II. The consolidation of the EU cybersecurity strategy

Even though cybersecurity was included by the European Commission among the Union’s priorities as early as 2001,Footnote ⁶ it does not appear as a specific policy area in primary law, nor an explicit legal basis for regulating this sector exists.Footnote ⁷ Over the last decade, however, it has gained new momentum, with the EU institutions adopting legislation on the basis of market interests within the meaning of Article 114 TFEU.Footnote ⁸

In 2013, the Barroso II Commission presented the first EU Cybersecurity Strategy: An Open and Secure Cyberspace,Footnote ⁹ aimed to ensure a cyberspace which is accessible to all and, at the same time, equipped with the appropriate tools to guarantee the confidentiality of the data and information contained therein. Since the adoption of this strategy, the Commission led by Juncker proceeded to adopt two key legal instruments.

The first was the Directive on the Security of Network and Information Systems (NIS Directive),Footnote ¹⁰ which is widely recognised as the first piece of EU legislation on cybersecurity. On the premise that network and information systems play an essential role in facilitating the cross-border movement of goods, services and people,Footnote ¹¹ it has introduced specific rules on the exchange of information and the obligation of minimum security requirements for major economic operators providing digital services. The second instrument is Regulation 2019/881 (the so-called Cybersecurity Act),Footnote ¹² which strengthened the role of ENISA established in 2003,Footnote ¹³ and defined a framework for the introduction of a EU certification system for the cybersecurity of products, services and processes.

In 2020 the Commission adopted the new Communication Shaping Europe’s digital future Footnote ¹⁴ and, shortly afterwards, the new Security Union Strategy for the period 2020–2025,Footnote ¹⁵ setting out further tools and measures to be developed to ensure the security of both the physical and digital environment. The elements of attention range here from the fight against terrorism to organized crime, passing through the prevention and detection of hybrid threats and the increase in the resilience of critical infrastructures, up to the strengthening of cybersecurity and the promotion of research and innovation.

Following this Communication and the European Council Conclusions,Footnote ¹⁶ in December 2020 the European Commission and the High Representative for Foreign Affairs presented the new EU Cybersecurity Strategy for the Digital Decade,Footnote ¹⁷ as a trigger for the adoption of new regulatory, policy and investment tools to ensure that everyone can “lead a secure digital life” and to create “a resilient Europe, green and digital” thanks to secure and reliable connectivity tools.

As set out in The Strategic Compass for Security and Defence approved by the Council in March 2022,Footnote ¹⁸ the conflict between Russia and Ukraine has then reinforced the need to revise the supranational defence strategy in cyber domain. Thus, following the Council’s recommendation on the development of the Union’s position on cyber deterrence, in November of the same year the High Representative and the Commission jointly presented the Communication on The EU’s Cyber Defence Policy.Footnote ¹⁹ This Communication entails to strengthen the tools for defence cooperation and collaboration between States, to enhance collective situational awareness and early detection capacity and, before that, to act decisively in order to provide the EU with adequate cyber skills capable of developing and managing digital technologies.

In light of these objectives and strategic developments, the new cybersecurity plan has provided for a strengthening of existing tools and the adoption of new ones. In February 2020, the EU institutions worked towards the adoption of Directive 2022/2555 (also known as NIS 2)Footnote ²⁰ and of a new Directive on the resilience of critical entities.Footnote ²¹ In addition, a targeted revision of the Cybersecurity Act was promoted to strengthen the role of ENISA and the mandatory certification system on IT products.Footnote ²² The European Commission then put forward two proposals for Regulations: the Cyber Resilience Act, introducing essential security requirements for devices interconnected via the Internet to send and receive data,Footnote ²³ and the Cyber Solidarity Act, establishing an ad hoc mechanism for preventing, preparing for and responding to large-scale cyber threats.Footnote ²⁴ It is the latter that, being entered into force on 4 February 2025, will be the focus of the following sections.

III. The Cyber Solidarity Act: legal basis and mechanisms

Regulation 2025/38 of the European Parliament and of the Council establishes measures to improve the detection of cybersecurity threats and incidents, as well as common preparedness and response to large-scale events. The actions will be supported by funding from the Digital Europe Programme (DEP) of the 2021–2027 Multiannual Financial Framework.Footnote ²⁵ In comparison to other acts in the cybersecurity domain, the Cyber Solidarity Act is not based on Article 114 TFEU, but has a dual legal basis, namely Article 173(3) and Article 322(1)(a) TFEU. The latter provision, concerning the adoption of measures with financial implications, is essential to allow the instruments illustrated below to benefit from a certain degree of flexibility in relation to budget management. This is necessary given the unpredictable, exceptional and specific nature of the cyber threat landscape. The other – and most significant – provision concerns the EU’s competence in the field of industrial policy. It stipulates that the Union and the Member States must ensure the conditions necessary for the competitiveness of Union industry and the optimal exploitation of industrial potential for innovation, research and technological development.Footnote ²⁶

The choice of this legal basis does not come as a surprise. Indeed, the explanatory memorandum accompanying the proposal makes it clear that the Regulation is also part of the new Industrial Strategy for Europe.Footnote ²⁷ It is aimed to facilitate the EU industry’s ascendance as a global actor in digital technologies, thereby reinforcing the Union’s competitive edge in the digital market. This could be achieved by also bolstering the resilience of critical infrastructures that are increasingly vulnerable to cyber threats and incidents due to their reliance on information and communication technologies. It is therefore imperative to implement a structured cybersecurity intervention to increase the resilience of citizens, businesses and entities operating in critical sectors against the growing cybersecurity threats in a context of technological improvement.

To achieve these objectives, the Regulation introduces two tools: a Cybersecurity Alert System and a Cybersecurity Emergency Mechanism.

The Cybersecurity Alert System is a supranational infrastructure that will detect, analyse and process data on cyber threats and incidents in the EU. It will do this through the coordination of national and cross-border cyber hubs.Footnote ²⁸

The national cyber hubs, which are public entities, serve as a reference point and gateway for other public and private organisations at the national level, to collect and analyse information on cybersecurity threats and incidents, and contribute to a cross-border hub.Footnote ²⁹ Following a call for expressions of interest, the European Cybersecurity Competence Centre (ECCC) will select a national hub for participating in a joint procurement of tools and infrastructures and receiving a grant for their interventions.Footnote ³⁰ It should be noted that, as explicitly stated in recital 33 of the Regulation, it is without prejudice to the compliance by Member States with the obligations under Directive (EU) 2022/2555 that require them to designate or establish one or more cyber crisis management authorities and to ensure that they have adequate resources to carry out their tasks in an effective and efficient manner.

Cross-border cyber hubs shall be constituted as consortia of at least three Member States, each represented by a national hub. These hubs are expected to commit to working together in order to coordinate their cyber threat detection and monitoring activities.Footnote ³¹ This implies for the national hubs participating in a cross-border hub to share relevant information related to cyber threats with each other. To this end, it is beneficial to define the details, including the commitment to exchange a significant amount of data and the conditions thereof, in a consortium agreement specifying the principles for sharing information.Footnote ³² It should be noted that the cross-border hub platforms represent an additional instrument to the Computer Security Incident Response Team (CSIRT) network which is provided for by NIS 2 Directive for pooling and sharing data on cybersecurity threats from public and private entities.Footnote ³³ Indeed, when cross-border hubs obtain information relating to a large-scale, potential or ongoing cybersecurity incident, they shall endeavour to provide the relevant information to the European cyber crisis liaison organisation network (“EU-CyCLONe”),Footnote ³⁴ the CSIRT network and the Commission, in view of their respective crisis management roles in accordance with the NIS 2 Directive.Footnote ³⁵ However, this complementary action also requires that the Cybersecurity Alert System avoids duplication and overlapping, in favour of consistency with the other existing instruments of cyber monitoring.

The Cybersecurity Emergency Mechanism provides for a number of interventions to support preparedness, response to, and immediate recovery from significant, large-scale or large-scale-equivalent cybersecurity incidents through mutual assistance actions.Footnote ³⁶

The Mechanism’s preparedness actions include the coordinated testing of entities operating in sectors deemed to be of critical importance. The Commission, in consultation with ENISA and the NIS Cooperation Group, shall periodically identify pertinent sectors or subsectors from those enumerated in Annex I of NIS 2 Directive, specifically finance, energy, and healthcare. The entities belonging to these sectors are also eligible to receive financial support for coordinated testing exercises at the Union level. Furthermore, the Mechanism may provide practical support for the monitoring of vulnerabilities and risks, as well as the organisation of exercises and training programmes for entities operating in sectors that are not of high criticality.Footnote ³⁷

In order to facilitate a coordinated response to significant incidents, the Regulation introduces a mechanism of intervention comprising a financial and an operational instrument. The financial support, introduced by the legislator’s revision, is intended to provide financial assistance to the Member State offering technical assistance to another Member State affected by a cybersecurity incident.Footnote ³⁸ The operational or in-kind instrument is based on a EU Cybersecurity Reserve,Footnote ³⁹ which comprises pre-committed incident response services provided by private entities designated as “trusted providers” in accordance with the procurement procedures set forth in Article 17. The aforementioned services may be activated by specific categories of “users” including Member States’ cyber crisis management authorities, CSIRTs, and Union institutions, bodies, and agencies through the Computer Emergency Response Team (CERT-EU), as established by Regulation 2023/2841.Footnote ⁴⁰ Third countries may also be designated as “users” and thus request support in cases where such provisions are outlined in the association agreements concluded in relation to their participation in the Digital Europe Programme.Footnote ⁴¹

Following an incident notification, as also referred to in the Directive 2022/2555, and upon request of the national authorities, the European Commission is tasked with evaluating it and determining whether intervention is necessary.Footnote ⁴² The Commission may, at its discretion, delegate the full or partial management of the operation and administration of the reserve to ENISA.Footnote ⁴³ For obtaining operational support, users are required to implement measures designed to mitigate the effects of the incident in question. This includes the provision of direct technical assistance and other resources intended to facilitate incident response and immediate recovery efforts. It is important to note that, following the amendments adopted by the legislator, support from the reserve may also extend to the recovery phase, but is limited to the initial stage of restoring the basic functionalities of the systems.Footnote ⁴⁴

In order to complete the picture, it is also pertinent to mention the establishment of the Cybersecurity Incident Review Mechanism, designed to assess significant cyberattacks with large-scale impacts, identify key lessons, and, if necessary, issue recommendations to enhance the EU’s resilience.Footnote ⁴⁵ In response to a request from the Commission or EU-CyCLONe, ENISA is obliged to submit a report that includes lessons learned and recommendations aimed at enhancing the Union’s cyber response. In the event that an incident has an impact on a DEP-associated third country, ENISA shall also share the report with the Council and the High Representative for Foreign Affairs.

IV. Lines of solidarity in Union’s response to cyber emergencies

The Cyber Solidarity Act establishes mechanisms to enhance collective preparedness and response to large-scale cybersecurity incidents, reflecting the EU’s comprehensive solidarity framework, which is currently being developed for activation in emergency situations.Footnote ⁴⁶ This section is, therefore, devoted to examine the extent to which, and the forms in which, solidarity is effectively integrated into the provisions of Regulation 2025/38.

As of the Cybersecurity Alert System, the establishment of a pan-European infrastructure based on Cyber Hubs, subsidised by the Union through the Digital Europe Programme, has two principal objectives which meet solidarity arguments in the preparedness phase. Firstly, it is intended to enhance the capacity of public authorities to be prepared to potential cyber threats in a timely and effective manner. Secondly, it is designed to strengthen the information exchange system regarding cyber threats, vulnerabilities, attack detection procedures, and cybersecurity alerts among public authorities. Such enhanced coordination and collaboration in the detection, analysis, and processing of data pertaining to cyber threats and incidents across the EU are intended to achieve a unified and concrete goal: safeguarding the cybersecurity interests of the Union and of its Member States. Consequently, this instrument, supported by the principle of loyal cooperation between authorised entities, has the potential to result in de facto solidarity, thereby facilitating the pursuit of a common and even supranational interest.Footnote ⁴⁷

The Cybersecurity Emergency Mechanism is the instrument that is explicitly and precisely designed to facilitate solidarity interventions in emergency contexts. In view of the heightened risks and the growing number of cyber incidents affecting Member States, this mechanism has been established “to support the improvement of the Union’s resilience to cyber threats and the preparation for and mitigation of, in a spirit of solidarity, the short-term impact of significant cybersecurity incidents, large-scale cybersecurity incidents and large-scale-equivalent cybersecurity incidents” [emphasis added].Footnote ⁴⁸

Such a spirit of solidarity is reflected, on the one hand, in the traditional financial support for technical assistance from one Member State to another Member State, as outlined in Article 18 of the Regulation 2025/38, and, in the other one, in the activation of a reserve composed of pre-committed resources. Indeed, the adoption of direct financial support measures is the most traditional way of ensuring an immediate and tangible manifestation of solidarity, by giving the national authorities full responsibility and autonomy in the management of financial resources. Instead, the pre-commitment of resources serves to complement the existing assets of Member States, thereby ensuring greater accessibility and faster deployment of intervention teams. Furthermore, it prevents the duplication of efforts within the Union and its Member States, by requiring a high degree of coordination between the subjects involved. Consequently, solidarity is manifested in the in-kind nature and temporal (that is pre-committed) nature of the Cybersecurity Reserve, thereby enabling a rapid, efficient, and effective response to offensive actions through joint technical and operational interventions conducted within the emergency mechanism.

In practice, if the Cyber Solidarity Act had already existed, it could have helped react to the SolarWinds attack in 2020, which affected multiple EU-based entities by highlighting the need for a more unified and rapid response.Footnote ⁴⁹ In that event, the Cybersecurity Emergency Mechanism could have been activated to swiftly deploy resources, thereby enhancing both the speed and coordination of the EU’s response. The establishment of a shared reserve of resources, along with the mobilisation of certified private-sector providers, would have served to mitigate the impact on critical infrastructure, whilst ensuring a more coherent approach across Member States. The SolarWinds incident thus underscores the importance of the solidarity-based interventions envisaged by Regulation 2025/38, which are designed to protect both Member States and the Union as a whole from large-scale cyber incidents.

Besides these considerations, the operational relevance of solidarity is further emphasised in Article 20 of Regulation 2025/38, which mentions the potential supplementary contribution of the Cybersecurity Emergency Mechanism to other existing assistance instruments.

In the first place, it could serve to reinforce the Union Civil Protection Mechanism (UCPM)Footnote ⁵⁰ in the event of a significant cybersecurity incident resulting from or occurring during a natural or man-made disaster on the territory of a State. In the abstract, while the UCPM can intervene to coordinate rescue and humanitarian assistance in the event of an emergency, the Cybersecurity Emergency Mechanism could integrate it by mitigating and resolving the (potential) resulting cyber impacts. In this respect, it has to be said that the Cybersecurity Reserve could currently work even better than the model proposed by the UCPM. Indeed, the EU’s rapid response capabilities established under the UCPM consist of pre-committed reserves that are rented, leased or owned by Member States; any activation must therefore be confirmed by them.Footnote ⁵¹ Instead, the cyber mechanism relies on trusted private sector service providers, certified according to the EU certification scheme, pre-procured through a supranational process and mobilised by the Commission (or ENISA). The fact that these supranational bodies are responsible for deciding on the procurement and deployment of the reserve makes the Union independent of the discretion of national authorities during the activation phase. It could also be argued that, by virtue of their independence from the national authorities and their direct link with the Commission, the Cybersecurity Reserve can ensure greater solidarity on the part of the Union in the event of major or widespread incidents.

Secondly, Regulation 2025/38 suggests that the activation of the emergency mechanism may serve to complement those instruments which implement primary law provisions setting obligations of solidarity typically upon Member States, namely the mutual defence clause (Article 42(7) TEU)Footnote ⁵² and the solidarity clause (Article 222 TFEU).Footnote ⁵³

The mutual defence clause essentially requires Member States to provide aid and assistance by all available means in the event of armed aggression. In such an eventuality, the activation of the Cybersecurity Emergency Mechanism would enable the Union to extend support to the Member State that has been the victim of an attack, thereby complementing the efforts of the other Member States under Article 42(7) TEU. Clearly, this intervention requires that the cyber attack is qualified as an armed aggression under international law.Footnote ⁵⁴

Concurrently, the solidarity clause imposes an explicit and general obligation upon the Union and its Member States to act jointly for assisting a Member State victim of a terrorist attack or of a natural or man-made disaster. It explicitly requires the Union to deploy all available instruments with the objective of providing support to affected Member State(s) and fostering positive synergies among them when a terrorist attack or a natural or man-made disaster occurs. Consequently, despite the solidarity clause is conceived as a last-resort instrument,Footnote ⁵⁵ in the event of its invocation the Cybersecurity Emergency Mechanism should be mandatorily activated, thereby obliging the Commission to activate the requisite assets, in particular the reserve, for which it bears responsibility.

Ultimately, in light of the potential for responding to both intentional and unintentional cyberattacks, the mechanisms established by the Cyber Solidarity Act have the capacity to serve as a valuable complement to the interventions of preparedness and assistance provided by Member States and also as a means of independent Union intervention in favour of them. Consequently, the Union is not merely a nexus of “solidary integration” between Member States; it also assumes an active role in cybersecurity, thereby establishing the EU level as a unified and distinctive sphere of solidarity.

V. Balancing solidarity and national security in the cyber domain

The “national identity clause” set out in Article 4(2) TEUFootnote ⁵⁶ establishes that in case of a threat to national security resulting from an emergency or external attack, national authorities have the full responsibility for reacting and protecting those concerned. Consequently, as the affected States are permitted a considerable degree of discretion during the response phase, the implementation of measures at the supranational level is contingent upon the approval and full involvement of national authorities. This rationale, inherent to the State as a sovereign entity, also extends to the cyber domain. Indeed, the possibility of cyber threats causing disruption to essential functions and services is considerable and may result in significant inefficiencies within a State’s territory and potentially affect the protection of individuals’ fundamental rights.

In light of the aforementioned considerations, the 2024 Council Conclusions on the Future of Cybersecurity: Implement and Protect Together emphasised that Member States keep the primary responsibility for responding to large-scale cyber incidents, which have the potential to threaten national security.Footnote ⁵⁷ Moreover, in instances where these incidents may have an international dimension and may necessitate action at the supranational level, such action must be coordinated with national interventions. The aforementioned perspective is also evident in the Cyber Solidarity Act, which aims to enhance collective preparedness and response measures against cyber incidents and attacks. The present section is therefore devoted to exploring how the prerogatives of Member States in responding to cyber events are envisaged in the Regulation in question, and whether these prerogatives may in some way compromise the solidarity measures previously illustrated.

From a theoretical standpoint, the necessity to respect Member States’ prerogatives in the security domain arises from the choice of Article 173(3) TFEU as the legal basis. This provision, in fact, pertains to a supporting and coordinating competence, which – under Article 2(5) TFEU – precludes the enactment of harmonisation measures and enables the Union to act without superseding the competences of Member States. As explicitly stated in Article 1(4) of the Cyber Solidarity Act, “the actions under this Regulation shall be conducted with due respect to the Member States’ competences.” Moreover, the Regulation underscores the significance of upholding the “essential functions” of the Member States, which encompasses the safeguarding of territorial integrity, the maintenance of law and order, and the protection of national security. In particular, it reaffirms that national security remains the sole responsibility of each Member State.Footnote ⁵⁸

To recall this constraint, Regulation 2025/38 includes three specific “non-affectation clauses” that have been designed and then reinforced by the legislator to emphasise the necessity of respecting the States’ prerogatives in matters of national cybersecurity.

In the first place, the Regulation underlines the voluntary nature of Member States’ involvement in the Cybersecurity Alert System, as well as the supplementary function of the Cybersecurity Emergency Mechanism in relation to States’ endeavours to prepare for, respond to and recover from cybersecurity incidents.Footnote ⁵⁹ It implies that the Union’s intervention shall necessarily be subordinated to the affected States’ willingness. Secondly, following the political agreement reached between the Council and the European Parliament, it is imagined that Member States may assume a role in the establishment of the reserve by interacting with the Commission on the formulation of criteria for tender calls and the procurement procedure for the reserve.Footnote ⁶⁰ Thirdly, there is an emphasis on the limits for the dissemination and disclosure of information: under Article 1(6) of the Regulation, the exchange of confidential information must be limited to what is relevant and proportionate to the final purpose, without affecting the essential national security, public security, or defence interests of Member States. This formulation appears perfectly consistent with Article 346(1)(a) TFEU, otherwise known as the “national defence privilege clause,” according to which no Member State shall be obliged to supply information the disclosure of which it considers contrary to the essential interests of its security.Footnote ⁶¹

In light of this reconstruction, although the Commission is responsible for activating the Cybersecurity Reserve, the instruments established by the Cyber Solidarity Act cannot be designed to replace or radically transform the national cybersecurity systems. The concept of supranational solidarity is thus mitigated by national security arguments. Indeed, the efficacy of the solidarity mechanisms is dependant upon the discretion and willingness of the affected Member States to engage and share information in the event of a cyber emergency. As is often the case in the EU landscape, the solidarity measures that the Union can activate in emergency situations are still bound by the sovereignty of the Member States.

At this juncture, it is clearly premature to speculate on the full scope of the Cyber Solidarity Act; however, it is evident that the current structure may encounter issues and frictions with the prerogatives of Member States, thus curtailing the positive effects of the act. Nevertheless, it should be noted that the “national identity clause” cannot derogate the general obligation of Member States to exercise their prerogatives in compliance with EU law. This obligation is derived from the principles that govern the relationship between the Union and the Member States, as set forth in Article 4 TEU, including that of sincere cooperation.Footnote ⁶² With respect to the topic at hand, this principle is relevant insofar as it establishes the duty on the Member States to assist EU institutions and facilitate their actions in carrying out EU tasks, as well as the obligation to refrain from implementing measures that could potentially compromise the attainment of EU objectives. Hence, the principle of loyal cooperation serves to strike a balance between the respect for the authority of Member States in the management of national (cyber) security and the broader imperative of upholding EU law and pursuing actions that align with the common interest and solidarity objectives.Footnote ⁶³ Ultimately, it is essential the development of a pluralistic approach that brings the supranational constitutional framework into dialogue with that of the Member States.Footnote ⁶⁴

By characterising cybersecurity as a matter of general interest at the EU level, the principle of loyalty in conjunction with that of solidarity may prompt Member States to align their national security measures with the EU’s solidarity goals. This would ensure that the efforts to protect national interests do not impinge upon collective security objectives. Such alignment could encourage both the Member States and the Union to develop more effective cyber crisis management instruments and foster a more unified response to cyber threats, thereby reinforcing the solidarity between Member States and the EU.

VI. Conclusive remarks

In light of the most recent statistics on cyber attacks, which indicate that ransomware, fileless attacks, and phishing remain the primary threats, it is evident that cybersecurity preparedness and a shared response capacity are of paramount importance in order to reduce the risks of network or data compromises. In recent years, the EU has implemented measures to enhance the protection of critical infrastructures and the resilience of the entities operating in this domain, with the objective of avoiding or mitigating the impact of disruptions to essential services.

The current EU cybersecurity strategy can be anchored to the concept of “EU digital (or technological) sovereignty,” mentioned for the first time by the President of the European Commission in the State of the Union Address in 2020.Footnote ⁶⁵ Such reading of supranational sovereignty enshrines, inter alia, the attempt to extend the parameters of the EU constitutional design to cyberspace,Footnote ⁶⁶ justifying the attribution to the supranational level of powers and instruments to encourage the implementation of regulatory interventions in several sectors to defend the constitutional structure of the Union as a whole from exogenous influences. And, in effect, the EU cybersecurity strategy underpins the need to affirm and protect the value system under Article 2 TEU at the basis of the EU identity in the cyber domain,Footnote ⁶⁷ by highlighting the intertwining of cybersecurity and the security of democratic systems, fundamental rights and the rule of law.Footnote ⁶⁸ The overarching approach of the EU is therefore projected to address current and future online and offline risks, and by equipping itself with robust tools and resources according to the EU Security Union Strategy. It is of the utmost importance for the Union to maintain its competitive advantage and protect its digital infrastructure from evolving threats.

In this context, the Cyber Solidarity Act represents the most recent regulatory milestone in the development of the comprehensive cybersecurity strategy. It serves to complement the existing legal instruments designed to enhance resilience against cyber threats, thereby ensuring that citizens and businesses can rely on the integrity and reliability of digital technologies. In this regard, the analysis presented in this article leads to two key conclusive considerations, that will need to be verified on the basis of future practice.

Firstly, Regulation 20025/38 provides a comprehensive framework that may support national authorities and enhance solidarity across Member States. This is achieved by establishing a supranational system of preparedness and assistance, which is designed to address particularly serious situations. The principle of solidarity, coupled with that of loyal cooperation envisaged in the EU legal framework, underpins the entire cycle of managing a cyber emergency by requiring Member States to cooperate with each other in a spirit of loyalty and the Union to activate the Cybersecurity Emergency Mechanism when necessary. Hence, the solidarity protection network established by the Cyber Solidarity Act has the potential to expand the articulated regulatory ecosystem of cybersecurity measures by providing support for the actions of Member States. Furthermore, when viewed in a broader context, this Regulation is embedded within the already extensive regulatory framework for emergency management, which encompasses a multitude of situations resulting from natural or man-made disasters. So, while Member States’ national security prerogatives remain solid, the urgency of a collective response to cyber threats is beginning to challenge the traditional boundaries of this exclusive competence. Indeed, in the event of a particularly significant cyber emergency, both national authorities and the Union bear responsibility for responding and protecting against cyber threats.

Secondly, it is important to note that the support outlined in Regulation 2025/38 is not exclusive to Member States or third countries. It also extends to EU institutions and bodies, enabling them to request assistance from the Cybersecurity Emergency Mechanism in the event of a significant cyber incident that could potentially impact EU infrastructure, institutions and, more broadly, the supranational democratic system. The reserve thus may be activated in the event of a hybrid threat targeting the electoral process of the European Parliament or seeking to gain access to EU confidential and classified documents, as well as sensitive non-classified information. In such instances, the Regulation permits a single EU institution, body, office, or agency to request action from the Commission or ENISA, thereby ensuring a prompt response to safeguard the Union’s interests. The extension of the Regulation’s scope to include EU institutions is a distinctive feature of the regulatory landscape for emergency responses, with notable implications for the EU constitutional dimension. This approach reflects the evolving nature of the threats faced by the Union, highlighting the importance of having its own cybersecurity measures in place alongside those of the Member States.

In light of the potential for cyber attacks to compromise the fundamental infrastructures and democratic systems that underpin the EU’s identity, it must rely on instruments, like the reserve of the Cyber Emergency Mechanism, that are able to protect its values and constitutional framework. Furthermore, it is important to emphasise that the Cyber Solidarity Act outlines an EU sovereignty that operates parallel to, rather than replacing, Member States’ sovereignty. Ultimately, it can be stated that the Regulation may contribute to the progressive realisation of the EU’s technological sovereignty in the field of cybersecurity, based on the fundamental value of solidarity. Nevertheless, it will be crucial to monitor the intertwining of the EU and Member States’ prerogatives in the protection of (supra)national security and sovereignty in the context of forthcoming legal developments in the cyber domain.