A New EU Cybersecurity Package Is Here, But What's Really Changing?

On 20 January 2026, the European Commission proposed a new EU Cybersecurity Package, a legislative designed to strengthen the European Union's long-term resilience against increasingly frequent and sophisticated cyber threats.

The initiative comes at a time when cyberattacks and hybrid threats are increasingly targeting essential services, critical infrastructure and even democratic institutions. These attacks are attributed not only to organised criminal networks, but also, more critically, to state-linked actors operating in a rapidly evolving geopolitical landscape.

Why the EU is introducing a new cybersecurity package

Since the adoption of the Cybersecurity Act in 2019, the cybersecurity landscape has changed dramatically. The Commission highlights that technological developments, combined with geopolitical instability, have created heightened risks for critical sectors and key social and economic functions across the Union.