May 2026 – We are pleased to share our updated and extended overview and critical analysis of the European cybersecurity reform, Cybersecurity Act 2.0 (CSA2), now including additional jurisdictions.

The European Supervisory Authorities have released their inaugural annual report on major ICT-related incidents across the EU financial sector in 2025, revealing 3,383 incidents reported under DORA regulations.

The EU's Cyber Resilience Act introduces mandatory vulnerability and incident reporting obligations for manufacturers of digital products starting 11 September 2026, well before the broader regulatory framework takes effect. Manufacturers must navigate tight reporting deadlines, determine when they become "aware" of security events, and establish governance structures to comply with 24-hour early warnings and subsequent detailed notifications through a platform that is not yet operational.

The European Commission has unveiled its European Technology Sovereignty Package, aiming to reduce the EU's heavy reliance on non-EU providers for over 80% of its digital products and infrastructure.

European financial regulators have issued new guidance on managing ICT risks from frontier AI models under DORA, setting expectations that will reshape how financial entities assess their technology providers. The statement from the European Supervisory Authorities outlines three core risk mitigation strategies—prevention, detection, and management—that will drive increasingly detailed scrutiny of AI service providers' cybersecurity, governance, and operational resilience. ICT service providers,

Starting September 11, 2026, manufacturers of digital products in the EU must report cybersecurity vulnerabilities and incidents within strict 24-hour and 72-hour deadlines under the new Cyber Resilience Act. Companies face penalties up to €15 million or 2.5% of global turnover for non-compliance, requiring immediate preparation of incident response procedures and assessment of product portfolios to meet these unprecedented product-focused cybersecurity obligations.

The European Union has unveiled a comprehensive digital infrastructure package aimed at tripling data centre capacity by 2030 while strengthening semiconductor manufacturing capabilities. This ambitious regulatory framework introduces acceleration zones, strategic project designations, and new procurement requirements that will fundamentally reshape how digital infrastructure is developed, operated, and integrated into Europe's energy systems.