OpenLobby.EU
Explore

The EU Cybersecurity Act

Digital economy and society

The initiative will revise the Cybersecurity Act, clarify the mandate of the EU Agency for Cybersecurity (ENISA) and improve the European Cybersecurity Certification Framework to achieve better resilience. The initiative also aims to streamline, simplify and supplement EU legislation to make the implementation of the EU cybersecurity framework more user and business friendly and to prioritise measures to support the EU objectives of developing a secure and resilient supply chain, including the EU cybersecurity industrial base.

Links

Public consultation

ID: 14578

Lobbying Activity

87 responses

Microsoft urges strengthened ENISA independence and streamlined EU cybersecurity rules

Microsoft Corporation, 19 Jun 2025

Microsoft requests ENISA receive adequate financial resources and greater autonomy to cooperate with industry partners. They advocate for streamlined certification processes, harmonization with international standards, and simplified compliance requirements across CRA, AI Act, and NIS2. They oppose data localization and urge coordinated market surveillance rather than multiple parallel investigations.
This would reduce compliance costs from multiple certifications and market surveillance inquiries.
EU cybersecurity certification providers lose preference as Microsoft advocates technology and origin neutrality.

AmCham EU Urges Global Standards for EU Cybersecurity Certification

American Chamber of Commerce to the European Union, 20 Jun 2025

AmCham EU advocates for aligning certification with international standards and removing sovereignty-based requirements. They propose increasing ENISA's resources and establishing a formal, structural role for industry stakeholders. Additionally, they request streamlining reporting to avoid overlaps between different cybersecurity legislative acts.
Global alignment would reduce compliance costs and prevent market barriers for international companies.
Domestic European cloud providers might lose competitive advantages gained through restrictive sovereignty-related requirements.

EuroCommerce urges targeted improvements to EU cybersecurity certification framework

EuroCommerce, 20 Jun 2025

EuroCommerce recommends targeted improvements to the certification framework instead of a major overhaul. They request more power for ENISA and guidance to manage overlapping regulations.
Streamlined rules would lower compliance costs and improve legal certainty for retailers.
Regulators lose oversight of non-technical supply chain vulnerabilities if certification is restricted.

DigitalEurope Urges Voluntary Certification and Regulatory Coherence

DIGITALEUROPE, 20 Jun 2025

DigitalEurope requests keeping certification voluntary except for high-risk cases. They want certificates to prove compliance with multiple laws to avoid repeating assessments. They also suggest giving the EU cybersecurity agency more power to fix security flaws.
This would lower costs and simplify rules for businesses operating across borders.
National governments lose the ability to create their own specific security standards.

Amazon urges EU to keep cybersecurity certification voluntary and technical

Amazon Europe Core SARL, 19 Jun 2025

Amazon wants ENISA to remain a technical advisor without binding regulatory powers, opposes introducing non-technical risk factors into certification schemes, and seeks streamlined incident reporting with alignment across EU laws. They advocate for voluntary certification based purely on technical criteria and greater stakeholder consultation in scheme development.
This would preserve customer choice of technologies and reduce compliance costs across multiple markets.
EU policymakers lose flexibility to restrict vendors based on non-technical security concerns.

Vodafone Urges EU to Simplify Fragmented Cybersecurity Rules

Vodafone Belgium SA, 19 Jun 2025

Vodafone requests a larger role for ENISA to harmonize the complex regulatory landscape. They propose a once-only principle to streamline incident reporting and supply chain security. Certification schemes should remain voluntary and focused strictly on technical criteria.
Removing overlapping regulations would lower compliance costs and reduce administrative burdens.
Advocates for digital sovereignty lose a tool for enforcing non-technical security criteria.

Eurelectric urges targeted adjustments to simplify EU cybersecurity rules

Eurelectric aisbl, 20 Jun 2025

They support limited fact-based changes while giving more resources to the cybersecurity agency. The industry needs time to implement existing rules before new ones are added. Aligning various laws is necessary to reduce the heavy administrative burden.
Streamlined rules and clearer procedures would reduce their compliance costs and complexity.

Enel urges simplified and harmonized EU cybersecurity rules

ENEL SpA, 20 Jun 2025

Enel requests simplification and harmonization among the many cybersecurity laws to address overlapping requirements. They propose a mapping matrix so that specific technical controls automatically satisfy multiple legal obligations. The company also insists on maintaining the voluntary adoption of certification schemes.
Unified rules would reduce administrative burdens and compliance costs for the energy giant.
National authorities may see their specific regulatory competences diminished by a centralized framework.

Deutsche Telekom urges simplified cybersecurity rules and ENISA overhaul

Deutsche Telekom, 20 Jun 2025

The company wants ENISA to focus on market harmonization and supporting certification schemes. They advocate for international standards and keeping certifications voluntary to reduce administrative burdens. They also request cross-compliance mechanisms to prevent overlapping regulations from creating duplicate paperwork.
Streamlined rules would lower compliance costs and improve the competitiveness of European businesses.
National authorities could face higher costs if they take over localized awareness campaigns.

Orgalim urges voluntary cybersecurity certification and simplified reporting

Orgalim – Europe's Technology Industries, 20 Jun 2025

Orgalim requests that cybersecurity certification schemes remain voluntary and opposes their mandatory application under recent EU laws. They propose a one-stop-shop mechanism to streamline overlapping incident reporting requirements and urge ENISA to focus on current tasks rather than expanding its mandate.
This would reduce administrative burdens and lower compliance costs for European technology manufacturers.

IBM Urges Standard-Based EU Cybersecurity Certification Rules

IBM Corporation, 20 Jun 2025

IBM advocates for a certification framework based on international standards and clear timelines. They request streamlined reporting through single national entry points and liability protections for entities. The company recommends that supply chain security tools focus only on first-level suppliers.
These measures would significantly reduce the compliance burden and administrative costs for global businesses.
Proponents of digital sovereignty lose the ability to favor local firms through restrictive requirements.

Insurance Europe Urges Streamlined Cyber Reporting and Voluntary Certification

Insurance Europe, 20 Jun 2025

The organization requests aligning and centralizing cyber reporting under different laws to avoid unnecessary duplication. They also argue that cybersecurity certification should remain voluntary and include more industry feedback.
Reducing overlapping reporting requirements would lower high compliance costs and administrative burdens for insurers.
Sovereignty requirements in certification would harm technology providers by limiting competition and innovation.

Orange urges EU to simplify overlapping cybersecurity regulations

Orange, 19 Jun 2025

Orange requests a more cohesive regulatory framework to eliminate redundant requirements across various cybersecurity laws. They propose a single-entry point for incident reporting and a mandate for ENISA to regulate non-EU cyber rating agencies.
Streamlining these rules would lower administrative costs and let staff focus on fixing security issues.
Foreign cyber rating agencies would lose their current freedom to rate firms without European oversight.

German industry urges simpler EU cybersecurity rules for businesses

Deutsche Industrie- und Handelskammer, 20 Jun 2025

The DIHK calls for a significant reduction in administrative burden through simplified and harmonized reporting requirements. They advocate for a risk-based, scalable certification approach that avoids redundancies and practical overload for companies.
Simplified rules would reduce high costs and complexity for small and medium enterprises.
Non-EU companies may face disadvantages as the framework emphasizes European digital sovereignty.

Nokia Urges Mandatory Security Rules for High-Risk Suppliers

Nokia, 19 Jun 2025

Nokia requests making current 5G security toolboxes mandatory for all types of connectivity. They also call for removing duplicate regulations and differentiating between consumer and business equipment.
This would reduce administrative costs and improve competitive position against high-risk rivals.
Suppliers labeled as high-risk would be systematically excluded from European network projects.

UNIFE urges EU to create independent rail cybersecurity database

UNIFE, 20 Jun 2025

UNIFE requests a European vulnerability database to replace reliance on US sources. They also want a dedicated information sharing center for the rail sector.
This would provide rail companies with a more stable and reliable security resource.
The US National Vulnerability Database could lose its global influence and usage.

Connect Europe urges harmonised standards and simplified cybersecurity reporting

Connect Europe, 20 Jun 2025

Connect Europe requests that ENISA harmonise standards and simplify reporting to reduce fragmentation. They propose a "once-only" principle for incident reporting and a centralised repository for compliance guidance.
These reforms would lower administrative expenses and prevent operational disruptions for telecom providers.
International rating agencies would face strict new EU oversight and transparency requirements.

Ibec Urges Prioritising Implementation Over New EU Cybersecurity Legislation

Ibec, 20 Jun 2025

Ibec recommends pursuing non-legislative measures to improve the effectiveness of existing cybersecurity schemes. They call for strengthening the capacity of the EU Agency for Cybersecurity instead of expanding its role. Additionally, they propose a single national platform to streamline incident reporting across various EU laws.
Streamlining regulations reduces administrative costs and prevents technical barriers to trade and scaling.
Political actors seeking non-technical influence over certification lose power to shape security schemes.

Bitkom Urges EU to Streamline Fragmented Cybersecurity Reporting Rules

Bitkom e.V., 19 Jun 2025

Bitkom advocates for a "one incident, one report" principle to eliminate redundant reporting obligations. They want ENISA to coordinate harmonisation efforts and map international standards against EU requirements.
This would reduce compliance costs and administrative burdens for companies operating across multiple borders.
Proponents of geopolitical certification requirements lose influence if schemes are strictly limited to technical criteria.

ITI Urges EU to Streamline Cybersecurity Rules and ENISA Mandate

ITI - The Information Technology Industry Council, 17 Jun 2025

ITI requests the simplification of overlapping regulations and the removal of political sovereignty requirements. They advocate for alignment with international standards to ensure global interoperability.
Streamlining regulations would decrease compliance costs and free up resources for innovation.
National authorities lose the ability to set unique domestic cybersecurity requirements.

GSMA and Connect Europe urge simpler EU cybersecurity rules

GSMA Europe, 20 Jun 2025

The groups request a 'single entry point for reporting' to simplify inconsistent procedures. They advocate for 'harmonised templates for incident reporting' and use of international standards. They argue that future cybersecurity certification schemes should 'remain market-driven' and voluntary.
Unified rules would 'reduce administrative costs associated with market fragmentation' and overlapping regulatory requirements.
Rating firms would face stricter 'rules governing the operations of Cyber Rating Agencies' within Europe.

APPLiA urges EU to streamline overlapping cybersecurity regulations

APPLiA (Home Appliance Europe), 20 Jun 2025

APPLiA calls for harmonized reporting for multinationals and clearer definitions for service providers. They also recommend withdrawing specific radio equipment rules once new cyber laws apply.
This approach would reduce administrative costs and provide legal certainty for manufacturers.
National authorities may lose flexibility as harmonized rules force consistent entity classification.

ASD calls for 'High+' cloud security standards in EU law

Aerospace, Security and Defence Industries Association of Europe, 19 Jun 2025

ASD calls for clearly defined responsibilities between EU agencies to prevent overlapping functions. They advocate for 'High+' cloud criteria to protect sensitive data from non-EU legal access.
Members benefit from a unified standard that protects industrial data and reduces fragmentation.
Non-EU cloud providers lose market access for sensitive high-security government and industrial contracts.

CEOE urges EU to prioritize cybersecurity implementation over expansion

CEOE - Confederación Española de Organizaciones Empresariales, 16 Jun 2025

CEOE recommends strengthening ENISA's resources to prioritize current mandates and reach market maturity before expanding the framework. They advocate for voluntary certification schemes and increased private stakeholder input in standardization.
Businesses would benefit from reduced compliance complexity and lower costs through harmonized certification.
SMEs face significant market entry barriers if certification becomes mandatory or overly complex.

Business Software Alliance urges EU to abandon cloud sovereignty requirements

Business Software Alliance, 10 Jun 2025

The Business Software Alliance urges the EU to avoid protectionist sovereignty requirements and maintain a technology-neutral certification framework. They advocate for cooperation with trusted international partners to support innovation and fair competition.
This would protect the market access and profitability of major international software providers.
European organizations would face restricted choices and higher costs for cloud and cybersecurity services.

German municipal utilities urge simpler rules in Cybersecurity Act review

Verband Kommunaler Unternehmen e.V., 19 Jun 2025

VKU requests simplified digital regulations to avoid overlapping administrative burdens and redundancies. They support mandatory security-by-design for manufacturers and enhanced security for ICT supply chains.
Simplified reporting would allow companies to focus limited staff on operational security.
Tech providers lose market access if security requirements become too complex for them.

Infineon supports ENISA expansion and simpler cybersecurity certification

Infineon Technologies AG, 10 Jun 2025

Infineon recommends expanding the cybersecurity agency's mandate and improving the certification framework. They support simplifying current legislation through a specific regulatory intervention path.
Simplified rules would reduce regulatory complexity and make compliance more business friendly.

Marsh McLennan urges EU to address cyber risk protection gap

MARSH McLENNAN COMPANIES FRANCE, 20 Jun 2025

Marsh McLennan advocates for public-private partnerships to handle massive cyber risks exceeding market capacity. They recommend establishing a common data framework and providing government subsidies for small businesses.
This would limit the company's financial exposure to extreme and unquantifiable cyber incidents.

TIM calls for new 'high+' cybersecurity level for EU sovereignty

TIM S.p.A., 20 Jun 2025

TIM proposes adding a fourth "high+" level to cybersecurity certifications to address non-technical risks. This would include requirements for legal and operational independence from foreign powers.
This would protect TIM's market position by ensuring immunity from foreign legal interference.
Non-EU technology companies lose access to critical sectors due to new sovereignty requirements.

OVHcloud urges EU to tackle non-EU tech dependencies

OVH Groupe, 20 Jun 2025

OVHcloud suggests expanding the Cybersecurity Act to address non-technical risks and dependencies. They also advocate for a stronger, strategic mandate for the EU cybersecurity agency.
Stricter sovereignty requirements would improve the market position of European cloud providers.
Non-European cloud giants would lose market access due to stricter control requirements.

European Publishers Council calls for mandatory EU bot registration

European Publishers Council, 20 Jun 2025

The EPC proposes mandatory registration for automated agents (bots) operating within the EU digital ecosystem. They also request streamlined reporting obligations and stronger resilience against ransomware for newsrooms.
A registration system would help publishers prevent unauthorized scraping and protect their copyrighted content.
Operators of unregistered bots would face blacklisting, penalties, and restricted access to digital infrastructure.

Amadeus warns against restrictive EU control for cloud services

AMADEUS IT GROUP S.A., 20 Jun 2025

Amadeus wants ENISA to focus on private sector coordination and guidance. They oppose excluding cloud providers based on their headquarters' location. They also suggest simplifying incident reporting through national entry points.
Harmonized technical standards would reduce compliance costs and improve digital trust.
EU-only cloud providers lose the advantage of rules excluding global competitors.

NXP urges simplified and business-centric EU cybersecurity certification

NXP Semiconductors Netherlands B.V., 20 Jun 2025

NXP requests a business-centric approach that prioritizes cost efficiency and simplifies the fragmented regulatory landscape. They urge the European Commission to appoint a coordinator to ensure cohesion among different certification frameworks. Additionally, they call for faster development of frameworks to keep pace with evolving threats.
Streamlined certification would reduce the administrative burden and offset costs through improved market access.
End users may face higher prices if certification costs are not managed effectively.

FEPORT urges EU to simplify port cybersecurity rules and guidance

FEPORT, 19 Jun 2025

FEPORT supports simplifying requirements and strengthening ENISA's role in sharing anonymized incident data. They advocate for practical guidance and a European Early Warning Management System.
The proposal would reduce compliance costs and protect terminals from external systemic risks.
Public authorities may face pressure to upgrade their less secure digital infrastructure systems.

App Association Urges SME-Friendly EU Cybersecurity Rules

ACT | The App Association, 20 Jun 2025

ACT calls for aligning certification with international standards like ISO 27001 to simplify compliance. They advocate for a centralized incident reporting platform to reduce administrative burdens. Additionally, they urge the Commission to avoid mandatory third-party certifications that create high-cost barriers.
Streamlined rules would reduce compliance costs and administrative burdens for small developers.
Third-party certification facilities could lose revenue if self-certification is expanded for SMEs.

CCIA Europe urges technical focus for EU cybersecurity certification

Computer and Communications Industry Association, 20 Jun 2025

The organization requests a transparent certification process focusing on technical security instead of political goals. They also suggest strengthening ENISA’s independent role and streamlining conflicting regulatory reporting requirements.
This would prevent non-European firms from being excluded by costly and restrictive sovereignty rules.
Domestic groups seeking protectionist measures lose the ability to restrict foreign market access.

European solar manufacturers urge stricter cybersecurity rules for inverters

European Solar Manufacturing Council, 19 Jun 2025

The council requests that the EU recognize solar inverters as critical infrastructure subject to mandatory third-party audits. They want the law to address risks from foreign jurisdictions that control software vulnerabilities.
This policy would protect European manufacturers by excluding foreign competitors with weak security standards.
Foreign suppliers subject to state-mandated vulnerability reporting would face significant market barriers.

I-Com urges EU to streamline cybersecurity rules and certifications

Istituto per la Competitività, 20 Jun 2025

I-Com requests streamlining reporting obligations and creating a 'Consolidated Act' for clarity. They advocate for voluntary certifications supported by fiscal incentives to help smaller companies.
These changes would lower compliance costs and simplify the complex regulatory landscape.
Advocates for mandatory certification lose influence as the group prioritizes voluntary standards.

EuroISPA Urges Technical Focus for EU Cybersecurity Certification

European Internet Services Providers Association, 20 Jun 2025

Certification schemes should remain exclusively technical and avoid sovereignty-based requirements. Small companies should have simplified pathways like self-assessment to lower regulatory barriers. Legislators should harmonize reporting across frameworks and create single reporting points.
Exempting internal software from certification would significantly lower administrative costs for providers.
National authorities lose the power to impose sovereignty-based criteria and localization requirements.

TIC Council urges expansion of EU cybersecurity certification schemes

TIC Council, 17 Jun 2025

The group recommends expanding the certification landscape to include AI, consumer IoT, and space systems. They also advocate for strengthening stakeholder input and pursuing mutual recognition agreements.
Expanding the certification framework provides more business opportunities for independent assessment bodies.
Manufacturers of high-risk products may face increased costs due to mandatory certification.

Interface Urges ENISA Funding Boost or a More Focused Mandate

interface - tech analysis and policy ideas for Europe e.V., 12 Jun 2025

Interface recommends that policymakers either provide the agency with adequate resources or significantly narrow its mandate. They advocate for clarifying ENISA’s strategic role and prioritizing activities to optimize impact.
Refining prioritization would alleviate operational strain and enable the agency to build specialized expertise.
Member States and businesses face a fragmented security landscape if coordination efforts remain under-funded.

FIA Urges Single Ruleset to End Cyber Regulation Overlap

Futures Industry Association, Inc., 20 Jun 2025

The organization calls for a single ruleset where regulations overlap or share the same objectives. They argue that applying product-focused rules to financial services creates uncertainty and redundant incident reporting.
Consolidating rules would reduce implementation costs and prevent interference from non-financial authorities.
Software providers would face higher costs to ensure security before product launches.

Sopra Steria calls for Zero Trust mandate in Cybersecurity Act

SOPRA STERIA GROUP, 20 Jun 2025

Sopra Steria proposes integrating 'Zero Trust' and 'Data-Centric Security' architectures into the legal framework. They advocate for expanding ENISA's mandate to assess strategic risks and geopolitical dependencies. The group also recommends creating a 'High+' assurance level for cloud services to ensure digital sovereignty.
These changes would favor European tech firms by prioritizing local providers in public procurement.
Non-EU technology providers may face market barriers due to new strict sovereignty requirements.

CNRS Urges EU to Harmonize and Simplify Cybersecurity Laws

Centre National de la Recherche Scientifique, 19 Jun 2025

The CNRS advocates for the rationalisation, simplification, and harmonisation of European cybersecurity legislation. They propose establishing a scientific advisory board to bridge the gap between researchers and policymakers.
A simplified regulatory landscape would reduce compliance costs and clarify requirements for large research institutions.
Dominant software vendors lose their market advantage if the EU prevents monopolies in certified products.

epicenter.works Urges Stronger ENISA and Protections for Ethical Hackers

epicenter.works - Plattform Grundrechtspolitik, 18 Jun 2025

The NGO advocates for robust regulation to build public trust in digital technologies. They demand an expanded, independent mandate for ENISA to overcome national fragmentation. The group calls for legal protections for ethical hackers and civil society involvement.
These reforms would secure fundamental rights and increase the organization's influence in governance.
National agencies lose their exclusive control over cybersecurity policy and standard-setting processes.

TÜV Association urges targeted updates to EU Cybersecurity Act

TÜV-Verband e. V., 18 Jun 2025

They support a targeted regulatory intervention rather than a complete repeal of current legislation. They recommend developing new certification schemes and considering making them mandatory in certain areas. They also advocate for better stakeholder participation in scheme development.
Mandatory certification schemes would increase demand for the testing services provided by members.
Businesses in sectors where certification becomes mandatory will face increased costs and regulations.

Consultation response

Dassault Systèmes, 20 Jun 2025

As a European software company, Dassault Systèmes recognizes that robust cybersecurity is fundamental to ensure the integrity of digital operations and maintaining trust in increasingly interconnected industrial ecosystems. Committed to a unified European cybersecurity framework with ENISA at its…

Consultation response

DigitalES - Asociación Española para la Digitalización, 20 Jun 2025

Please find our comments and suggestions in the file attached.

Consultation response

Federation of European Risk Management Associations, 20 Jun 2025

1. ON THE SIMPLIFICATION OF CYBER REPORTING European companies face an increasingly challenging environment, marked by the rising volume, complexity, and sophistication of cyber threats: since 2018, cyberattacks are considered as the most critical risk by Risk Managers worldwide (see: FERMAs Global…

Consultation response

Cámara Oficial de Comercio, Industria, Servicios y Navegación de España, 20 Jun 2025

La Cámara de Comercio de España considera oportuna y necesaria la iniciativa de revisión del Reglamento de Ciberseguridad, en tanto que constituye una oportunidad para reforzar los instrumentos existentes sin comprometer la seguridad jurídica ni aumentar de forma innecesaria la carga regulatoria…

Consultation response

OpenForum Europe AISBL, 19 Jun 2025

OpenForum Europe (OFE) welcomes the opportunity to provide input to the public consultation on the revision of Regulation (EU) 2019/881 (Cybersecurity Act). The revision of the Cybersecurity Act presents a timely opportunity to align ENISAs mandate with the realities of the rapidly developing…

Eco Urges Stronger Independence for EU Cybersecurity Agency ENISA

eco - Verband der Internetwirtschaft, 20 Jun 2025

Eco calls for granting ENISA more autonomy to act as an independent expert. They want certification aligned with global standards and streamlined reporting to reduce bureaucracy.
Standardized rules and simplified reporting would reduce compliance costs for internet service providers.
Proponents of technological sovereignty may lose control as ENISA gains more operational independence.

ESMIG backs Cybersecurity Act to ensure uniform EU standards

European Smart Energy Solution Providers, 11 Jun 2025

ESMIG recommends keeping the current Cybersecurity Act text and ENISA support. They stress the need to prevent fragmentation caused by differing national certification schemes.
A single certification approach would streamline market access across all European countries.

Consultation response

European Telecommunications Standards Institute, 20 Jun 2025

The European Telecommunications Standards Institute (ETSI) is pleased to provide its feedback on the call for evidence regarding an assessment of the Cybersecurity Act (CSA) adopted in 2019. Cybersecurity is a major focus area of ETSIs work with its Technical Committee CYBER being active for a long…

Consultation response

Kaspersky Labs Limited, 24 Apr 2025

Kaspersky, a global cybersecurity company committed to supporting secure and resilient digital infrastructure across the EU and globally, welcomes the European Commissions initiative to revise the Cybersecurity Act. We recognize the CSAs pivotal role in defining the EUs cybersecurity governance and…

Consultation response

Trellix, 20 Jun 2025

Trellix, as a global leader in cybersecurity solutions serving both private and public sector clients, welcomes the European Commissions initiative to revise the Cybersecurity Act (CSA) and to simplify the EUs cybersecurity legislative framework. The evolving threat landscape and the proliferation…

Hospital federation demands more funding for EU cybersecurity mandate

European Hospital and Healthcare Federation, 19 Jun 2025

The federation demands clarification on ENISA's role and calls for increased financial support. They want streamlined regulations that avoid administrative duplication while protecting sensitive healthcare data.
Securing more funding would help hospitals strengthen their defenses against evolving cyber-threats.
Technology providers may see their market competitiveness deprioritized in favor of patient safety.

Consultation response

CIO Platform Nederland, 20 Jun 2025

CIO Platform Nederland welcomes the opportunity to share its insights, and those of the CIO associations in Belgium and Germany, on the Cyber Security Act with the Commission. You can find these in the attached document, which has been drafted in close coordination with Beltug and VOICE e.V. We are…

Consultation response

ISACA, 5 Jun 2025

ISACA welcomes the CSA revision as a key opportunity to harmonise EU cybersecurity rules, enhance ENISAs mandate, and build digital resilience. It calls for a stronger role for ENISA in policy implementation, technical coordination, and skills development. ISACA supports making cybersecurity…

Consultation response

Assotelecomunicazioni, 20 Jun 2025

Asstel, associazione della filiera delle telecomunicazioni, esprime alcune osservazioni inerenti la revisione del Regolamento sulla Cibersicurezza nel file allegato.

Consultation response

Gen Digital Inc., 20 Jun 2025

Gen Digital, the global leader in consumer cyber safety and digital protection solutions, with renowned brands including Norton, Avast, LifeLock, Avira, and AVG, welcomes the European Commissions timely initiative to revise the EU Cybersecurity Act. We fully support the Commissions strategic…

Consultation response

Finnish Information Security Cluster – Kyberala ry, 19 Jun 2025

ENISAs mandate needs to be critically assessed, focusing its tasks on areas where it can provide the most European value added that member states cannot achieve independently. It has far too many tasks in its mandate (even approx. 80 various tasks) and there is a need to significantly reduce them.…

Consultation response

CrowdStrike, 20 Jun 2025

CrowdStrike welcomes the opportunity to respond to the European Commissions Call for Evidence on the revision of the EU Cybersecurity Act (CSA). As a global, AI-native cybersecurity provider, we bring insights informed by frontline experience defending organizations from sophisticated, rapidly…

Consultation response

NetApp Ireland Limited, 20 Jun 2025

NetApp welcomes the opportunity to contribute to the European Commissions public consultation and call for evidence on the revision of the EU Cybersecurity Act. Recognizing the current pressures of the geopolitical landscape, we consider that the development and application of objective trusted…

Consultation response

The Open Cloud Coalition, 20 Jun 2025

The Open Cloud Coalition (OCC) welcomes the European Commissions initiative to review the EU Cybersecurity Act (CSA) in light of evolving cyber threats. The Commissions call for feedback emphasizes goals of strengthening resilience,simplifying rules, and addressing ICT supply chain security. In…

Consultation response

Associazione Italiana Internet Provider, 20 Jun 2025

The Italian Association of Internet Providers (AIIP) is the first and longest-standing Italian association representing Internet operators, infrastructure and network providers, including FTTH, as well as providers of electronic communications services, data center and cloud services. For thirty…

Spanish digital association urges EU to prioritize existing certification schemes

Asociación Española de Economia Digital, 19 Jun 2025

Adigital requests strengthening ENISA's resources to prioritize current mandates before expanding the framework. They advocate for voluntary certification and deeper cooperation with the private sector.
This would provide regulatory certainty and reduce costs for digital businesses.
Centralized EU authorities lose direct visibility if reporting is handled through national entry points.

Consultation response

Cremades & Calvo-Sotelo Abogados S.L.P., 21 May 2025

As a law Firm with expertise in telecom, digital law and business tech, we welcome the opportunity to participate in the consultation initiated by the European Commission. We share the Commissions view that the evolution of networks and technology requires regular reassessment of cybersecurity…

Consultation response

Eesti Infotehnoloogia ja Telekommunikatsiooni Liit, 20 Jun 2025

Eesti Infotehnoloogia ja Telekommunikatsiooni Liit (ITL) tervitab Euroopa Komisjoni küberturvalisuse määruse 2029/881 (edaspidi: määrus) ülevaatamist, kuna meie hinnangul ei ole see suutnud oma eesmärke täita. Peamine murekoht seisneb selles, et ENISA ei ole saanud talle omistatud rolliga tõhusalt…

Consultation response

Open Source Initiative, 20 Jun 2025

Please find below our feedback. For your convenience, it is also attached as a PDF with structured formatting. Dear Commission Reviewer, The Open Source Initiative (OSI) is a global charity at the heart of the Open Source Community for over 25 years, recognized globally as the authority defining…

U.Di.Con. urges technical ban on digital identity spoofing

U.Di.Con. APS Unione per la Difesa dei Consumatori, 19 Jun 2025

The association demands protection against scams involving simulated corporate and personal identities. They call for technical measures to stop spoofing, which allows fraudsters to impersonate banks. Communication architectures should be redesigned to make phone number theft impossible.
This would protect consumers from financial losses caused by digital identity fraud.
Telecom operators would incur costs to redesign their technical communication architectures.

AIOTI urges technical focus for EU cybersecurity certification

Alliance for AI, IoT and Edge Continuum Innovation IVZW, 19 Jun 2025

AIOTI advocates for certification based on technical standards that allow for measurable and aligned criteria. They propose excluding non-technical requirements from the revised framework because they are not assessable.
This prevents unpredictable assessments by ensuring requirements are based solely on objective technical standards.
Policy makers lose the ability to vet vendors based on non-technical geopolitical risks.

Consultation response

Hangzhou Hikvision Digital Technology Co., Ltd., 18 Jun 2025

Hikvision welcomes the opportunity to contribute to the revision of the EU Cybersecurity Act. We believe a harmonized, risk-based, and proportionate approach is essential for a thriving digital single market. We advocate for clear, practical certification schemes aligned with international…

Consultation response

CLUSIT - Associazione italiana per la Sicurezza Informatica, 20 Jun 2025

Clusit welcomes the opportunity to contribute to the impact assessment for the CSA, to provide feedback on the effectiveness of its adoption, and to suggest possible actions to improve this regulation. Please find in attachment our contribution.

Consultation response

Circularise, 20 Jun 2025

Circularise is a technology company at the forefront of digital transparency and traceability in global supply chains. Through our Digital Product Passports (DPPs), we enable secure and standardized data exchange across a wide range of industrial sectors. Our solution supports regulatory compliance…

Consultation response

Eurosmart, 20 Jun 2025

Eurosmart supports a focused revision of the EU Cybersecurity Act (CSA) to strengthen ENISAs role, preserve the integrity of the European Cybersecurity Certification Framework (ECCF), and streamline certification. The CSA remains central to the EUs cybersecurity framework, and its alignment with…

Consultation response

EUCC ISAC, 20 Jun 2025

The EUCC Information Sharing and Analysis Centre (ISAC) has submitted feedback on the revision of the EU Cybersecurity Act (CSA), emphasizing the need to institutionalize collaborative mechanisms between public and private stakeholders. It proposes integrating the successful EUCC ISAC model into…

Consultation response

, 19 Jun 2025

The Confédération des Petites et Moyennes Entreprises (CPME) represents French SMEs across all sectors and regions. In its response to the consultation on the EU Cybersecurity Act, CPME supports the objective of strengthening cybersecurity, but stresses the need for a more accessible, consistent…

Consultation response

Charter of Trust, 19 Jun 2025

The Charter of Trust, a coalition of global companies dedicated to cybersecurity, welcomes the opportunity to submit our consolidated response to the European Commissions public consultation on the revision of the Cybersecurity Act. We endorse policy option2, which advocates for targeted regulatory…

Consultation response

Red Alert Labs, 19 Jun 2025

Red Alert Labs welcomes the EC's initiative to revise the CSA and is pleased to contribute as a CAB/ITSEF actively engaged in cybersecurity certification across multiple regulatory domains. We support the goals of reinforcing ENISAs mandate, improving the ECCF, and streamlining cybersecurity…

Consultation response

Open Source Security Foundation, 18 Jun 2025

This is the Open Source Security Foundation (OpenSSF) Global Cyber Policy Working Groups response to the European Commissions Public Consultation for The EU Cybersecurity Act Call for Evidence (with comments from the OpenSSF Public Policy Committee). See the attached file for details of our…

Consultation response

IPAC GLOBAL, 17 Jun 2025

To ensure safe digitalisation at all levels, we, the undersigned members of the Inter-Parliamentary Alliance on China call for the introduction of observer status in the European Union Agency for Cybersecurity (ENISA) for Albania, Bosnia and Herzegovina, Kosovo, Montenegro, North Macedonia and…

Consultation response

European Energy Information Sharing and Analysis Centre, 17 Jun 2025

The European Energy Information Sharing and Analysis Centre (EE-ISAC) welcomes the opportunity to contribute to the European Commissions consultation on the revision of Regulation (EU) 2019/881 (the Cybersecurity Act). EE-ISAC is a trust-based, industry-driven information-sharing network that…

Consultation response

EUROPEAN FEM INSTITUTE, 11 Jun 2025

European Fem Institute rekomenduje włączenie przemocy ze względu na płeć jako pozatechnicznego czynnika ryzyka w ramach europejskiego systemu certyfikacji cyberbezpieczeństwa. Obecne ramy koncentrują się głównie na zagrożeniach technicznych, pomijając jednocześnie systemowe i społeczne ryzyka…

Consultation response

GMVV & Co. GmbH, 10 Jun 2025

GMVV & Co. GmbH is a strategic think tank, registered with the Parliament of the European Union and the Commission in the EU Transparency Register under Section IV, specialized in research in the field of criminal law and justice in connection with the protection of human and civil rights. In April…

DigitalTrade4.EU calls for dual-use digital standards in defense

DigitalTrade4.EU, 3 Jun 2025

The consortium recommends aligning digital trade tools with defense initiatives through interoperability and decentralization. They suggest mandating standards like MLETR and eIDAS for secure military logistics. Additionally, they propose extending Digital Product Passports to track sensitive defense equipment.
Standardized digital processes would significantly lower administrative burdens and compliance costs for their member organizations.
Operators of centralized digital systems face potential displacement by more resilient, decentralized network architectures.

Consultation response

Global Intelligence International, 15 Apr 2025

The EU Cybersecurity Act (2019) aims to enhance cybersecurity across the Union by strengthening the European Union Agency for Cybersecurity (ENISA) and establishing a framework for cybersecurity certification of ICT products, services, and processes. Improving it could address emerging threats,…