The Proposal for a revised Cybersecurity Act, known as the Cybersecurity Act 2 (CSA2), was published by the Commission on 20 January 2026.
At a high level, the proposal contains a number of positive developments including the CSA2’s particular emphasis on the strengthening the mandate of the European Union's Agency for Cybersecurity (ENISA). The reform of the European Cybersecurity Certification Framework (ECCF) will better enable the harmonisation of the recognition of the level of cyber security of ICT solutions across the Union, allowing Irish vendors and service providers to reach more customers throughout the EU. A harmonised approach to the security of the ICT supply chains can address the current fragmentation of the internal market caused by different approaches at national level, avoid critical dependencies and de-risk ICT supply chains from high-risk suppliers, in this way securing critical infrastructure.
However, all of the proposed provisions require detailed analysis and discussion within the Council of the European Union to ensure there is sufficient clarity as to their operation and impact, and as such they are also subject to change.
In considering Ireland’s position on this file my officials are engaging with relevant stakeholders including the Department for Foreign Affairs and Trade, the Department for Communications, Culture and Sport and the Department of Enterprise, Tourism and Employment, as well as seeking technical inputs from the National Cyber Security Centre regarding various aspects of this file.
In addition, my officials and the cyber team attached to the Permanent Representation in Brussels have been engaging with, and meeting stakeholders both here and in Brussels.
