European Commission 20 January 2026, COMMISSION STAFF WORKING DOCUMENT EXECUTIVE SUMMARY OF THE IMPACT ASSESSMENT REPORT Accompanying the documents Proposal for a Regulation of the European Parliament and of the Council on the European Union Agency for Cybersecurity (ENISA), European cybersecurity certification framework, and ICT supply chain security and repealing Regulation (EU) 2019/881 (The Cybersecurity Act 2) And Proposal for a Directive of the European Parliament and of the Council amending Directive (EU) 2022/2555 as regards simplification measures and alignment with the [Proposal for the Cybersecurity Act 2]

Also known as

This Commission Staff Working Document evaluates proposed reforms to the EU cybersecurity framework, specifically recommending the repeal and replacement of the Cybersecurity Act (Regulation (EU) 2019/881) to overhaul the mandate of the European Union Agency for Cybersecurity (ENISA) and the European Cybersecurity Certification Framework (ECCF). The preferred policy package introduces targeted amendments to the NIS2 Directive (Directive (EU) 2022/2555) to simplify regulatory compliance and establishes a new horizontal framework to address non-technical cybersecurity risks in ICT supply chains. These measures aim to harmonize cybersecurity governance, reduce administrative burdens for businesses by an estimated EUR 14.6 billion, and ensure technological sovereignty across the Single Market.AI