Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on revision of the Cybersecurity Act, streamlining and supplementing cybersecurity legislation and repealing Regulation (EU) 2019/881 of the European Parliament and the Council of 17 April 2019 on ENISA (the European Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) (Text with EEA relevance)
Date: 2026-08-11
Institutions: Directorate-General for Communications Networks, Content and Technology, European Commission
Subjects: digital single market

EUROPEAN COMMISSION 
DIRECTORATE-GENERAL FOR COMMUNICATIONS NETWORKS, CONTENT AND 
TECHNOLOGY 

Cybersecurity and Trust 
Cybersecurity Technology and Capacity Building 

RESULTS OF THE PUBLIC CONSULTATION  
FOR THE REVISION OF CYBERSECURITY ACT 

SUMMARY REPORT 

1.  Introduction 

The public consultation supported the revision of the Cybersecurity Act (Regulation (EU) 
2019/881) by gathering evidence and practical insights from those affected by the current 
legislative framework. It aimed to collect views on the effectiveness of the existing rules 
and to identify potential areas for improvement, thereby contributing to the ongoing impact 
assessment. 

The consultation focused on three core areas identified as central to the future functioning 
and coherence of the EU cybersecurity framework: 

1.  Mandate  of  ENISA,  including  support  for  Member  States  and  expertise  in 

emerging technologies. 

2.  European  Cybersecurity  Certification  Framework  (ECCF),  focusing  on  its 
current  effectiveness  as  well  as  on  its  governance,  development  and  update 
processes. 

3.  Simplification of cybersecurity and incident reporting obligations, to address 
perceived  complexities  and  burdens  in  reporting  as  well  as  the  fragmentation 
current obligations. 

The public consultation was published on the European Commission’s ‘Have Your Say’ 
portal  and was open to  all interested parties  and stakeholders from  11 April to  20 June 
2025  (10  weeks).  The  stakeholder  views  were  collected  through  38  open  and  closed 
questions.  The  respondents  were  invited  to  provide  feedback  in  an  open  text  form  in 
English or any other EU official language. They were also able to upload position papers 
and supporting documents. A total of 193 responses were received, with partial responses 
accepted.  The  consultation  attracted  a  diverse  pool  of  respondents  from  various 
stakeholder groups, reflecting balanced input from both private and public sector actors, 
as well as individual citizens. 

Table 1: Respondents by stakeholder type (n = 193) 

Stakeholder type 
Company / business 
Business association 
EU Citizen 
Public authority 
Other 
Academic / research institution 
Non-governmental organisation 
Trade union 
Non-EU citizen 

Number of respondents 
79 
54 
26 
8 
8 
7 
6 
4 
1 

Percentage (%) 
40.9 % 
28.0 % 
13.5 % 
4.1 % 
4.1 % 
3.6 % 
3.1 % 
2.1 % 
0.5 % 

 
 
 
      
 
 
 
Among  company  and  business  respondents,  a  majority  represented  large  enterprises, 
though a substantial share of micro, small, and medium-sized enterprises also participated. 

Table 2: Company size distribution among business respondents (n = 79) 

Company size 
Large enterprises 
Medium-sized enterprises 
Small enterprises 
Micro enterprises 

Number of respondents 
50 
8 
9 
12 

Percentage (%) 
63.3 % 
10.1 % 
11.4% 
15.2% 

Responses were received from across 26 countries, including EU Member States and a few 
non-EU countries. The most represented countries were Belgium (30, 15.5%), France (27, 
14.0%), Germany (23, 11.9%), the United States (14, 7.3%), Spain (11, 5.7%), Italy (10, 
5.2%), Hungary (9, 4.7%), Austria (9, 4.7%), and the Netherlands (8, 4.1%). 

No contributions were received from national Parliaments or local and regional authorities 
through this public consultation activity. 

This report gives a concise, neutral factual summary of the responses received through the 
public consultation. Advanced computational tools were used to support the analysis of 
gathered  data,  including  text-mining  techniques.  Human  oversight  remained  central  to 
ensuring accuracy and interpreting nuanced results. 

In addition to the public consultation, other consultation activities were undertaken for this 
initiative: a call for evidence (184 written contributions received), targeted semi-structured 
interviews with ENISA representatives, national cybersecurity agencies, and certification 
experts; consultation of Member States' representatives within the Council working party 
and  in  bilateral  discussions;  targeted  consultation  of  ECCF  governance  groups  (ECCG 
meetings on 12 March and 3 July 2025, SCCG meeting on 17 March 2025); and findings 
from the 2024 evaluation study of ENISA and the ECCF (65 interviews, a survey with 209 
responses, and two workshops). A comprehensive synopsis report covering all consultation 
activities was published as an annex to the impact assessment report. 

2.  Summary of key issues raised 

2.1 ENISA’s mandate and operational role 

The  consultation  assessed  stakeholders’  views  on  the  relevance  of  the  eight  core  tasks 
currently assigned to ENISA. Respondents were asked to indicate the importance of each 
task on a five-point scale. 

As  shown  in  Figure  1,  the  task  most  frequently  rated  as  "Very  important"  was  market, 
cybersecurity  certification,  and  standardisation  (58.6%),  followed  by  development  and 
implementation of Union policy and law (47.2%), and operational cooperation at Union 
level (45.1%). Research and innovation were least often rated "Very important" (20.2%).  

2 

 
Figure 1 Stakeholder’s views in ENISA’s tasks rated by importance (results provided 
in %of respondents, excluding “Do not know” answers) 

Large  companies  consistently  supported  most  tasks,  with  60%  rating  certification  and 
policy implementation as "Very important", and 58% for operational cooperation. Public 
authorities  emphasised  ENISA’s  coordination  and  compliance  roles,  with  62.5%  rating 
policy implementation, operational cooperation, and certification as "Very important". EU 
citizens expressed high support for knowledge and information (53.9%) and certification 
(57.7%).  Small  and  micro  enterprises  placed  greatest  emphasis  on  certification  (66.7% 
"Very important"), but gave less importance to strategic, educational, or analytical roles. 

Regarding  ENISA’s  support  for  policy  implementation,  assisting  Member  States  and 
supporting the Commission were most frequently rated as "Very important" (both 45.6%), 
followed by industry guidance (43.5%). International cooperation received 27.5%. Public 
authorities were especially supportive: 75% rated assistance to Member States and support 
to  the Commission as "Very important". Small companies prioritised industry guidance 
(55.6% "Very important"). 

When  asked  about  integrating  additional  technical  tasks  into  ENISA’s  mandate,  28.5% 
supported expansion, 42.5% opposed, and 29% had no opinion. EU citizens were cautious, 
with half opposing expansion, while trade unions were strongly supportive. Open-ended 
responses suggested a range of potential technical tasks, including developing frameworks 
for  vendor  participation,  supporting  mutual  recognition  of  certifications,  enhancing 
incident  reporting  interoperability,  and  integrating  threat  intelligence.  For  building  a 
shared  EU  situational  awareness  picture,  77.2%  supported  ENISA’s  role,  with  strong 
endorsement  from  large  companies,  public  authorities,  and  business  associations,  while 
medium-sized  and  small  companies  were  more  cautious.  Most  respondents  supported 
ENISA’s  continued  development  of  the  European  Cybersecurity  Skills  Framework 
(ECSF), with 75.1% agreeing or strongly agreeing, and ENISA’s coordination of EU-wide 
awareness campaigns received broad support (78.8% agreeing or strongly agreeing). 

Overall,  37.8%  of  respondents  agreed  and  18.7%  strongly  agreed  that  ENISA’s 
partnerships with other bodies should be better defined in its founding legislation, while 
17.1% disagreed, 2.6% strongly disagreed, and 23.8% had no opinion. 

3 

 
 
2.2 European  Cybersecurity  Certification  Framework 

(ECCF)  and 

governance 

Certification  was  widely  seen  as  a  tool  to  enhance  product  and  service  security,  with 
41.45% of respondents strongly agreeing. Similarly, 47.67% strongly supported its role in 
regulatory compliance, and 41.45% emphasised its importance for market access through 
mutual  recognition.  Among  business  associations,  33.33%  strongly  agreed  on  security 
benefits and 40.74% on compliance. Large companies showed 36.0% strong agreement on 
security  and  62.0%  on  compliance.  Micro  businesses  were  the  most  supportive,  with 
66.67% strongly agreeing that certification improves security. 

Views on mandatory certification were more divided, with 36.3% supporting and 51.3% 
opposed. Tailored certification schemes received mixed responses, with 37.8% in favour 
and 40.9% opposed. Integration of privacy and data protection requirements was generally 
supported  (41.5%),  though  some  groups  remained  cautious.  Satisfaction  with  the  time 
required for scheme development was low, with only 11.4% agreeing and 40.9% strongly 
disagreeing. There was strong consensus on the need for regular updates to certification 
schemes (52.9% agreeing and 23.8% strongly agreeing). Transparency in the development 
and adoption process received overwhelming support (60.6% strongly agreeing and 24.4% 
agreeing). 

Figure 2 Stakeholder’s views on the role of ENISA regarding multiple areas of the 
ECCF (results provided in %of respondents, excluding “Do not know” answers) 

As shown in Figure 2, a majority supported ENISA having a leading or supporting role in 
preparing  and  developing  candidate  schemes  (52.3%  leading,  30.1%  supporting),  with 
large companies and public authorities most in favour. For presumption of conformity with 
EU legislation, 31.09% supported a leading role for ENISA, 40.41% preferred a supporting 
role, and 11.92% opposed any role. Open-ended responses highlighted broad support for 
ENISA’s role as a facilitator and knowledge hub, not a certifier or regulator, and stressed 
the importance of avoiding duplication with national authorities. 

4 

 
 
Confidence in the ECCG’s effectiveness was limited: nearly half of respondents had no 
opinion,  and  most  others  rated  its  effectiveness  as  low  or  very  low.  Stakeholder 
involvement  in  certification  scheme  development  was  widely  seen  as  insufficient, 
particularly among SMEs and civil society. There was broad consensus on the need for 
more organised and inclusive stakeholder engagement in ECCG and ECCF processes. A 
separate question about a single forum and governance mechanism found strong support. 

A large majority of respondents (82%) reported that ICT supply chain risk has increased 
(49%) or increased significantly (33%) over the past five years, with the most cited threats 
being  third-party  software  compromise,  malicious  updates,  and  exploitation  of  supplier 
access privileges. On whether non-technical risks (e.g. geopolitical dependencies, foreign 
ownership) require dedicated tools, views were divided: 48% agreed or strongly agreed, 
while  40%  disagreed  or  strongly  disagreed  —  with  public  authorities  most  supportive 
(88% agree/strongly agree) and business associations and SMEs most opposed (55% and 
64% respectively either disagree or strongly disagree). Respondents broadly rejected the 
notion  that  existing  measures  alone  suffice:  42%  disagreed  or  strongly  disagreed  that 
organisational policies adequately mitigate all supply chain risks, and 47% disagreed or 
strongly disagreed that purely technical measures are sufficient. The current ECCF was 
seen  as  moderately  effective  for  public  procurement  (46%  agree,  but  24% 
disagree/strongly disagree). Respondents called for stronger third-party risk governance, 
greater supply chain transparency, and alignment with international standards (ISO 27001, 
NIST CSF), while cautioning against duplicating existing regulatory obligations. 

2.3 Simplification of cybersecurity obligations 

NIS2  was  the  most  frequently  cited  applicable  EU  legislation,  with  many  respondents 
indicating  multiple  frameworks  (GDPR,  DORA,  CER,  AI  Act)  apply  to  their  entities. 
Cross-sectoral  associations  and  digital  service  providers  highlighted  the  growing 
complexity and called for a more integrated legislative approach. 

Figure 3 Stakeholder’s view on regulatory burden regarding EU legislation (results 
provided in % of respondents). 

5 

 
 
Stakeholders expressed strong concern about the diversity of incident reporting tools and 
processes at the national level, with medium-sized, small, and micro enterprises reporting 
the highest difficulty. The lack of harmonised reporting thresholds across EU legislations 
was  a  major  challenge,  especially  for  SMEs  and  business  associations.  Overlap  of 
requirements and the burden of proving compliance were significant issues, particularly 
for medium-sized, small, and micro enterprises, as well as trade unions. 

Open-ended  responses  emphasised  the  need  for  simplified  regulations,  standardised 
templates,  and  centralised  platforms.  Stakeholders  described  the  current  system  as 
fragmented and resource-intensive, with overlapping obligations diverting resources from 
operational cybersecurity efforts. There was strong support for cross-sector harmonisation, 
especially in banking, energy, transport, and public administration. Respondents supported 
a  unified  digital  reporting  platform  to  streamline  compliance  and  reduce  administrative 
overhead, and advocated for principle-based, risk-oriented frameworks. Tailored support 
for  SMEs  was  a  recurring  theme,  with  suggestions  for  tiered  obligations  and  clearer 
guidance. 

Medium-sized  companies  reported  the  highest  concern,  particularly  regarding  reporting 
thresholds,  tool  diversity,  and  compliance  burdens.  Small  and  micro  enterprises  also 
expressed significant concern and large companies, although comparatively less likely to 
select the highest negative rating, still included a sizeable share of respondents expressing 
concern.  Business  associations  advocated  strongly  for  harmonisation,  and  public 
authorities, EU citizens, and other stakeholders highlighted the need for coordination and 
sector-specific guidance. 

6