Picture this: you have just won a contract with a European energy operator. Months later, you learn that one component in your product may be barred from the operator's critical systems, not because it is insecure, but because of who owns or controls your company. That is the scenario Brussels is sketching with CSA2, the proposed Cybersecurity Act 2. If you sell to NIS2 vendors' customers, or are one yourself, this is the proposal to watch.
What Is CSA2 (Cybersecurity Act 2)?
On 20 January 2026, the European Commission proposed CSA2 (COM(2026) 11 final) to repeal and replace the 2019 Cybersecurity Act. It was published alongside targeted amendments to the NIS2 Directive. CSA2 reforms the EU certification framework, strengthens ENISA, and, most controversially, creates the first horizontal EU framework for non-technical risks in ICT supply chain security across NIS2 sectors.
One point matters above all: CSA2 is a proposal, not law. Nothing described below is binding yet.
How Would the High-Risk Supplier Mechanism Work?
The proposal follows a staged logic:
1. Risk assessment: the Commission, or a group of Member States, triggers a coordinated ICT supply chain risk assessment.
2. Country designation: the Commission may designate a third country that poses "serious and structural" non-technical risks.
3. Key ICT assets: implementing acts identify which assets in each sector count as key ICT assets.
4. Supplier listing: entities established in, or controlled from, a designated country can be listed as high-risk suppliers. They may ask for reassessment if their ownership or control structures change.
5. Restrictions: NIS2 entities could be prohibited from using, installing or integrating high-risk suppliers' components in key ICT assets, subject to transition periods.
Listed suppliers could also face exclusion from European standardisation work, EU cybersecurity certification, public procurement and EU-funded programmes tied to key ICT assets. The restrictions may reach not only direct suppliers but also products that contain their components.
Why NIS2 Vendors Should Care
NIS2 (Directive (EU) 2022/2555) already requires essential and important entities to manage supply chain security. Maximum fines reach at least €10 million or 2% of worldwide turnover for essential entities, and at least €7 million or 1.4% for important entities. CSA2 would add a geopolitical layer on top of that technical duty.
The prohibitions would target how NIS2 entities use components, but the commercial effect flows straight to vendors. If a NIS2 entity must remove or avoid your components, your contract, roadmap and revenue are exposed. For breaches of the supply chain framework, the proposal sets fines of 1%, 2% or 7% of worldwide annual turnover, with 7% covering the most serious failures, including the telecom prohibition.
Telecoms face the sharpest edge. For mobile networks, phase-out of high-risk supplier components would be capped at 36 months, while fixed and satellite timelines would follow by implementing act. The Commission's impact assessment estimates replacement costs of EUR 3.4 to 4.3 billion per year over three years.
Quick Answers: Does CSA2 Replace NIS2?
No. CSA2 repeals the 2019 Cybersecurity Act, while NIS2 stays in force and would be amended. The supply chain rules would apply to entities in NIS2 sectors such as energy, transport and cloud computing, so your exposure depends on whether your customers sit there. The framework could also catch products that merely contain a designated supplier's components, so subcontractors and integrators should look beyond their first-tier vendors.
Where Does the Legislation Stand?
According to the latest reporting available (October 2026), the file is still in committee in the European Parliament and has not reached trilogue. The Industry, Research and Energy (ITRE) Committee is leading, with Markéta Gregorová as rapporteur. A draft report circulated in September proposes moving from country-based designation towards assessing individual suppliers. Member States in the Council are still examining methodology, scope and governance. Industry bodies such as Orgalim and DIGITALEUROPE are pressing for clearer, proportionate criteria. Law firm analysis suggests Parliament–Council negotiations could start in early 2027, so the final text may differ significantly.
The same package also proposes simplifying NIS2, including a possible "cyber posture" certification route to demonstrate NIS2 conformity. That link remains under negotiation.
5 Steps to Prepare Now
1. Map your supply chain and ownership. Know who supplies each component, where they are established and who controls them. Regulators will care about structure, not just origin.
2. Identify your likely key ICT assets. Ask which parts of your product sit in the critical functions of energy, transport, cloud or telecom customers.
3. Build component transparency. A maintained SBOM with country-of-origin data supports CSA2 readiness and Cyber Resilience Act compliance, whose vulnerability reporting obligations began applying on 11 September 2026.
4. Strengthen your management system. A certified ISO 27001 audit and certification gives customers documented evidence of governance, which they increasingly request as part of NIS2 third-party risk management.
5. Prepare contracts and exit plans. Expect customers to ask for ownership disclosures, change-of-control notices and substitution plans for single-source components.
If you are unsure where you stand, start with a structured NIS2 compliance and audit assessment. German-speaking markets can explore NIS2 compliance consulting in Germany. Financial entities should also check their DORA compliance and audit obligations for ICT third-party risk. You can also use VISTA's Regulatory Exposure Check or browse the free compliance guides.
The Bottom Line
CSA2 may change, narrow or slow down before it becomes law. But the direction is clear: in the EU, who supplies your technology is becoming as important as how secure it is. Vendors that can prove transparency, control and resilience today will be the ones their NIS2 customers keep tomorrow.
Ready to assess your exposure? Book a free consultation with VISTA InfoSec to review your NIS2 and supply chain readiness.
This article is for general information and is not legal advice. Status of the proposal reflects publicly available reporting as of November 2026.
Top comments (0)