Changes from plenary report to adopted text

51. Urges the Member States to increase intelligence sharing, including with EU INTCEN and the European Union Military Staff (EUMS) Intelligence Directorate, while respecting the sovereignty of the Member States, the need-to-know principle, and the protection of national classified information; stresses that data-driven, intelligence-based assessments must be systematically incorporated into EU planning, crisis management and policymaking;

52. Calls on the EU institutions, in cooperation with the Member States and the EEAS, to explore a secure – need-to-know and need-to-share – information-sharing system, whereby the EU would act as a facilitator connecting public authorities, relevant EU, national and international bodies, critical infrastructure operators, private companies, and trusted threat-information sources, in order to strengthen collective situational awareness while ensuring the utmost protection of sensitive information; believes that such a system would incentivise participating bodies to share information by enabling them to benefit from a more complete threat picture and higher-quality intelligence products, while progressively building the trust required for meaningful information sharing;

53. Calls for the establishment of a ‘Black Book of Hybrid Aggression by Russia, China and others’ in order to publicly document every hybrid operation against the EU and its Member States from the past 10 years; insists that the ‘Black Book’ be discussed in the Council and presented to Parliament annually in order to impose further costs on the states in question;

From fragmentation to a coordinated and decisive European response

54. Underlines that only through deeper integration, coordination, increased European defence readiness and capabilities, including through further developing the European Defence Technological and Industrial Base, can the EU respond effectively to escalating hybrid and conventional threats;

55. Considers that the EU must move from a reactive to a proactive strategy, which includes using its capabilities to disrupt, deter and respond to hybrid threats and credibly raise the cost of hostile action; stresses that any violation of the Member States’ sovereignty must be met with effective, proportionate and coordinated retaliation measures;

56. Stresses that to effectively counter and deter hybrid threats a shared and comprehensive threat picture is required, which depends on common frameworks, methodologies, taxonomies and operational standards; highlights the need to combine diplomatic, legal, economic and restrictive measures to prevent, detect, identify, attribute and respond to hybrid operations including through asymmetric measures across all relevant domains; calls on the Commission, the High Representative and the Council to develop a cross-domain action plan against hybrid warfare, including strengthened civil-military cooperation, operational playbooks, collaborative and efficient response protocols, including calibrated EU retaliatory options proportionate to the severity of hostile activities and clear response chains that are interoperable with and complement those of NATO, while preserving the capacity of the EU and the Member States to act independently if necessary; calls for the designation of a single point of coordination between the Commission and the EEAS in order to establish a genuine whole-of-EU approach to hybrid threats;

57. Welcomes the ongoing initiatives to strengthen operational capacity, including EU Hybrid Rapid Response Teams and the launch of the EU’s Eastern Flank Watch and the European Drone Defence Initiative; calls for swift progress in their deployment; stresses the strategic importance of regional defence and security clusters and calls for dedicated EU funding lines to integrate their know-how and capabilities into cross-border projects that increase European resilience;

58. Welcomes the Commission’s and the High Representative’s announcement of a new global EU security strategy and calls for it to comprehensively address the full spectrum of hybrid threats;

59. Insists on the need to urgently advance towards a genuine European Defence Union, as a stronger European pillar of NATO, separable but not separate, enabling the EU and its Member States to act independently when necessary; calls for the mutual defence clause (Article 42(7) TEU) to be further operationalised in armed aggression and severe hybrid scenarios; calls further for an Article 42.7 playbook – a concise but comprehensive operational guide for national governments and EU institutions, explaining what happens before, during and after a Member State invokes the Article; suggests that the playbook be tested regularly in severe hybrid crisis scenarios and through comprehensive cross-sectoral exercises;

60. Stresses that some of Russia’s hybrid attacks against the EU and its Member States may amount to state-sponsored terrorism; encourages the Member States to use all available legal tools to counter them, including the solidarity clause (Article 222 TFEU), making full use of the cooperation and coordination mechanisms made available when the clause is activated;

61. Welcomes the work done under existing sanctions regimes targeting hybrid activities, in particular the sanctions regime established in October 2024 targeting Russia’s destabilising activities and the horizontal cyber sanctions regime established in 2019; deplores the fact that the EU sanctions framework is complex and fragmented across different hybrid threat vectors; calls for further strengthening the EU’s restrictive measures in response to hybrid threats, including the immediate establishment of a horizontal EU sanctions framework – specifically designed for hybrid threats in order to fill the gaps in existing regimes and increase the deterrent effect – which would exist alongside the Russia hybrid sanctions regime to underscore Russia’s active engagement in hybrid operations globally while enabling faster and more systematic sanctioning of entities responsible for hybrid campaigns; calls for the EU Hybrid, FIMI and Cyber Diplomacy Toolboxes to be further strengthened and used more effectively;

62. Reiterates the need to ensure accountability for hybrid operations and for those responsible, including proxies acting on behalf of state actors, by making full use of existing and dedicated tools; calls on the EU and the Member States to take urgent action to halt and disrupt the financial flows that fund attacks on democracy, including by mobilising banking regulators, criminal investigators and sanctions authorities to trace and examine illicit sources of financing, including cryptocurrency; calls on the EU and the Member States to break the financial and algorithmic incentives that allow disinformation to thrive, including by addressing the links between illicit funding, advertising revenues, attention-driven platform business models and manipulative content;

63. Takes the view that all criminal law tools available at Member State and EU level should be applied and, where appropriate, further developed to prevent and counter illegal conduct aimed at undermining democratic institutions and processes; stresses the need for competent national authorities to be equipped with adequate tools and cooperation channels to prevent, investigate, detect and prosecute criminal offences related to foreign interference; considers that corruption and intimidation of elected and public officials by criminal networks should be addressed as part of the EU’s response to hybrid threats via strengthened cooperation between specialised anti-corruption agencies, law enforcement authorities and relevant EU bodies; asks the Commission to assess the added value of establishing minimum rules in EU law on the definition of and sanctions for the criminal offence of knowingly participating in organised activities of interference on behalf of foreign powers; notes that the forthcoming revision of the mandates for EU justice and home affairs agencies provides an opportunity to strengthen the EU’s operational response capacity; calls on the Commission to explore the idea of convening a platform or task force for the Member States to voluntarily coordinate national legislative responses and share best practices;

Geographical considerations

64. Strongly condemns the instrumentalisation of migration by third countries or hostile non-state actors in order to destabilise a Member State or put pressure on the EU; notes the specific provisions on the instrumentalisation of migration recently included in key pieces of EU legislation; notes the Commission’s announced revision of the mandate for Frontex; underlines that this revision should provide for the legal basis, analytical capabilities, and adequate human, financial and technical resources required, which would also help strengthen the EU’s response to hybrid threats;

66. Condemns Russia’s systematic drone incursions and cross-border provocations targeting the Member States along the EU’s eastern flank as a calculated campaign of intimidation against civilian populations; welcomes the Commission communication on the EU’s eastern regions bordering Russia, Belarus and Ukraine, and its explicit recognition that the EU’s eastern border regions face structural and sustained threats from Russia and Belarus; calls on the Commission to translate this recognition into dedicated funding streams under the 2028-2034 multiannual financial framework, including dedicated funding to enhance integrated border protection capabilities, modernise physical and digital border surveillance infrastructure – in line with NATO standards – at the EU’s external land borders; underlines that focus should be placed on advanced detection, monitoring and countermeasure systems against unmanned aerial systems to protect critical infrastructure such as airports, energy facilities, and transport hubs and support the Member States in deploying interoperable airspace awareness systems, electronic protection measures, and rapid incident response capacities; stresses that measures must be proportionate, defensive, and civilian-protection-oriented, ensuring continuity of essential services and freedom of movement within the Schengen area;

67. Stresses that hybrid threats increasingly affect the EU as a whole, while taking different forms across regions; underlines, in this regard, the exposure of the Baltic, Nordic-Baltic and Black Sea regions to threats against maritime and airspace security, as well as instrumentalised migration, the vulnerability of Mediterranean and southern border regions to threats targeting maritime infrastructure, energy networks, logistics corridors, strategic transport routes, disinformation campaigns and the instrumentalisation of migration flows, the exposure of south-eastern Europe to economic coercion, energy dependencies and coordinated information manipulation linked to neighbouring theatres, the specific vulnerability of major urban and digital information spaces across the EU to cognitive warfare, polarisation and foreign interference; underlines the growing strategic significance of the Arctic region for European security, including the protection of critical infrastructure, freedom of navigation, satellite communications and emerging transport corridors; calls on the EU and NATO to reflect the geography of hybrid threats in their strategies, including the upcoming EU security strategy, while maintaining a 360º security approach to resilience, preparedness and response; stresses that funding to counter hybrid threats should be based on strategic exposure, operational needs and demonstrated vulnerabilities, while ensuring support for all regions facing hybrid threats;

EU and NATO coordination and cooperation

68. Reaffirms that NATO remains the cornerstone of collective defence for its members; calls for increased EU-NATO cooperation to strengthen European preparedness, resilience and deterrence against hybrid threats; highlights in this regard the importance of critical infrastructure protection, military mobility, cyber resilience and preparedness; highlights the need for a more systematic exchange of lessons learned from the war in Ukraine in the hybrid domain;

69. Stresses that EU and NATO action in the hybrid domain must be complementary, mutually reinforcing and operationally coordinated, while ensuring the EU’s capacity to act when required, against the backdrop of the alignment of EU minimum preparedness requirements with NATO baseline requirements;

70. Notes that NATO’s 2025 revised hybrid strategy marks a shift from resilience to active deterrence; welcomes the pre-agreed Military Response Options and expanded authorities of the Supreme Allied Commander Europe (SACEUR) to enable faster action at the start of a hybrid attack, reducing delays between threat detection and response while preserving political oversight;

71. Welcomes NATO’s Hybrid Tracking Mechanism, an intelligence aggregation tool via NATO’s Joint Intelligence and Security Division, which provides allies with a consolidated threat picture, drawing on national intelligence services; recognises the ongoing cooperation between NATO and the EU in the intelligence domain, and calls on the Commission and the EEAS to establish a structured interface within the Hybrid Fusion Cell with this mechanism so that EU situational awareness and NATO’s hybrid threat picture are regularly and systematically aligned;

72. Stresses the important role of NATO’s Arctic Sentry, Baltic Sentry and Eastern Sentry as agile instruments in responding to hybrid threats within operationally relevant time frames, especially regarding the protection of maritime critical infrastructure and supply routes, and the monitoring of hybrid activities in those regions; notes that their effectiveness is constrained by the high cost of intercepting drones, gaps in situational awareness and the fragmentation of counter-drone regulatory frameworks across the Member States; calls for the implementation of the EU action plan on drone and counter-drone security to be accelerated, including the provision of dedicated funding for layered defence capabilities in front-line Member States to combat meteorological balloons and drones kinetically and electronically, and for the action plan’s systematic alignment with NATO operational requirements, ensuring harmonised, adequately resourced counter-drone capabilities across the Member States; further supports greater cooperation in the development and deployment of cost-effective counter-drone technologies across the EU;

73. Welcomes the EU–NATO Parallel and Coordinated Exercises (PACE) framework as a valuable instrument for testing and improving joint response capacity, scale, and scope and for the systematic integration of lessons learned into EU policy, planning and institutional arrangements; calls for regular EU and NATO exercises simulating hybrid attack scenarios, including sabotage against military mobility infrastructure, coordinated cyberattacks, large-scale FIMI campaigns, airspace violations and attacks on critical infrastructure;

74. Calls on the Commission, the EEAS, in close coordination with NATO and the Member States, to develop a common understanding of hybrid threats and to establish a coherent response mechanism for the EU and NATO;

75. Recognises the valuable role played by specialised centres of excellence, including the European Centre of Excellence for Countering Hybrid Threats in Helsinki and the NATO Cooperative Cyber Defence Centre of Excellence in Tallinn, in strengthening preparedness, resilience, cyber defence and counter-hybrid capabilities across Europe; further welcomes the work of the EU-NATO Task Force on the Resilience of Critical Infrastructure, particularly in strengthening cooperation on energy, transport, digital infrastructure and undersea connectivity;

76. Calls on the Member States to harmonise their laws in closing the legal gaps preventing allied personnel from participating in below-threshold hybrid response operations; welcomes Estonia’s recently adopted amendments to its Defence Forces Organisation Act as a concrete step in this direction;

Partner countries: cooperation and support

77. Underlines that Russian hybrid operations beyond the EU aim to shift the foreign policies of third countries in line with Moscow’s interests, undermine the EU’s relationships with its partners and weaken international support for Ukraine; reiterates, therefore, the importance of close cooperation with international partners and organisations to enhance situational awareness and to prevent, deter and respond more effectively to hybrid threats; acknowledges the value of deepening bilateral sectoral dialogues and consultations with like-minded partners on hybrid threats, especially within the framework of security and defence partnerships;

78. Emphasises that strengthened cooperation with Ukraine, Moldova, Armenia and partners in the Western Balkan is a strategic necessity, as they face continuous attacks from Russia and form key testing grounds for Russia’s hybrid tactics, combining FIMI, cyber operations, covert influence networks, energy coercion, and corruption-based leverage to undermine democratic institutions, societal cohesion, and EU and NATO integration prospects; calls on the Member States to adopt lessons learned from these countries and establish structured mechanisms for the systematic exchange of best practices and operational experience, including on Ukraine’s capacity to maintain essential services, continuity of government, protection of critical infrastructure, strategic communication and societal functioning and resilience under sustained attack; reiterates its strong support for Ukraine’s progressive accession to the EU and accession to NATO once the relevant conditions have been fulfilled;

79. Highlights the strategic importance of continuing and deepening hybrid resilience support to candidate, potential candidate and partner countries, who are often primary targets of Russian hybrid activities and whose resilience directly contributes to the security of the EU; welcomes the EU’s and the Member States’ active contribution to strengthening their resilience through the Foreign Policy Instrument, strategic communications, Hybrid Rapid Response Teams, the Hybrid Risk Survey and CSDP missions in partner countries including Ukraine, Moldova, Armenia and Montenegro; calls for the organisation of regular joint exercises, simulation scenarios and training programmes aimed at enhancing preparedness, improving rapid response capacities and fostering interoperability in addressing hybrid threats; notes with appreciation the coordinated EU-NATO response in Moldova, including the parallel deployment of an EU Hybrid Response Team and a NATO Counter Hybrid Support Team with complementary mandates; encourages candidate countries and potential candidates to fully align with the EU common foreign and security policy (CFSP), including restrictive measures, as a key aspect of the EU integration process;

80. Commends Moldova’s and Armenia’s pro-European forces for their democratic resilience during and in the lead-up to their 2025 and 2026 parliamentary elections, demonstrating strong resistance to Russia’s sustained years-long FIMI campaigns; underlines the effectiveness of the whole-of-government approach as an operational model, including its use of law enforcement action against networks conducting hybrid operations on behalf of Russia; calls on the Member States and the Commission, in cooperation with the EEAS, to develop EU-level frameworks enabling comparable enforcement responses; notes the important role played by EU institutions, state institutions, civil society, and independent media in countering FIMI, including AI-enabled large-scale coordinated information manipulation campaigns contributing to the notably high level of public awareness of hybrid threats;

81. Calls for reinforced cooperation on hybrid threats with like-minded non-EU partners, in particular the United Kingdom and Norway, as key European security partners, as well as Canada, Japan, the Republic of Korea, Australia, New Zealand, Taiwan and other like-minded partners, including where possible through security and defence partnerships, information sharing, cyber, maritime security, space and resilience cooperation; stresses that EEA/EFTA states and their defence industries should be fully included in EU hybrid resilience frameworks and capability development programmes, recognising their direct contribution to European security and their shared exposure to hybrid threats;

82. Regrets that the recent shift in US policy has weakened the common front of democracies at a time of intensifying hybrid threats; stresses that transatlantic unity remains essential to fighting them;

83. Highlights that Russian influence operations in Africa, Latin America and the Caribbean are not peripheral to European security, as they seek to undermine the EU’s partnerships, weaken support for Ukraine and undermine European diplomacy, security assistance and development cooperation; notes that in Africa, these operations mostly rely on state media, and cultural and religious fronts, while in Latin America and the Caribbean, Russia has built a Spanish-language influence ecosystem that complements its anti-European messaging elsewhere; calls on the EU and the Member States to strengthen strategic communication, support independent and trusted local media, engage credible local voices and reinforce cooperation with partners in both regions to expose and counter hostile information operations;

84. Underlines the importance of the experience of Gulf States, Jordan, and other relevant partners in addressing hybrid influence networks associated with the Muslim Brotherhood, including through governance, regulatory, and societal resilience approaches, and calls for structured exchange of best practices with these partners in order to strengthen the EU’s understanding of hybrid threats, improve policy responses, and step up cooperation in countering foreign interference while respecting fundamental rights and the diversity of legal and political systems;

85. Notes Taiwan’s extensive experience defending itself against China’s hybrid attacks and FIMI; commends Taiwan’s comprehensive resilience model, including the establishment of a Whole-of-Society Defence Resilience Committee, large-scale civil defence training, cooperation with civil society organisations, digital resilience networks and public preparedness initiatives; underlines that Taiwan’s experience shows that societal resilience is not a secondary aspect of defence, but a central pillar of national security, particularly when hybrid pressure targets critical infrastructure, public trust and social cohesion; calls for regular exchanges between the EU and its Taiwanese counterparts on relevant security issues, and for stronger cooperation, in this regard, on countering FIMI and cognitive warfare, protecting critical infrastructure and undersea cables, and strengthening whole-of-society resilience between the EU and Taiwan; calls on the EU to expand trade and industrial cooperation with Taiwan, particularly in high-tech components and strategic technologies critical to the resilience and security of essential infrastructure and supply chains, including semiconductors, 5G/6G telecommunications equipment, drones, and dual-use items; stresses also the need to provide IRIS² (Infrastructure for Resilience, Interconnectivity and Security by Satellite) to Taiwan and Ukraine;

°

° °

86. Instructs its President to forward this resolution to the Council, the High Representative and the Commission.