The EU Cybersecurity Act 2.0 threatens stability and competitiveness
The European Union, in recent years, has shown a growing commitment to cybersecurity, especially after a series of high-profile breaches. However, the draft revision of the Cybersecurity Act (CSA 2.0) risks turning good intentions into harmful policies, with potentially catastrophic consequences for the European economy and digital security.
The criticalities of the Cybersecurity Act 2.0
The original Cybersecurity Act, which came into force in 2019, laid the foundations for a structured approach to cybersecurity. The CSA 2.0, instead of being a measured evolution, introduces a dangerous mechanism: the European Commission could label some countries as "high-risk," with consequent automatic restrictions for suppliers from those countries. This geopolitical approach, rather than being based on objective technical criteria, could cause enormous economic damage and market distortions.
Economic and operational impacts
The Irish Business and Employers Confederation (IBEC) has warned that the proposed changes could threaten the stability of 18 critical sectors in Ireland, with estimated costs of around 730 million euros for the Irish telecommunications sector. Furthermore, the new rules would also severely affect companies outside the direct scope of the CSA 2.0, through stricter requirements for supply chains, procurement rules, and investor caution.
The uncertainty of the "high-risk" mechanism
The fundamental problem with the CSA 2.0 is the lack of clear criteria for determining which countries will be considered "high-risk." Currently, the definition seems to be based more on geopolitical factors than on verifiable technical vulnerabilities. A supplier could be excluded from the European market not because of weaknesses in the security of its code or in the management of updates, but simply because of the legal headquarters of its company.
Risk of technological fragmentation
If the main objective of the CSA 2.0 is countries like China, Russia, North Korea, and Iran, the proposed mechanism is not limited to these states. In an evolving geopolitical context, even the United States could be considered "high-risk." This scenario, if realized, would have devastating consequences for Europe's critical infrastructure, cloud services, cybersecurity tools, and business software, many of which come from suppliers based in the United States.
Exorbitant costs and market distortions
Imposing strict restrictions on Chinese suppliers in 18 sectors could cost the EU around 368 billion euros in five years, considering both direct and indirect effects. Extending this logic to other technology-supplying countries would further amplify the economic impact. Furthermore, the CSA 2.0 approach reverses established security practices, replacing objective technical assessments with decisions based on political considerations.
Threats to SMEs
Small and medium-sized enterprises (SMEs) would be among the hardest hit by the CSA 2.0. Unlike large multinationals, SMEs often operate with tight margins and limited resources. If a key component is suddenly reclassified as coming from a "high-risk" supplier, these companies would face impossible choices: undertake costly re-adaptations or lose important customers.
The need for an approach based on objective criteria
Cybersecurity requires an approach based on concrete evidence: technical vulnerabilities, realistic attack vectors, independent audits, and certifications. The CSA 2.0 should be anchored to objective and verifiable criteria, such as technical risk assessments, secure development practices, vulnerability management, transparency, and independent certification. The nationality of a company's executives is not a security check.
Rebalancing the legislation
There is still time to correct the CSA 2.0 and steer it toward a more balanced and technically-based approach. The crucial question is whether there is the political will to do so. Without significant change, the CSA 2.0 could turn a well-intentioned initiative into a law harmful to the European economy and digital security.
The impact of the CSA 2.0 on the European technological market
The EU's Cybersecurity Act 2.0 is not just a matter of cybersecurity, but represents a geopolitical turning point that could redefine the European technological market. The implications for European companies and consumers are profound and require in-depth analysis.
Europe's dependence on foreign technology
Europe is highly dependent on technologies from third countries, particularly from the United States and China. According to data from Digital Business Ireland, over 60% of Europe's critical infrastructure, cloud services, and cybersecurity tools depend on foreign suppliers. A "high-risk" designation could force European companies to undergo forced migrations, with estimated costs in the hundreds of billions of euros.
The consequences for consumers
European consumers could face service interruptions, price increases, and reductions in service quality due to forced migrations. For example, cloud services could experience downtime during the transition from a "high-risk" supplier to a "safe" one. Furthermore, consumers could lose access to innovative technologies developed by non-European companies.
Alternatives to the "high-risk" mechanism
Instead of a nationality-based approach, the EU could adopt an independent and transparent certification system. Existing models such as the ENISA certification scheme could be extended to assess suppliers based on objective technical criteria. This approach would allow safe suppliers to maintain market access, regardless of their legal headquarters.
The role of SMEs in the technological landscape
SMEs represent 99% of European technology companies and are crucial for innovation. According to a study by BH Consulting, 70% of technology SMEs in Ireland depend on components from non-European suppliers. A sudden change in regulations could put their survival at risk, with repercussions on employment and GDP.
The challenges for large multinationals
Even large European multinationals face significant challenges. Companies like Siemens and Airbus use components from foreign suppliers in their supply chains. Replacing these components could involve additional costs and project delays, putting Europe's global competitiveness at risk.
The importance of a collaborative approach
Cybersecurity is a global challenge that requires international collaboration. The EU should work with bodies such as the NIST in the United States and the ISO to develop common standards. This approach would allow addressing cybersecurity threats without creating artificial trade barriers.
The future prospects of the CSA 2.0
The fate of the CSA 2.0 will depend on the political will to rebalance the legislative text. It is essential that the European Parliament and the Council of the EU listen to the concerns of companies and cybersecurity experts. A more balanced approach could prevent economic damage and ensure the security of Europe's critical infrastructures.
The Cybersecurity Act 2.0 represents a crucial turning point for Europe. If implemented correctly, it could strengthen cybersecurity without compromising economic growth. However, the current "high-risk" mechanism raises significant concerns. It is fundamental that the EU adopts an approach based on objective technical criteria, ensuring at the same time the stability of the technological market.
Editorial Note and Disclaimer
The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.
GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not perform real-time information activities.
The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the improper use of the information published.
In the Crypto sector, every investment involves risks: the reader is invited to always inform themselves autonomously before making any decision.