European digital sovereignty and the risk of confusing security with geopolitics

Current status of CSA2 and next steps in the EU

As of June 13, 2026, the review of Regulation (EU) 2019/881, informally known as “Cybersecurity Act 2” (CSA2), is in an early stage of the ordinary legislative procedure of the European Union. The Commission has already submitted a proposal to amend the Regulation, and it has been sent to national parliaments for subsidiarity control, a phase that in Spain concluded in April 2026 without formal objections. It is not yet recorded that the European Parliament has adopted its first reading position nor that the Council has approved a general approach, so trilogues have not been initiated. Consequently, the next steps involve internal work within Parliament and Council and, only afterwards, the interinstitutional negotiation that will lead to the final text.

1. Starting point: current Regulation and scope of the review

The reference framework remains Regulation (EU) 2019/881, which establishes ENISA's mandate and creates the European cybersecurity certification framework. The base text can be consulted on EUR‑Lex. This regulation has already been amended occasionally, for example through Regulation (EU) 2025/37 on managed security services, but the CSA2 reform is conceived as a broader revision of the system, strengthening ENISA's powers and adjusting the certification framework, in line with other instruments such as NIS2 and the future deployment of the Cyber Resilience Act, which is a distinct instrument.

According to the analysis by El Demócrata, the reform also fits into a geopolitical context marked by concern over providers considered “high risk” in critical infrastructures (telecommunications, energy, etc.), introducing tools to limit their participation or even require equipment withdrawal in certain cases.

2. Current phase: subsidiarity control and absence of legislative positions

After submitting the proposal, the Commission sent it to national parliaments for subsidiarity control (standard period of 8 weeks). In Spain, the initiative was examined by the Joint Committee for the European Union of the Congress and the Senate, which approved the subsidiarity report on 04/13/2026 by assent, without a negative reasoned opinion. The file can be seen in the Official Bulletin of the General Courts, Series A, no. 232, available in this Congress PDF, and in the informative tracking sheet of the European initiative at Quehacenlosdiputados.es.

With the information accessible in official and open sources, it is not yet recorded that:
– The European Parliament has approved its first reading position (neither in committee nor in Plenary).
– The Council of the EU has adopted a general approach that serves as a negotiation mandate.
– Trilogues between Parliament, Council, and Commission have been initiated.

This places the file in a preparatory phase: assignment to Parliament committee(s) (likely ITRE and/or LIBE), appointment of rapporteur, drafting of report, and technical debates in Council working groups (Telecommunications/Information Society).

3. Formal next steps in the ordinary legislative procedure

The standard path expected for CSA2 is as follows:

a) In the European Parliament
– Formal assignment of the file to the competent committee and appointment of rapporteur and shadow rapporteurs.
– Presentation of a committee draft report, with amendments from political groups.
– Vote on the report and, if applicable, on a negotiation mandate authorizing the start of trilogues before the Plenary.
– Vote in Plenary on the first reading position.

To follow these steps once the file is fully indexed, the entry point is the Legislative Observatory (OEIL): European Parliament OEIL.

b) In the Council of the EU
– Meetings of sectoral working groups to refine the position of Member States.
– Adoption by the Council of a general approach, which functions as a negotiation mandate vis-à-vis Parliament.
– Possible revisions of the mandate as dialogue with Parliament progresses.

Monitoring is done through the Council's legislative tracker: Council legislative tracker.

4. Trilogues, final adoption, and timeline

Only when Parliament has set its first reading position and the Council has its general approach can trilogues begin. In this phase, the three institutions negotiate a compromise text; if agreed, it is consolidated into a Council first reading position and Parliament endorses it in second reading, or vice versa, depending on when the agreement is reached. Afterwards, the signature and publication in the Official Journal of the EU (OJ) take place, after which the revised regulation enters into force (usually 20 days after publication, unless otherwise provided).

Since to date there are no formal positions from Parliament or Council nor trilogues underway, it is not possible to set a reliable schedule for final adoption. As a guideline, reforms of this scope usually take between 18 and 30 months from the Commission's proposal. Taking as reference that subsidiarity control in national parliaments ended in mid-April 2026, a reasonable horizon, always subject to the agenda of the new European legislature and the degree of consensus among Member States, could be between late 2027 and 2028, but this is a speculative projection.

To contextualize the review, the political analysis on the dimension of digital sovereignty and the risk of confusing security with geopolitics published by El Demócrata may be useful, as well as the monitoring of internal impact in Spain and debates on delays in the cybersecurity framework, described in this report.

Summary

The European Commission plays a central role in cybersecurity and in regulating technology providers, but its power is mainly normative, promotional, and supervisory of compliance, not direct operational over Member States. It proposes major rules (such as NIS2, the Cyber Resilience Regulation, or digital services legislation) and monitors that States and companies apply them correctly. Additionally, it defines cybersecurity certification frameworks, coordinates responses to cross-border incidents, and can intervene in competition matters against large platforms or dominant providers. Many concrete security decisions remain the competence of Member States, but under a common framework designed and overseen by the Commission.

1. General role of the European Commission in cybersecurity

At the Union level, cybersecurity is conceived as an area of shared competence: Member States retain competencies in national security, but the Commission promotes and coordinates common policy in everything affecting the internal market and the provision of digital services. This includes harmonizing requirements for operators of essential services and digital service providers, creating minimum obligations for risk management and incident notification, and strengthening the resilience of technological supply chains operating throughout the EU.

Since it is a highly cross-border area (networks, cloud services, platforms, digitized critical infrastructures), the Commission relies on the legal basis of the internal market to justify adopting directives and regulations that avoid a divergent regulatory mosaic among countries. In practice, this allows it to establish a “common floor” of technical and organizational requirements, which States can tighten but not lower.

2. Normative powers: proposal and development of legislation

The Commission's most relevant attribution is legislative initiative in cybersecurity and technological regulation. It can propose directives and regulations which, after approval by the European Parliament and the Council, become binding. Among the major recent regulatory packages fitting this area are cybersecurity of networks and systems (such as the framework replacing and expanding NIS), the Cyber Resilience Regulation, and specific regulation of digital services and platforms (including security, risk management, and transparency requirements for large technology providers).

Additionally, the Commission is empowered to adopt delegated and implementing acts foreseen in those norms. Through these acts, it can specify technical requirements, risk assessment methodologies, incident notification formats, or detailed criteria to classify services and providers by criticality level. This grants it significant capacity to adapt the regulatory framework to technological evolution without constantly reopening major legislative texts.

3. Supervision, enforcement, and infringement procedures

Once the rules are approved, the Commission has the attribution to ensure they are properly applied in all States. It supervises the transposition of directives into national legal systems, reviews that Member States designate competent cybersecurity authorities, single points of contact, and incident response teams, and that they provide those authorities with sufficient sanctioning powers against operators and providers who fail to comply.

If it detects that a State does not transpose on time, does so incompletely, or does not properly apply cybersecurity or technology provider regulation obligations, the Commission can open infringement procedures. These procedures can culminate in cases before the Court of Justice of the EU and, ultimately, economic sanctions. It can also launch reviews of the regulation's functioning (impact assessments, implementation reports) and propose adjustments when it detects regulatory gaps or widespread compliance problems.

4. Regulation and control of technology providers

Regarding technology providers, the Commission acts on several levels. First, it sets security and data governance requirements for certain services (e.g., cloud services, content platforms, online marketplaces, or mobile operating systems), depending on their size, systemic role, or criticality. These requirements may include security audits, vulnerability management obligations, algorithmic transparency, or enhanced data protection and service continuity measures.

Second, it promotes EU-wide cybersecurity certification frameworks, which allow labeling technological products and services according to assurance levels. Although technical management is handled by specialized agencies and evaluation bodies, the Commission defines the general framework and can propose specific schemes for high-risk product categories (e.g., connected devices or network components). This directly affects how providers design and market their solutions in the European market.

Third, it uses its competition and internal market powers to intervene against dominant providers' conduct that may affect, among other aspects, the security and resilience of the digital ecosystem. It can impose structural or behavioral remedies, require interoperability and fair access to essential infrastructures, and monitor that control of key technologies is not used to distort the market to the detriment of security or innovation.

5. Coordination, incident response, and international cooperation

Although operational incident management remains national, the Commission has coordination powers when a cybersecurity incident has significant cross-border impact. It participates in coordinated response mechanisms, promotes information exchange among States, and fosters joint exercises and contingency plans at the EU level. Likewise, it promotes European cybersecurity strategies that guide investment in capabilities, public-private cooperation, and the development of the cybersecurity industry.

Finally, the Commission represents the EU in many international forums on technical standards, Internet governance, and cybersecurity, and negotiates or coordinates common positions in agreements with third countries. In this way, it exports European regulatory standards on digital security abroad and influences the practices of global technology providers wishing to operate in the European market, transferring the so-called “Brussels effect” to the cybersecurity field.

Brief answer

For the European Union to restrict the participation of providers considered high risk in critical infrastructures, essentially a clear legal basis in EU law (treaties or secondary legislation) is needed, respect for the internal market and free competition, and a solid justification based on national security, public order, or network and information security. Such restrictions must be proportionate, not discriminatory without objective reason, and properly motivated. Additionally, they are usually articulated through sectoral legislation (e.g., telecommunications, energy, transport, digital services), Commission decisions, or coordination frameworks among Member States. As a specialized assistant in policy and regulation, but focused on the Spanish context, I can explain it from a general legal-political perspective without delving into the technical details of all possible European instruments.

1. Legal basis and respect for the internal market

The EU can only limit the participation of providers in critical infrastructures if it relies on a legal basis in the Treaties (mainly the Treaty on the Functioning of the European Union, TFEU) and derived legislation (regulations, directives, or decisions). The starting point is that the free movement of goods, services, capital, and the right of establishment are the general rule in the internal market. Any restriction on a provider's participation, especially if from another Member State or a third country, is considered an exception that must be well justified.

The Treaties allow exceptions to free movement for reasons of public order, public security, and public health, and the Court of Justice of the EU's case law has consolidated that the protection of critical infrastructures and cybersecurity can fit within these overriding reasons of general interest. But it is always required that the measure be proportionate (not going beyond what is necessary) and suitable to achieve the security objective.

2. National security and Member States' margin

National security is primarily a Member State competence, but national decisions affecting the internal market's functioning (e.g., excluding certain providers from 5G networks, energy systems, or essential digital platforms) must be compatible with EU law. This means that, although the EU recognizes a broad margin to protect national security, arbitrary or purely political use of that clause is not allowed: risk assessments, objective criteria, and a clear link between the “high risk” provider and the threat to critical infrastructure must exist.

From a political perspective, in Spain this balance is seen in how the Government must justify to the European Commission and other partners any relevant restriction that may affect investments or contracts in regulated sectors, aligned with the existing European frameworks on cybersecurity, foreign investments, and critical infrastructure protection.

3. Sectoral legislation and cybersecurity frameworks

In practice, restrictions on high-risk providers are mainly implemented through sectoral and network and system security legislation. At the European level, the typical approach is:

First, define what is critical infrastructure or “essential service” (e.g., sectors like energy, transport, banking, health, drinking water, digital infrastructures) through cybersecurity and infrastructure protection directives. Second, impose on operators of essential services and digital service providers obligations for risk management, supply chain security, and incident notification, including risk assessment of third-party providers. Third, enable Member States to designate certain providers as high risk, based on objective criteria (links with third-country governments, history of cyber incidents, ability to comply with security requirements, etc.) and, from that designation, limit or prohibit their participation in critical network and system components.

Within this framework, the EU usually promotes coordination: information exchange on threats, development of “toolboxes” or sets of recommended measures, and, in some cases, the possibility for the Commission to oversee that national restrictions do not violate EU law.

4. Requirements of proportionality, transparency, and control

From a legal-political standpoint, restrictions must meet a series of minimum requirements to pass European scrutiny:

First, proportionality: the measure must be necessary and the least restrictive possible to achieve the security objective. Blocking a provider's total participation would only be justified if less restrictive measures (network segmentation, certification requirements, additional controls) are insufficient. Second, non-discrimination: a provider cannot be treated worse without objective basis. Although many debates have focused on companies from certain third countries, legally there must be a risk assessment justifying differential treatment. Third, motivation and procedure: decisions must be reasoned, subject to some form of administrative or judicial review, and, when having a European dimension, notified or coordinated within the EU framework.

Finally, in the Spanish context, any such measure is inserted into national legislation on national security, cybersecurity, and critical infrastructure protection, which in turn transposes and applies European obligations. Democratic control is exercised through the Government, Parliament, and judicial oversight, ensuring that restrictions on high-risk providers in critical infrastructures are legally founded and politically supervised.