EU Cybersecurity Act 2 Advances Amid Member States’ Concerns Over EU Competence

As the revision of the EU Cybersecurity Act ("CSA 2") advances through the ordinary legislative procedure, its framework empowering the European Commission (the "Commission") to exclude high-risk suppliers from the EU market is drawing Member State scrutiny over the limits of EU competence in cybersecurity—a concern reinforced by Advocate General Ćapeta's recent opinion in Elisa Eesti reaffirming Member States' exclusive competence over national security.

CSA 2, which aims to reinforce the European Union's cybersecurity framework, is progressing through the ordinary legislative procedure. As discussed in our prior Alert, the proposal establishes a horizontal framework (meaning it applies uniformly across all critical sectors rather than on a sector-by-sector basis) to secure information and communications technology, or ICT, supply chains.