Public Comment on The EU Cybersecurity Act

This paper announces the 2026 revision to the European Union Cybersecurity Act, an update designed to strengthen the EU’s resilience to increasingly sophisticated threats to infrastructure and supply chains. While the original 2019 Act established a foundation through the European Cybersecurity Certification Framework (ECCF) and a permanent mandate for ENISA, the recent landscape has necessitated a more aggressive and comprehensive strategy. Key findings include operational expansion (81.5% budget increase and the creation of the EU Cybersecurity Reserve to assist Member States), supply chain de-risking (including a horizontal framework to identify and phase out “high risk” suppliers), and critical policy gaps (lack of mandatory certification consistency and fragmented coordination between EU institutions and individual member states, which can disproportionately burden SMEs). Ultimately, while the transition away from high-risk suppliers carries short-term costs, the long-term benefits are projected to save EU businesses up to 15.3 billion euros over five years.