Cyber Solidarity Act

No changes recorded yet — we are watching, and nothing has been published.

1. 2027-02-05 in 88 days Commission's first evaluation of the Regulation is due, then at least every four years (Article 25(1))
2. 2025-02-04 The Cyber Solidarity Act enters into force
3. 2025-01-15 The Cyber Solidarity Act is published in the Official Journal

1. 2025-11-06
   Regulation (EU) 2025/38 (as corrected November 2025) ErrataCurrent text

   Corrigendum to Article 22(3)(b), which amends Article 12(6) of the Digital Europe Programme Regulation on when entities in associated countries, or EU entities controlled from third countries, may take part in actions. source

2. 2025-01-24
   Regulation (EU) 2025/38 (as corrected January 2025) Errata

   Corrigendum to the reference to the statement published with the act in the Annex. source

3. 2024-12-19
   Regulation (EU) 2025/38 Major version

   The Cyber Solidarity Act, published in the Official Journal on 15 January 2025; it also amends the Digital Europe Programme Regulation (EU) 2021/694. source

   More

   • It entered into force on 4 February 2025.

The Act builds EU-level detection and response capacity; private companies are touched mainly as providers to the EU Cybersecurity Reserve.

Alert System

A pan-European network of national and cross-border cyber hubs, the European Cybersecurity Alert System, for detection and situational awareness (Articles 1(1)(a) and 3-5). source

Emergency Mechanism

A Cybersecurity Emergency Mechanism supporting preparedness, response and recovery for significant and large-scale incidents (Article 10). source

Reserve users

Member States' cyber crisis management authorities and CSIRTs, CERT-EU, and authorities of DEP-associated third countries can request EU Cybersecurity Reserve services (Articles 14(3) and 15(1)). source

Preparedness testing

Voluntary coordinated preparedness testing, such as penetration testing, of entities in sectors of high criticality, funded mainly by grants to Member States (Article 12). source

Incident review

At the request of the Commission or EU-CyCLONe, ENISA reviews significant or large-scale incidents and reports on lessons learned (Article 21). source

There is no compliance assessment for companies; providers joining the Reserve must meet the procurement criteria of Article 17.

Trusted providers

Reserve providers must show professional integrity and competence, protect classified information, have transparent governance, and have security clearance where a Member State requires it (Article 17(2)). source

Future certification

Once a European certification scheme for managed security services exists, Reserve providers must be certified under it within 2 years of the scheme applying (Article 17(2)). source

The Act carries no fines; its measures are delivered through procurement and EU funding.

Penalties

None. The Regulation contains no penalty provisions; it sets up support mechanisms and amends the Digital Europe Programme to fund them (Article 22). source

Evaluation

The Commission evaluates the measures by 5 February 2027 and at least every 4 years thereafter (Article 25(1)). source

1. Law text Regulation (EU) 2025/38 (Cyber Solidarity Act)
2. Law text Regulation (EU) 2025/37 - managed security services certification (adopted the same day)

1. NIS2

   Sets the obligations on essential and important entities; the Cyber Solidarity Act builds on NIS2's CSIRTs and crisis authorities without adding company duties.

2. EU Cybersecurity Act

   Its 2025 amendment enables certification of managed security services, which Reserve providers will need once a scheme exists.

3. ENISA

   The EU cybersecurity agency, which reviews major incidents under this Act.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 18 September 2026. Subscribe to Cyber Solidarity Act (RSS)