In the final quarter of 2024, there have been significant developments in the EU cybersecurity legal landscape. Most prominently, the EU institutions adopted the Cyber Resilience Act and mid-October marked the deadline for Member States to transpose the NIS2 Directive into national law. Most Member States failed to meet the NIS2 transposition deadline, which resulted in the European Commission sending a formal notice to 23 Member States, urging them to transpose the Directive. These 23 Member States have been given two months to respond. (For more information on the Cyber Resilience Act and NIS2 Directive, see our blog posts here and here.)
Legislative developments have continued beyond these two major laws, however. On December 2, 2024, the European Council adopted two further cybersecurity laws from the EU Cybersecurity Package: the Cyber Solidarity Act (“CSA”) and an amendment to the 2019 Cybersecurity Act (“CA Amendment”).
The CSA covers three main “pillars”:
- Threat detection and prevention: the CSA will establish a European Cybersecurity Alert System: in practice, this will impose reinforced collaboration obligations between EU and Member State institutions that focus on cybersecurity;
- Incident preparedness and response: the CSA will also establish a European Cybersecurity Emergency Mechanism. Member States and private entities (including those designated as essential or important entities under NIS2) can request assistance from this mechanism, including in preparing for cyber threats and with incident response. Of particular interest to technology companies, certain “trusted providers” will provide services through the “EU Cybersecurity Reserve,” which forms part of the Emergency Mechanism; and
- Incident reviews: ENISA will, on request, assess threats, vulnerabilities, and potential mitigation actions in relation to specific major cybersecurity incidents.
The Cybersecurity Act created a pan-EU cybersecurity certification framework for ICT products, services and processes, and mandated ENISA to develop certifications. The CA Amendment expands the scope of potential cybersecurity certifications that ENISA adopts, so that it may adopt certifications for “managed security services” in addition to ICT products, services, and processes. The CA Amendment defines these services by reference to NIS2, which states they are “services consisting of carrying out, or providing assistance for, activities relating to their customers’ cybersecurity risk management, and have gained increasing importance in the prevention and mitigation of incidents.”
As many of you who have been grappling with NIS2 implementation in recent months will be aware, Article 24 of that Directive permits Member States to mandate the use of cybersecurity certifications adopted under the Cybersecurity Act by essential and/or important entities. As a result, it is possible that Member States may in the future require certain entities in these sectors to use managed security services that have a certain level of certification.
Both the CSA and CA Amendment are likely to be published in the Official Journal of the EU before the end of 2024, or in the early part of 2025. They will come into force 20 days after publication.
* * *
The Data Privacy and Cybersecurity Practice at Covington has deep experience advising on privacy and cybersecurity issues across Europe, and will continue to monitor developments. If you have any questions about the Cyber Solidary Act, Cybersecurity Act, NIS2, and the Cyber Resilience Act, or about developments in the cybersecurity space more broadly, our team would be happy to assist.
(This post was written with the assistance of Diane Valat.)