The 2026 cybersecurity package: revised Cybersecurity Act and NIS2 amendments

The legal framework

On 20 January 2026 the Commission presented two linked proposals:

• COM(2026) 11 final of 20 January 2026, a Regulation "on the European Union Agency for Cybersecurity (ENISA), the European cybersecurity certification framework, and ICT supply chain security and repealing Regulation (EU) 2019/881 (The Cybersecurity Act 2)". Procedure 2026/0011(COD).
• COM(2026) 13 final of 20 January 2026, a Directive "amending Directive (EU) 2022/2555 as regards simplification measures and alignment with the [Proposal for the Cybersecurity Act 2]". Procedure 2026/0012(COD).

On 13 November 2026 the Legislative Observatory of the European Parliament shows both files at the stage "Awaiting committee decision". They are proposals. Nothing in them binds anyone yet, and the texts can change in Parliament and Council. Until adoption, the current Cybersecurity Act, Regulation (EU) 2019/881, and the NIS2 Directive, Directive (EU) 2022/2555, with the national laws that transpose it, continue to apply.

What the current Cybersecurity Act does

Regulation (EU) 2019/881 gives ENISA, the EU cybersecurity agency, its mandate, and sets up the European cybersecurity certification framework for ICT products, services and processes (Article 46). Schemes can use three assurance levels, "basic", "substantial" and "high" (Article 52). Self-assessment is possible only at level "basic" (Article 53). Certification is voluntary unless Union or national law says otherwise (Article 56(2)). The Cyber Resilience Act already relies on these schemes: an important product of class II can, for example, prove conformity with a certificate at level "substantial" (see part I of our CRA series).

The Cybersecurity Act 2: three titles that matter to business

The explanatory memorandum names four problems: a framework that no longer fits the threat landscape, the "stalled implementation" of the certification framework, the complexity of overlapping cybersecurity rules, and growing ICT supply chain risks. The proposal answers them in three parts.

ENISA (Title II). ENISA gets operational tasks. Among them: early alerts on threats (proposed Articles 11 and 12), operating the EU Cybersecurity Reserve and helping essential and important entities prepare for, respond to and recover from ransomware incidents (Article 13), the single reporting platform of the Cyber Resilience Act (Article 15), and a Union vulnerability management service (Article 16). It also gets tasks on individual cybersecurity skills attestations (Articles 19 to 23).

Certification (Title III). The framework is rebuilt and widened. Beyond ICT products, services and processes, schemes may cover managed security services and the cyber posture of entities (proposed Article 71). Where another Union act provides for it, a certificate demonstrates compliance and gives a presumption of conformity with that act, and the assessment for that purpose must be done by a third-party body (Article 78). Self-assessment stays limited to low-risk cases at assurance level "basic" (Article 83). After a detailed request from the Commission, ENISA is expected to deliver a candidate scheme within 12 months (explanatory memorandum, on Article 73).

ICT supply chain security (Title IV). This is the most far-reaching part. It targets "non-technical risks" in the supply chains of the sectors covered by NIS2:

• Union-level coordinated security risk assessments, requested by the Commission or at least three Member States (Articles 98 and 99);
• the possibility to designate, by implementing act, a third country "posing cybersecurity concerns to ICT supply chains", based on criteria such as laws requiring vulnerabilities to be reported to that state before they are known to be exploited (Article 100(1) and (2));
• high-risk suppliers may not hold European cybersecurity certificates, become accredited conformity assessment bodies, take part in public procurement for ICT components in key ICT assets, or receive Union funding for such components; existing certificates are withdrawn (Article 100(4) and (5));
• implementing acts that may prohibit specific types of NIS2 entities from using ICT components from high-risk suppliers in key ICT assets, with transition and phase-out periods (Article 103(1)), or impose other mitigating measures, such as transparency about suppliers, restrictions on data transfers and remote processing from third countries, and third-party audited technical measures (Article 103(2));
• for mobile networks, the phase-out period for components from high-risk suppliers in key ICT assets is at most 36 months from the publication of the list of high-risk suppliers for those networks (Article 110(3)).

Penalties are set by Member States, with maximums of 1%, 2% or 7% of worldwide annual turnover depending on the provision breached; 7% applies to breaches of a prohibition under Article 103(1) and of Article 111 (proposed Article 115). The proposal repeals Regulation (EU) 2019/881; the date is left open in the text (Article 121).

The NIS2 amendments (COM(2026) 13)

The Directive proposal makes targeted changes to NIS2:

• Small mid-caps. Annex I entities would be essential only if they exceed the ceilings for small mid-cap enterprises under Commission Recommendation (EU) 2025/1099. Entities in that band would therefore be important entities (amended Article 3(1)(a); recital 2).
• DNS service providers would no longer be covered regardless of size, so the general size-cap rule applies to them (amended Article 2(2)(a)(iii); recital 2).
• New entities regardless of size: providers of European Digital Identity Wallets and of European Business Wallets, as essential entities (amended Articles 2(2) and 3(1)(b)). Operators of submarine data transmission infrastructure are added to digital infrastructure in Annex I (new definition in Article 6, point (43); Annex to the proposal).
• Scope clarifications in the annexes: electricity producers only above 1 MW total generation capacity, a narrower description of healthcare providers, hydrogen undertakings and the chemicals sector (Annex to the proposal; recitals 3 and 4).
• Cyber posture certification. Member States may require entities to obtain a certificate on their cyber posture under a scheme of the Cybersecurity Act 2 to demonstrate compliance with Article 21. Where such a certificate covers the requirements, authorities may not order additional regular and targeted security audits under Article 32(2)(b) or 33(2)(b) for those requirements. The entity remains responsible for compliance (new Article 24(4) to (6)).
• Maximum harmonisation where the Commission adopts implementing acts on risk-management measures: Member States could then not add further technical, methodological or sectoral requirements (amended Articles 5 and 21(5)).
• Ransomware. Incident reports would include whether a ransomware attack was detected, the attack vector and whether mitigation was implemented. On request, entities would tell the CSIRT whether a ransom was demanded and by whom, and whether it was paid, how much, how and to whom (new Article 23(12) and (13)).
• Registration and the ENISA registry. The registration details of Article 3(4) are aligned, and ENISA would keep a registry of all essential and important entities (amended Articles 3(4) and 27).
• Cross-border supervision. ENISA would support mutual assistance and joint supervisory actions for entities active in several Member States (new Article 37a).
• Post-quantum cryptography becomes part of national cybersecurity strategies (amended Article 7(2)).

Member States would have 12 months after entry into force to transpose (proposed Article 2).

In practice

A Belgian electricity producer with 600 staff is an essential NIS2 entity today, as an Annex I entity above the ceilings for medium-sized enterprises. If the small mid-cap rule is adopted as proposed and the company falls within the small mid-cap thresholds, it would become an important entity, with supervision mainly after the fact. Its current duties stay in force until the Belgian NIS2 Law is amended.

A managed service provider active in Belgium, the Netherlands and France is supervised in each country today. The proposal would let it use a cyber posture certificate to show compliance with Article 21, where Member States opt for that route, and would give ENISA a role in joint supervision.

A telecom operator buys radio equipment from a supplier based in a third country. If that country is designated under Article 100 and the supplier is listed as high-risk, the operator could have to phase out the supplier's components from key ICT assets. Procurement teams should note which suppliers could be affected and how their contracts allow an exit.

What to do now

1. Keep complying with the current NIS2 law of each country where you operate. The proposals change nothing yet.
2. Follow both procedures on the Legislative Observatory pages above.
3. Check whether your group could qualify as a small mid-cap under Recommendation (EU) 2025/1099.
4. Map your ICT suppliers for key systems by country of establishment and control.
5. Build exit and replacement clauses into ICT supply contracts, with clear allocation of costs if a supplier becomes a prohibited source by law.
6. Document your ransomware handling: detection, vector, mitigation and any ransom demand.

Contracts

Supply contracts for ICT components and managed services should anticipate change in law: a right to terminate or replace a supplier that becomes subject to a legal prohibition, cooperation in a phase-out, and transparency on ownership and control of the supplier. Service contracts with in-scope customers should also cover cooperation on incident reports, including the new ransomware data points if they are adopted.

Frequently asked questions

Do we have to do anything because of these proposals today?

No legal duty follows from a proposal. Practical preparation makes sense, in particular for supplier mapping and contract terms, because ICT contracts often run for years.

Will NIS2 certification be mandatory?

Under the proposal, Member States "may" require a cyber posture certificate to demonstrate compliance with Article 21 (new Article 24(4)). The proposal does not make it mandatory across the Union.

Does the high-risk supplier regime apply to all companies?

The prohibitions and mitigating measures would apply to types of entities listed in Annexes I and II of NIS2, through implementing acts the Commission adopts after a risk assessment (Article 103). The procurement and funding restrictions of Article 100(4) concern ICT components in key ICT assets.

How does this relate to the Cyber Resilience Act?

The Cyber Resilience Act sets rules for products. The Cybersecurity Act 2 would keep and rebuild the certification schemes the CRA refers to, and gives ENISA the CRA's single reporting platform as a task (proposed Article 15).

How this connects

Incident reporting under NIS2, the CRA and the GDPR is handled by our data breach response team from one timeline, recorded in the breach workflow. Supplier exit and change-in-law clauses are drafted by our commercial contracts team, and the rights and obligations register keeps track of renewal and termination windows so you can act when the rules change.

At a glance

Texts: proposal COM(2026) 11 final, 2026/0011(COD), Articles 11 to 16, 71, 73, 78, 83, 98 to 103, 110, 111, 115 and 121; proposal COM(2026) 13 final, 2026/0012(COD), amending Articles 2, 3, 5, 6, 7, 21, 23, 24 and 27 and inserting Article 37a of Directive (EU) 2022/2555; Regulation (EU) 2019/881, Articles 46, 52, 53 and 56.

Key dates: both proposals of 20 January 2026; stage on 13 November 2026: awaiting committee decision; NIS2 amendments to be transposed within 12 months of entry into force.

Related: the NIS2 Directive, Cyber Resilience Act I, Cyber Resilience Act II and the Cyber Solidarity Act.