In brief
- It is a proposal, not a finished rulebook: The Commission's January 2026 proposal would revise the 2019 Cybersecurity Act. The legislative procedure is ongoing, so organisations should distinguish between current obligations and the direction of travel.
- The management signal is broader than certification: The proposal strengthens the European cybersecurity certification framework and puts additional emphasis on ICT supply-chain security. That makes supplier assurance, dependency visibility and evidence increasingly relevant governance topics even before every detail is final.
- Do not build a programme around a moving text: A proportionate response is to identify which supplier, certification and assurance decisions could become material, then connect those questions to existing NIS2, ISO 27001 and third-party-risk governance.
- What to do now: Keep the proposal on the regulatory watchlist, understand critical ICT dependencies and avoid creating duplicate control structures. Where possible, strengthen reusable governance: ownership, supplier segmentation, assurance evidence and management review.
It is a proposal, not a finished rulebook
The Commission's January 2026 proposal would revise the 2019 Cybersecurity Act. The legislative procedure is ongoing, so organisations should distinguish between current obligations and the direction of travel.
The management signal is broader than certification
The proposal strengthens the European cybersecurity certification framework and puts additional emphasis on ICT supply-chain security. That makes supplier assurance, dependency visibility and evidence increasingly relevant governance topics even before every detail is final.
Do not build a programme around a moving text
A proportionate response is to identify which supplier, certification and assurance decisions could become material, then connect those questions to existing NIS2, ISO 27001 and third-party-risk governance.
What to do now
Keep the proposal on the regulatory watchlist, understand critical ICT dependencies and avoid creating duplicate control structures. Where possible, strengthen reusable governance: ownership, supplier segmentation, assurance evidence and management review.
Follow the proposal in detail: CybersecurityAct2.com is Governancy’s dedicated practical resource for legislative status, ENISA, certification, ICT supply-chain risk and the evolving CSA2 proposal. Open CybersecurityAct2.com →
Practical next step: If this issue is live in your organisation, determine first whether the problem needs assessment, implementation or independent assurance. Discuss the scope with Governancy.