Europe prepares for a regulatory rearmament of the digital: the new frontier of power is in the algorithms

Based on the available information, the so-called “European Cybersecurity Act” you refer to is the new Cybersecurity Regulation proposal presented by the Commission on January 20, 2026, which reviews and strengthens the framework of the current Cybersecurity Act and its European certification system. This proposal has not yet been definitively approved: it is currently in the ordinary legislative procedure (European Parliament and Council) and without a finalized text.

1. Exact phase

According to the legislative analysis by Demócrata, the Commission presented the new EU Cybersecurity Regulation as part of a cybersecurity package aiming to:

• Strengthen the EU's capacity to prevent, detect, and respond to large-scale cybersecurity incidents.
• Update the European Cybersecurity Certification Framework, simplifying and harmonizing schemes.
• Reduce regulatory fragmentation and ICT supply chain risks, including risks linked to third-country suppliers.

After this presentation, the text “now begins its ordinary legislative procedure”, which implies:

• In the European Parliament, examination by the competent committees on the internal market, civil liberties, and security, which must prepare reports and amendments.
• In the Council, Member States must establish a position on the scope of the new framework and its alignment with existing or transposed legislation (for example, NIS2).

Other recent articles indicate that the reform of the EU cybersecurity law and the new certification framework “are still in the legislative process” and that the final form of the regulation must still be negotiated with the Twenty-Seven and the European Parliament, confirming that, as of August 2026, final approval has not yet occurred.

2. Next steps in the European parliamentary procedure

From the current phase (Commission proposal under study), the usual steps until final approval are:

• 1) Work in European Parliament committees
  The committees (e.g., Internal Market, Civil Liberties, and Security) discuss the text, present amendments, and approve a report with the Parliament's position. This report will serve as the basis for the Plenary debate.
• 2) Formation of the Council's position
  In parallel, Council working groups and competent ministers agree on a general position, in which Member States adjust the scope of the regulation, certification obligations, ENISA governance, etc.
• 3) Trilogues
  With the Parliament and Council positions on the table, interinstitutional negotiations (trilogues) open between:
  • European Commission (defending the initial proposal and mediating technically);
  • European Parliament (rapporteur MEPs and “shadows”);
  • Council (representatives of Member States).
  The goal is to reach a single compromise text.
• 4) Formal approval
  Once the political agreement is closed, both the Parliament Plenary and the Council must formally approve the regulation. Only then is it sent to the Official Journal of the EU (OJEU) for publication.
• 5) Entry into force and application
  The regulation normally enters into force 20 days after its publication, but many cybersecurity and certification obligations apply after transitional periods (e.g., 24 months), as has happened with the Cyber Resilience Act or the Cyber Solidarity Act.

3. What it implies for companies and Member States

Although the “European Cybersecurity Act” is not yet approved, the pieces of the new European framework are already being deployed:

• ENISA has promoted schemes such as the EUCC (certification based on common criteria) and is working on others, including for managed security services, in accordance with the current Cybersecurity Act and future amendments.
• The Commission and Council have already adopted other regulations in the package, such as the Cyber Solidarity Act, and are advancing in the implementation of NIS2, DORA, and the Cyber Resilience Act, which will be applied gradually between 2026 and 2028 (see analysis).
• Member States, like Spain, are reorganizing their own national cybersecurity laws to align with this European package and the future cybersecurity regulation currently under negotiation.

In summary, the European Cybersecurity Act strictly speaking (the new regulation revision) is today in parliamentary and Council negotiation phase, without a final vote, and the next milestones will be the closure of positions by both institutions, the trilogues, and the formal adoption of the regulation, after which a gradual implementation period and development of new European certification schemes will begin.

The powers of the President of the European Commission in digital transformation do not appear as a “specific catalog” in the EU Treaties. What exists is, on one hand, the general framework of the Commission's powers and, on the other, the functions that the Treaties attribute to the President of the Commission. From there, the digital dimension is framed as one of the major political priorities, but legally it is exercised through those general powers.

1. General basis: the role of the Commission in digital policies

Digital transformation is articulated in the Treaties mainly as part of the internal market, trans-European networks, research and innovation, and data protection, among other areas. Although the question focuses on the President, it is important to remember that:

• Article 17.1 of the TFEU establishes that the Commission “shall promote the general interest of the Union and take appropriate initiatives to that end.”
• Article 17.2 TFEU indicates that, with few exceptions, the Commission has the monopoly on legislative initiative (it presents proposals for regulations, directives, decisions, etc.).
• Much of the digital legislation (digital services, digital markets, cybersecurity, data, 5G networks, etc.) is based on the articles of the TFEU on the internal market, trans-European networks, information society, or research.

That is, the Union's capacity to act digitally is legally channeled through the Commission as a whole, and the President exercises her powers within that collegiate framework.

2. Formal powers of the President according to the Treaties

The President's functions are mainly described in Article 17.6 TFEU and, more generally, in other provisions on the functioning of the Commission. The most relevant, with direct impact on the digital agenda, are:

• Setting the general political direction of the Commission (art. 17.6 TFEU): the President “shall lay down the guidelines on which the Commission shall be based in carrying out its tasks.” This includes deciding that digital transformation is a strategic priority and defining its main lines (for example, a “Europe prepared for the digital age”).
• Organizing the Commission internally: the same article grants her the power to “decide the internal organization of the Commission to ensure coherence, efficiency, and collegiality of its action.” On this basis, the President:
  • Assigns and can reassign portfolios (for example, an executive vice-president responsible for the digital agenda).
  • Determines which commissioner leads specific digital legislative proposals.
  • Restructures services (directorates-general) to adapt them to the digital priority.
• Appointing and, if necessary, dismissing commissioners within the provided margins: the President “shall decide the distribution of responsibilities among the members of the Commission” and can request a commissioner’s resignation. This gives her decisive political leverage over who drives the digital agenda.
• Leading the work of the College: she chairs the meetings of the College of Commissioners, sets the agenda, and therefore can prioritize or delay legislative and strategic proposals on digital matters.
• Representation of the Commission: the President represents the Commission before the European Council, the Council, and the European Parliament (without prejudice to the High Representative in the CFSP). This includes:
  • Defending the Commission's digital initiatives in legislative negotiations.
  • Participating in European councils where digitalization (data, artificial intelligence, cybersecurity) is a central topic.

3. Specifics regarding digital transformation

Based on these general provisions, Ursula von der Leyen's powers regarding digital matters are concretized in several types of acts and decisions:

• Establishing the initial “political guidelines” for the legislature, in which she can identify digital transformation as a cross-cutting priority (data economy, AI, connectivity, digital capabilities, etc.).
• Proposing and coordinating the Commission's annual work program, which includes the digital legislative and non-legislative initiatives the Commission plans to present.
• Promoting the use of the right of initiative in digital matters: although proposals are prepared by the competent commissioner, the President can order, prioritize, or redirect those proposals (for example, accelerating an AI regulation or modulating its scope).
• Ensuring horizontal coherence: digitalization affects competition, internal market, industry, employment, education, data protection, etc. The President's coordination functions allow her to:
  • Lead groups of commissioners or “clusters” to ensure digital policy coherence across portfolios.
  • Arbitrate conflicts between commissioners when a digital initiative affects several areas.
• Politically representing the Commission in international forums on digital governance (G7, G20, UN, OECD, bilateral summits), defending the EU position developed by the Commission and supported by the Council.

4. Limits of her powers

No Treaty provision grants the President an exclusive or autonomous competence in digital matters separate from the College of Commissioners. All legislative and regulatory decisions are adopted collegially. The President's specificity is:

• Her capacity to define priorities and organization.
• Her central role in the political representation of the European digital agenda.
• Her influence over the composition and coordination of the Commission.

In summary, according to the Treaties, Ursula von der Leyen does not have “digital powers” of her own but exercises, regarding digital transformation, the same functions of promotion, coordination, internal organization, and representation that the TFEU attributes to the Commission presidency in any other major Union priority.

EU Member States can limit or exclude providers considered “high-risk” from their telecommunications networks (particularly 5G), but only if they comply with a series of legal requirements derived from Union Law and common political guidelines (the so-called EU 5G Toolbox). These are not discretionary decisions: they must be anchored in an appropriate legal basis and respect principles such as proportionality, non-discrimination, and the internal market.

1. Legal basis and Member State competence

First, the Member State must act within its competences in:

• National security (essentially a state competence, but exercised respecting EU Law).
• Cybersecurity and electronic communications, where the following apply:
  • The European Electronic Communications Code (Directive (EU) 2018/1972).
  • Cybersecurity legislation, including the NIS Directive and its revision NIS2.
  • The Commission Recommendation on 5G network cybersecurity and the “5G Toolbox.”

Restrictions must have a clear foundation in national legislation that transposes or develops these rules, defining who decides, by what procedure, and with what criteria.

2. Prior risk assessment based on objective criteria

It is not acceptable to declare “high risk” in a generic or purely political manner. Member States must:

• Conduct a security risk assessment of their networks (especially 5G and critical elements).
• Apply objective technical and legal criteria, including:
  • The provider's role in critical functions (network core, management, orchestration, data centers, etc.).
  • The degree of technological dependence and risk of “vendor lock-in.”
  • Security history, known vulnerabilities, and capacity for remediation.
  • Possible third-country state interference (e.g., legal frameworks obliging the provider to cooperate with intelligence services without sufficient safeguards).

The EU 5G Toolbox emphasizes that the concept of “high-risk provider” must derive from this structured assessment, not from a purely geopolitical or commercial criterion.

3. Proportionality and non-discrimination

Limiting high-risk providers involves interfering with freedom of enterprise and the free movement of goods and services. Therefore, EU law requires:

• Measures proportionate to the detected risk:
  • Prioritize restrictions on critical components and functions (network core, remote management, monitoring systems).
  • Only reach a total exclusion of the provider if risks cannot be mitigated otherwise.
  • Allow, when reasonable, transitional periods and gradual replacement plans.
• No arbitrary discrimination:
  • Measures must be based on concrete risks, not on national origin per se.
  • The same criteria must apply to all providers in comparable situations.

4. Respect for the internal market and European coordination

National decisions cannot ignore the functioning of the EU internal market:

• Restrictions must be compatible with competition and public procurement rules.
• If they constitute a new “technical regulation,” they must follow European prior notification procedures, so the Commission and other Member States can examine their impact.
• States must coordinate through European structures (e.g., the NIS Cooperation Group and the 5G expert group) to avoid fragmentation and ensure an equivalent security level.

5. Procedural guarantees and judicial review

Measures against high-risk providers must respect the guarantees of the Rule of Law:

• Reasonable transparency about the criteria used and the type of measures (without revealing sensitive security information).
• Clear procedure for decision-making (competent body, deadlines, information to operators).
• Right of defense for the provider and affected operators, at least through access to sufficient reasoning.
• Possibility of appeal before national courts or independent regulatory bodies, with proportionality and EU law compatibility review.

6. Comprehensive risk management approach

Finally, European legislation and the 5G Toolbox adopt a global approach: limiting high-risk providers is only one piece of a broader cybersecurity strategy, which includes:

• Enhanced security requirements for essential operators and important service providers.
• Business continuity and incident response plans.
• Continuous regulatory supervision and updating of risk assessments in light of new technological or geopolitical threats.

Overall, Member States can only restrict high-risk providers when doing so is legally founded, based on an objective risk assessment and coordinated at the European level, with proportionate, non-discriminatory measures subject to effective judicial review.