From Cybersecurity To Supply Chain Sovereignty In CSA2: The Spotlight On Suppliers

In January 2026, the European Commission unveiled its plan to overhaul the EU's Cybersecurity Act, a proposal now known as CSA2. It's the natural next step in a story that began years earlier with the EU's 2020 "5G Security Toolbox" - a set of voluntary recommendations encouraging Member States to be cautious about certain telecom suppliers. That voluntary approach produced patchy results: by most accounts, fewer than half of EU countries had actually acted on those recommendations. It is worth asking whether the adoption levels were however a failure of design, or a reflection of Member States reaching different conclusions about their risk exposures.

CSA2 is, in large part, the Commission's answer to that inconsistency - turning soft guidance into binding law. As EU Commissioner Henna Virkkunen has put it, the goal is to finally finish the job that member states started on their own. That framing is worth a pause however, as its based on an assumption that hasn’t been put to the