The European Commission has proposed a new Cybersecurity Act 2 (CSA2), marking the most significant update to the EU cybersecurity framework since the original regulation introduced in 2019.
The proposal reflects Europe’s growing focus on cybersecurity resilience, digital sovereignty, cloud infrastructure security, and the governance of artificial intelligence systems. The regulation is currently entering the legislative review process within the European Parliament and the Council of the European Union.
Among the most important proposed changes is the expanded operational role of the European Union Agency for Cybersecurity (ENISA). Under the new framework, ENISA would take on stronger responsibilities related to crisis coordination, early warning systems, and cybersecurity incident management across member states.
The proposal also introduces stricter certification requirements for AI systems and cloud services operating within the European market. Certification could become a prerequisite for market access in specific sectors, increasing the importance of cybersecurity readiness for technology providers and digital service operators.
Another major change is the creation of a unified incident reporting mechanism. The European Commission aims to reduce overlapping obligations currently spread across frameworks such as NIS2, GDPR, and DORA by introducing a single reporting portal for cybersecurity incidents.
CSA2 also highlights the growing importance of post-quantum cryptography. Member states would be expected to include migration strategies toward quantum-resistant encryption standards within their national cybersecurity plans.
The proposed regulation further expands the scope of entities covered under European cybersecurity rules. Additional sectors under consideration include digital wallet providers and operators of submarine digital infrastructure.
For SMEs and digital businesses, these developments carry significant implications. Cybersecurity compliance is increasingly becoming linked to operational continuity, supplier trust, market access, and long-term competitiveness.
As digital transformation accelerates across Europe, organisations are expected to place greater focus on:
• cybersecurity governance
• cloud infrastructure resilience
• AI system certification
• incident response readiness
• secure digital infrastructure
• regulatory compliance strategies
For EDIH DIGIHUB and DINT Foundation, the proposal highlights the growing need to support SMEs through cybersecurity preparedness, digital innovation, and technology adoption.
The evolving European regulatory environment demonstrates that cybersecurity is no longer viewed solely as a technical function. It is becoming a strategic pillar of Europe’s digital economy and long-term technological resilience.
Learn more ????
https://digital-strategy.ec.europa.eu
https://www.enisa.europa.eu
https://dint.digital
#Cybersecurity #CSA2 #NIS2 #EDIH #DIGIHUB #DINT #DigitalTransformation
