 5 February 2027 (Article 25). **Related:** [the NIS2 Directive](https://pitch.law/academy/the-nis2-directive-towards-a-firmer-eu-wide-cybersecurity-framework), [the 2026 cybersecurity package](https://pitch.law/academy/cybersecurity-act-revision-and-nis2-amendments), [Cyber Resilience Act II, vulnerability handling and reporting](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting) and [the 72-hour rule for personal data breaches](https://pitch.law/academy/data-breach-response-the-72-hour-countdown). ## In short - The three building blocks of Regulation (EU) 2025/38 - Who can ask for help from the EU Cybersecurity Reserve, and how - The 48-hour answer and the criteria for priority - What managed security service providers must offer to join the Reserve - How it connects to NIS2 reporting ## Related solutions - [Solutions](https://pitch.law/solutions/data-breach-response-enforcement) ### [Data Breach Response](https://pitch.law/solutions/data-breach-response-enforcement) [Help from the first hours of a personal data breach: assessment, notification to the authority and individuals, documentation, and action against the source.](https://pitch.law/solutions/data-breach-response-enforcement) - [Solutions](https://pitch.law/solutions/commercial-contracts-transactions) ### [Commercial Contracts & Transactions](https://pitch.law/solutions/commercial-contracts-transactions) [Supply, distribution, services, SaaS and procurement contracts, and the deals around them, drafted and reviewed with the IP, data and tax angles in view.](https://pitch.law/solutions/commercial-contracts-transactions) ## Our proprietary Legal Tech - [Technology](https://pitch.law/technologies/breach-response-workflow) ### [Data Breach Handling](https://pitch.law/technologies/breach-response-workflow) [A GDPR Article 33 and 34 workflow with a 72-hour countdown, a reference per breach and a structured notification to the supervisory authority, approved by a lawyer.](https://pitch.law/technologies/breach-response-workflow) - [Technology](https://pitch.law/technologies/contract-obligations) ### [Contract Management: Rights and Obligations](https://pitch.law/technologies/contract-obligations) [Once a contract is final, we pull out each party's duties and rights with the clause they come from, have a person confirm them, and follow them with reminders.](https://pitch.law/technologies/contract-obligations) ## More in Data - ### [Children Online: the EU KIDS Act Proposal and Age Verification](https://pitch.law/academy/children-online-kids-act-and-age-verification) [What the Digital Services Act already requires to protect minors, what the EU KIDS Act proposal of 17 September 2026 would add for social networks, video platforms, games, app stores and chatbots, and how the EU age verification framework fits in.](https://pitch.law/academy/children-online-kids-act-and-age-verification) - ### [The Cloud and AI Development Act: sovereignty rules for cloud and AI procurement](https://pitch.law/academy/cloud-and-ai-development-act) [What the Commission's proposal for a Cloud and AI Development Act would require of cloud providers that sell to the public sector, of contracting authorities, and of bidders for cloud and AI contracts, and how it sits next to the Data Act and the procurement Directive.](https://pitch.law/academy/cloud-and-ai-development-act) - ### [Cyber Resilience Act III: importers, distributors, open source and contracts](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source) [The duties of importers, distributors and authorised representatives under Articles 18 to 23 of Regulation (EU) 2024/2847, when a reseller becomes a manufacturer, how free and open-source software and its stewards are treated, and the clauses that follow.](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source) - ### [Cyber Resilience Act I: which products are caught, and in which class](https://pitch.law/academy/cyber-resilience-act-products-and-classes) [How to tell whether hardware or software you sell falls under Regulation (EU) 2024/2847, whether it is a default, important (class I or II) or critical product, and which conformity route follows from that, with the dates up to 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-products-and-classes) - ### [Cyber Resilience Act II: vulnerability handling and reporting since 11-09-2026](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting) [What manufacturers must report under Article 14 of Regulation (EU) 2024/2847 since 11 September 2026, within 24 hours, 72 hours, 14 days and one month, and the vulnerability handling duties of Annex I, Part II, that follow from 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting) - ### [The 2026 cybersecurity package: revised Cybersecurity Act and NIS2 amendments](https://pitch.law/academy/cybersecurity-act-revision-and-nis2-amendments) [What the Commission proposed on 20 January 2026 in COM(2026) 11 (the Cybersecurity Act 2, replacing Regulation (EU) 2019/881) and COM(2026) 13 (targeted amendments to the NIS2 Directive), where the procedures stand and what companies can prepare now.](https://pitch.law/academy/cybersecurity-act-revision-and-nis2-amendments) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://pitch.law/schedule)