--- title: "The 2026 cybersecurity package: revised Cybersecurity Act…" description: "What the Commission proposed on 20 January 2026 in COM(2026) 11 (the Cybersecurity Act 2, replacing Regulation (EU) 2019/881) and COM(2026) 13 (targeted…" url: https://pitch.law/academy/cybersecurity-act-revision-and-nis2-amendments --- [pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [Data](https://pitch.law/academy/topics/information-technology) # The 2026 cybersecurity package: revised Cybersecurity Act and NIS2 amendments What the Commission proposed on 20 January 2026 in COM(2026) 11 (the Cybersecurity Act 2, replacing Regulation (EU) 2019/881) and COM(2026) 13 (targeted amendments to the NIS2 Directive), where the procedures stand and what companies can prepare now. - - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law - 13 November 2026 - Updated 13-11-2026 ## The legal framework On 20 January 2026 the Commission presented two linked proposals: - **[COM(2026) 11 final](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52026PC0011)** of 20 January 2026, a Regulation "on the European Union Agency for Cybersecurity (ENISA), the European cybersecurity certification framework, and ICT supply chain security and repealing Regulation (EU) 2019/881 (The Cybersecurity Act 2)". Procedure [2026/0011(COD)](https://oeil.secure.europarl.europa.eu/oeil/en/procedure-file?reference=2026/0011%28COD%29). - **[COM(2026) 13 final](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52026PC0013)** of 20 January 2026, a Directive "amending Directive (EU) 2022/2555 as regards simplification measures and alignment with the \[Proposal for the Cybersecurity Act 2]". Procedure [2026/0012(COD)](https://oeil.secure.europarl.europa.eu/oeil/en/procedure-file?reference=2026/0012%28COD%29). On 13 November 2026 the Legislative Observatory of the European Parliament shows both files at the stage "Awaiting committee decision". They are proposals. Nothing in them binds anyone yet, and the texts can change in Parliament and Council. Until adoption, the current [Cybersecurity Act, Regulation (EU) 2019/881](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019R0881), and the [NIS2 Directive, Directive (EU) 2022/2555](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555), with the national laws that transpose it, continue to apply. ### What the current Cybersecurity Act does Regulation (EU) 2019/881 gives ENISA, the EU cybersecurity agency, its mandate, and sets up the European cybersecurity certification framework for ICT products, services and processes ([Article 46](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019R0881#art_46)). Schemes can use three assurance levels, "basic", "substantial" and "high" ([Article 52](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019R0881#art_52)). Self-assessment is possible only at level "basic" ([Article 53](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019R0881#art_53)). Certification is voluntary unless Union or national law says otherwise ([Article 56(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019R0881#art_56)). The Cyber Resilience Act already relies on these schemes: an important product of class II can, for example, prove conformity with a certificate at level "substantial" (see [part I of our CRA series](https://pitch.law/academy/cyber-resilience-act-products-and-classes)). ### The Cybersecurity Act 2: three titles that matter to business The explanatory memorandum names four problems: a framework that no longer fits the threat landscape, the "stalled implementation" of the certification framework, the complexity of overlapping cybersecurity rules, and growing ICT supply chain risks. The proposal answers them in three parts. **ENISA (Title II).** ENISA gets operational tasks. Among them: early alerts on threats (proposed Articles 11 and 12), operating the EU Cybersecurity Reserve and helping essential and important entities prepare for, respond to and recover from ransomware incidents (Article 13), the single reporting platform of the Cyber Resilience Act (Article 15), and a Union vulnerability management service (Article 16). It also gets tasks on individual cybersecurity skills attestations (Articles 19 to 23). **Certification (Title III).** The framework is rebuilt and widened. Beyond ICT products, services and processes, schemes may cover managed security services and the **cyber posture of entities** (proposed Article 71). Where another Union act provides for it, a certificate demonstrates compliance and gives a presumption of conformity with that act, and the assessment for that purpose must be done by a third-party body (Article 78). Self-assessment stays limited to low-risk cases at assurance level "basic" (Article 83). After a detailed request from the Commission, ENISA is expected to deliver a candidate scheme within 12 months (explanatory memorandum, on Article 73). **ICT supply chain security (Title IV).** This is the most far-reaching part. It targets "non-technical risks" in the supply chains of the sectors covered by NIS2: - Union-level coordinated security risk assessments, requested by the Commission or at least three Member States (Articles 98 and 99); - the possibility to designate, by implementing act, a third country "posing cybersecurity concerns to ICT supply chains", based on criteria such as laws requiring vulnerabilities to be reported to that state before they are known to be exploited (Article 100(1) and (2)); - **high-risk suppliers** may not hold European cybersecurity certificates, become accredited conformity assessment bodies, take part in public procurement for ICT components in key ICT assets, or receive Union funding for such components; existing certificates are withdrawn (Article 100(4) and (5)); - implementing acts that may prohibit specific types of NIS2 entities from using ICT components from high-risk suppliers in key ICT assets, with transition and phase-out periods (Article 103(1)), or impose other mitigating measures, such as transparency about suppliers, restrictions on data transfers and remote processing from third countries, and third-party audited technical measures (Article 103(2)); - for mobile networks, the phase-out period for components from high-risk suppliers in key ICT assets is at most 36 months from the publication of the list of high-risk suppliers for those networks (Article 110(3)). Penalties are set by Member States, with maximums of 1%, 2% or 7% of worldwide annual turnover depending on the provision breached; 7% applies to breaches of a prohibition under Article 103(1) and of Article 111 ([proposed Article 115](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52026PC0011)). The proposal repeals Regulation (EU) 2019/881; the date is left open in the text (Article 121). ### The NIS2 amendments (COM(2026) 13) The Directive proposal makes targeted changes to [NIS2](https://pitch.law/academy/the-nis2-directive-towards-a-firmer-eu-wide-cybersecurity-framework): - **Small mid-caps.** Annex I entities would be essential only if they exceed the ceilings for small mid-cap enterprises under Commission [Recommendation (EU) 2025/1099](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025H1099). Entities in that band would therefore be important entities (amended Article 3(1)(a); recital 2). - **DNS service providers** would no longer be covered regardless of size, so the general size-cap rule applies to them (amended Article 2(2)(a)(iii); recital 2). - **New entities regardless of size:** providers of European Digital Identity Wallets and of European Business Wallets, as essential entities (amended Articles 2(2) and 3(1)(b)). Operators of submarine data transmission infrastructure are added to digital infrastructure in Annex I (new definition in Article 6, point (43); Annex to the proposal). - **Scope clarifications** in the annexes: electricity producers only above 1 MW total generation capacity, a narrower description of healthcare providers, hydrogen undertakings and the chemicals sector (Annex to the proposal; recitals 3 and 4). - **Cyber posture certification.** Member States may require entities to obtain a certificate on their cyber posture under a scheme of the Cybersecurity Act 2 to demonstrate compliance with Article 21. Where such a certificate covers the requirements, authorities may not order additional regular and targeted security audits under Article 32(2)(b) or 33(2)(b) for those requirements. The entity remains responsible for compliance (new Article 24(4) to (6)). - **Maximum harmonisation** where the Commission adopts implementing acts on risk-management measures: Member States could then not add further technical, methodological or sectoral requirements (amended Articles 5 and 21(5)). - **Ransomware.** Incident reports would include whether a ransomware attack was detected, the attack vector and whether mitigation was implemented. On request, entities would tell the CSIRT whether a ransom was demanded and by whom, and whether it was paid, how much, how and to whom (new Article 23(12) and (13)). - **Registration and the ENISA registry.** The registration details of Article 3(4) are aligned, and ENISA would keep a registry of all essential and important entities (amended Articles 3(4) and 27). - **Cross-border supervision.** ENISA would support mutual assistance and joint supervisory actions for entities active in several Member States (new Article 37a). - **Post-quantum cryptography** becomes part of national cybersecurity strategies (amended Article 7(2)). Member States would have 12 months after entry into force to transpose (proposed Article 2). ## In practice A Belgian electricity producer with 600 staff is an essential NIS2 entity today, as an Annex I entity above the ceilings for medium-sized enterprises. If the small mid-cap rule is adopted as proposed and the company falls within the small mid-cap thresholds, it would become an important entity, with supervision mainly after the fact. Its current duties stay in force until the Belgian NIS2 Law is amended. A managed service provider active in Belgium, the Netherlands and France is supervised in each country today. The proposal would let it use a cyber posture certificate to show compliance with Article 21, where Member States opt for that route, and would give ENISA a role in joint supervision. A telecom operator buys radio equipment from a supplier based in a third country. If that country is designated under Article 100 and the supplier is listed as high-risk, the operator could have to phase out the supplier's components from key ICT assets. Procurement teams should note which suppliers could be affected and how their contracts allow an exit. ### What to do now 1. Keep complying with the current NIS2 law of each country where you operate. The proposals change nothing yet. 2. Follow both procedures on the Legislative Observatory pages above. 3. Check whether your group could qualify as a small mid-cap under Recommendation (EU) 2025/1099. 4. Map your ICT suppliers for key systems by country of establishment and control. 5. Build exit and replacement clauses into ICT supply contracts, with clear allocation of costs if a supplier becomes a prohibited source by law. 6. Document your ransomware handling: detection, vector, mitigation and any ransom demand. ### Contracts Supply contracts for ICT components and managed services should anticipate change in law: a right to terminate or replace a supplier that becomes subject to a legal prohibition, cooperation in a phase-out, and transparency on ownership and control of the supplier. Service contracts with in-scope customers should also cover cooperation on incident reports, including the new ransomware data points if they are adopted. ## Frequently asked questions ### Do we have to do anything because of these proposals today? No legal duty follows from a proposal. Practical preparation makes sense, in particular for supplier mapping and contract terms, because ICT contracts often run for years. ### Will NIS2 certification be mandatory? Under the proposal, Member States "may" require a cyber posture certificate to demonstrate compliance with Article 21 (new Article 24(4)). The proposal does not make it mandatory across the Union. ### Does the high-risk supplier regime apply to all companies? The prohibitions and mitigating measures would apply to types of entities listed in Annexes I and II of NIS2, through implementing acts the Commission adopts after a risk assessment (Article 103). The procurement and funding restrictions of Article 100(4) concern ICT components in key ICT assets. ### How does this relate to the Cyber Resilience Act? The Cyber Resilience Act sets rules for products. The Cybersecurity Act 2 would keep and rebuild the certification schemes the CRA refers to, and gives ENISA the CRA's single reporting platform as a task (proposed Article 15). ## How this connects Incident reporting under NIS2, the CRA and the GDPR is handled by our [data breach response](https://pitch.law/solutions/data-breach-response-enforcement) team from one timeline, recorded in the [breach workflow](https://pitch.law/technologies/breach-response-workflow). Supplier exit and change-in-law clauses are drafted by our [commercial contracts](https://pitch.law/solutions/commercial-contracts-transactions) team, and the [rights and obligations register](https://pitch.law/technologies/contract-obligations) keeps track of renewal and termination windows so you can act when the rules change. ### At a glance **Texts:** proposal COM(2026) 11 final, 2026/0011(COD), Articles 11 to 16, 71, 73, 78, 83, 98 to 103, 110, 111, 115 and 121; proposal COM(2026) 13 final, 2026/0012(COD), amending Articles 2, 3, 5, 6, 7, 21, 23, 24 and 27 and inserting Article 37a of Directive (EU) 2022/2555; Regulation (EU) 2019/881, Articles 46, 52, 53 and 56. **Key dates:** both proposals of 20 January 2026; stage on 13 November 2026: awaiting committee decision; NIS2 amendments to be transposed within 12 months of entry into force. **Related:** [the NIS2 Directive](https://pitch.law/academy/the-nis2-directive-towards-a-firmer-eu-wide-cybersecurity-framework), [Cyber Resilience Act I](https://pitch.law/academy/cyber-resilience-act-products-and-classes), [Cyber Resilience Act II](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting) and [the Cyber Solidarity Act](https://pitch.law/academy/cyber-solidarity-act). ## In short - The two proposals, their procedures and their status - Certification of an organisation's cyber posture - ICT supply chain security and high-risk suppliers - Small mid-caps, ransomware reporting and other NIS2 changes - What stays the same until adoption ## Related solutions - [Solutions](https://pitch.law/solutions/data-breach-response-enforcement) ### [Data Breach Response](https://pitch.law/solutions/data-breach-response-enforcement) [Help from the first hours of a personal data breach: assessment, notification to the authority and individuals, documentation, and action against the source.](https://pitch.law/solutions/data-breach-response-enforcement) - [Solutions](https://pitch.law/solutions/commercial-contracts-transactions) ### [Commercial Contracts & Transactions](https://pitch.law/solutions/commercial-contracts-transactions) [Supply, distribution, services, SaaS and procurement contracts, and the deals around them, drafted and reviewed with the IP, data and tax angles in view.](https://pitch.law/solutions/commercial-contracts-transactions) ## Our proprietary Legal Tech - [Technology](https://pitch.law/technologies/breach-response-workflow) ### [Data Breach Handling](https://pitch.law/technologies/breach-response-workflow) [A GDPR Article 33 and 34 workflow with a 72-hour countdown, a reference per breach and a structured notification to the supervisory authority, approved by a lawyer.](https://pitch.law/technologies/breach-response-workflow) - [Technology](https://pitch.law/technologies/contract-obligations) ### [Contract Management: Rights and Obligations](https://pitch.law/technologies/contract-obligations) [Once a contract is final, we pull out each party's duties and rights with the clause they come from, have a person confirm them, and follow them with reminders.](https://pitch.law/technologies/contract-obligations) ## More in Data - ### [Children Online: the EU KIDS Act Proposal and Age Verification](https://pitch.law/academy/children-online-kids-act-and-age-verification) [What the Digital Services Act already requires to protect minors, what the EU KIDS Act proposal of 17 September 2026 would add for social networks, video platforms, games, app stores and chatbots, and how the EU age verification framework fits in.](https://pitch.law/academy/children-online-kids-act-and-age-verification) - ### [The Cloud and AI Development Act: sovereignty rules for cloud and AI procurement](https://pitch.law/academy/cloud-and-ai-development-act) [What the Commission's proposal for a Cloud and AI Development Act would require of cloud providers that sell to the public sector, of contracting authorities, and of bidders for cloud and AI contracts, and how it sits next to the Data Act and the procurement Directive.](https://pitch.law/academy/cloud-and-ai-development-act) - ### [Cyber Resilience Act III: importers, distributors, open source and contracts](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source) [The duties of importers, distributors and authorised representatives under Articles 18 to 23 of Regulation (EU) 2024/2847, when a reseller becomes a manufacturer, how free and open-source software and its stewards are treated, and the clauses that follow.](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source) - ### [Cyber Resilience Act I: which products are caught, and in which class](https://pitch.law/academy/cyber-resilience-act-products-and-classes) [How to tell whether hardware or software you sell falls under Regulation (EU) 2024/2847, whether it is a default, important (class I or II) or critical product, and which conformity route follows from that, with the dates up to 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-products-and-classes) - ### [Cyber Resilience Act II: vulnerability handling and reporting since 11-09-2026](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting) [What manufacturers must report under Article 14 of Regulation (EU) 2024/2847 since 11 September 2026, within 24 hours, 72 hours, 14 days and one month, and the vulnerability handling duties of Annex I, Part II, that follow from 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting) - ### [Cyber incidents across borders: the Cyber Solidarity Act](https://pitch.law/academy/cyber-solidarity-act) [What Regulation (EU) 2025/38 sets up, the European Cybersecurity Alert System, the Cybersecurity Emergency Mechanism with the EU Cybersecurity Reserve and the incident review mechanism, how a company hit by a major incident can benefit, and what it means for managed security service providers.](https://pitch.law/academy/cyber-solidarity-act) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://pitch.law/schedule)