EU Cyber Regulation, Part II: The Soon-To-Be-Updated Cybersecurity Act Is Linked To Geopolitics

CSA2 obliges companies to map their supply chains more thoroughly than before. The European Commission’s new proposal for a Cybersecurity Act was published in January 2026. The original regulation, which entered into force in 2019, focused on the certification framework and the tasks of the EU Agency for Cybersecurity, ENISA. The newly published CSA2 proposal significantly expands this framework. For the first time, it creates a legal basis against which supply chain security is also assessed from a geopolitical perspective.

– Other cyber regulation has focused on what a product or company does and whether the associated risks are under control. CSA2 looks more closely at who the supplier is — that is, whether the supplier can be trusted, taking into account its ownership structure, affiliations, and the third countries behind it, explains Maria Aholainen.