Changes from plenary report to adopted text

RemovedDRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

AddedP9_TA(2024)0355

Removedon the proposal for a regulation of the European Parliament and of the Council laying down measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cybersecurity threats and incidents

AddedCyber Solidarity Act

Removed(COM(2023)0209 – C90136/2023 – 2023/0109(COD))

AddedCommittee on Industry, Research and Energy

AddedPE752.795

AddedEuropean Parliament legislative resolution of 24 April 2024 on the proposal for a regulation of the European Parliament and of the Council laying down measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cybersecurity threats and incidents (COM(2023)0209 – C9-0136/2023 – 2023/0109(COD))

▸5 unchanged paragraphs

(Ordinary legislative procedure: first reading)

The European Parliament,

– having regard to the Commission proposal to Parliament and the Council (COM(2023)0209),

– having regard to Article 294(2) and Articles 173(3) and 322(1), point (a), of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C90136/2023),

– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

Added– having regard to the opinion of the Court of Auditors of 18 April 2023,

– having regard to the opinion of the European Economic and Social Committee of 13 July 2023,

Added– having regard to the opinion of the Committee of the Regions of 30 November 2023,

Added– having regard to the provisional agreement approved by the committee responsible under Rule 74(4) of its Rules of Procedure and the undertaking given by the Council representative by letter of 21 March 2024 to approve Parliament’s position, in accordance with Article 294(4) of the Treaty on the Functioning of the European Union,

▸4 unchanged paragraphs

– having regard to Rule 59 of its Rules of Procedure,

– having regard to the opinions of the Committee on Foreign Affairs and the Committee on Transport and Tourism,

– having regard to the report of the Committee on Industry, Research and Energy (A9-0426/2023),

1. Adopts its position at first reading hereinafter set out;

Change 1

Removed2. Approves its statement annexed to this resolution;

Added2. Takes note of the statement by the Commission annexed to this resolution, which will be published in the C series of the Official Journal of the European Union;

3. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;

4. Instructs its President to forward its position to the Council, the Commission and the national parliaments.

Change 2

RemovedAMENDMENTS BY THE EUROPEAN PARLIAMENT*

AddedP9_TC1-COD(2023)0109

Removedto the Commission proposal

AddedPosition of the European Parliament adopted at first reading on 24 April 2024 with a view to the adoption of Regulation (EU) 2025/… of the European Parliament and of the Council laying down measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cyber threats and incidents and amending Regulation (EU) 2021/694 (Cyber Solidarity Act)

Removed---------------------------------------------------------

Added(As an agreement was reached between Parliament and Council, Parliament's position corresponds to the final legislative act, Regulation (EU) 2025/38.)

Removed2023/0109 (COD)

AddedANNEX TO THE LEGISLATIVE RESOLUTION

RemovedProposal for a

AddedCommission’s statement on budget with regards to Regulation (EU) 2025/38 of the European Parliament and of the Council of 19 December 2024 laying down measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cybersecurity threats and incidents (Cyber Solidarity Act)

RemovedREGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

Added1. The Commission’s Legislative Financial Statement accompanying the proposal on the Cyber Solidarity Act was published in April 2023. Since then, the relevant estimated figures have changed due to the adoption or expected adoption of other legislative acts.

Removedlaying down measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cybersecurity threats and incidents and amending Regulation (EU) 2021/694

Added2. On 5 March 2024, the co-legislators reached a preliminary political agreement to limit to EUR 22 million the reallocation from the Specific Objective 4 “Advanced Digital Skills” to the Specific Objective 3 “Cybersecurity and Trust” of the Digital Europe Programme foreseen in the Legislative Financial Statement.

RemovedTHE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Added3. To reflect the terms of the preliminary political agreement, the Commission updated the Legislative Financial Statement of the Cyber Solidarity Act with regards to the financial envelopes for the Specific Objectives 2 “Artificial Intelligence”, 3 “Cybersecurity and Trust” and 4 “Advanced Digital Skills”, taking into account the reallocations as agreed by the co-legislators.

RemovedHaving regard to the Treaty on the Functioning of the European Union, and in particular Article 173(3) and Article 322(1), point (a) thereof,

Added4. Accordingly, the financial envelopes for the period 2025-2027 presented in the updated Legislative Financial Statement, without prejudice to the powers of the Commission in the context of the annual budgetary procedure, are the following:

RemovedHaving regard to the proposal from the European Commission,

Added[EUR544 726 000] for Specific Objective 2 “Artificial Intelligence”, taking into account EUR 65 million reallocated to Specific Objective 3 “Cybersecurity and Trust”;

RemovedAfter transmission of the draft legislative act to the national parliaments,

Added[EUR 44 451 000] for Specific Objective 3 “Cybersecurity and Trust” - part under the direct management of the Commission, including EUR 26 million reallocated from Specific Objectives 2 and 4.

RemovedHaving regard to the opinion of the Court of Auditors

Added[EUR 353 190 613] for Specific Objective 3 “Cybersecurity and Trust” - part managed by the European Cybersecurity Competence Centre, including the reallocation of EUR 61 million from Specific Objectives 2 and 4.

RemovedHaving regard to the opinion of the European Economic and Social Committee,

Added[EUR 167 162 423] for Specific Objective 4 “Advanced Digital Skills”, taking into the reallocation of EUR 22 million to Specific Objective 3 “Cybersecurity and Trust”.

RemovedHaving regard to the opinion of the Committee of the Regions,

Added5. The EU Cybersecurity Reserve will be funded from the financial envelope of the Specific Objective 3 “Cybersecurity and Trust”– part under the direct management of the Commission (which according to the updated LFS is estimated at EUR [44 451 000]).

RemovedActing in accordance with the ordinary legislative procedure,

RemovedWhereas:

Removed(1) The use of and dependence on information and communication technologies have become fundamental aspects, but have, simultaneously introduced possible vulnerabilities, in all sectors of economic activity and democracy as our public administrations, companies and citizens are more interconnected and interdependent across sectors and borders than ever before.

Removed(2) The magnitude, frequency and impact of cybersecurity incidents are increasing at a Union-wide and global level in terms of their method and impact, including supply chain attacks aiming at cyberespionage, ransomware or disruption. They represent a major threat to the functioning of network and information systems. In view of the fast-evolving threat landscape, the threat of possible large-scale incidents causing significant disruption or damage economies and democracies to critical infrastructures across the Union demands heightened preparedness at all levels of the Union’s cybersecurity framework. That threat goes beyond Russia’s military aggression on Ukraine, and is likely to persist given the multiplicity of state-aligned, and criminal ▌actors involved in current geopolitical tensions. Such incidents can impede the provision of public services and the pursuit of economic activities, including in critical or highly critical sectors, generate substantial financial losses, undermine user confidence, cause major damage to the economy of the Union, and could even have health or life-threatening consequences. Moreover, cybersecurity incidents are unpredictable, as they often emerge and evolve within very short periods of time, not contained within any specific geographical area, and occurring simultaneously or spreading instantly across many countries. Close and coordinated cooperation is therefore needed between the public sector, the private sector, academia, civil society and the media. Moreover, the Union's response needs to be coordinated with international institutions as well as trusted and like-minded international partners. Trusted and like-minded international partners are countries that share the Union’s values of democracy, commitment to human rights, effective multilateralism, and rules-based order, in line with the international cooperation frameworks and agreements. To ensure cooperation with trusted and like-minded international partners and protection against systemic rivals, entities established in third countries that are not parties to the GPA should not be allowed to participate in procurement under this Regulation.

Removed(3) It is necessary to strengthen the competitive position of industry and services sectors in the Union across the digitised economy and support their digital transformation, by reinforcing the level of cybersecurity in the Digital Single Market. As recommended in three different proposals of the Conference on the Future of Europe , it is necessary to increase the resilience of citizens, businesses, in particular microenterprises, small and medium-sized enterprises (SMEs) including startups and entities operating critical infrastructures, including local and regional authorities against the growing cybersecurity threats, which can have devastating societal and economic impacts. Therefore, investment in infrastructures and services and building capabilities to develop cybersecurity skills that will support faster detection and response to cybersecurity threats and incidents is needed, and Member States need assistance in better preparing for, as well as responding to significant and large-scale cybersecurity incidents. The Union should also increase its capacities in these areas, notably as regards the collection and analysis of data on cybersecurity threats and incidents.

Removed(3a) Cyberattacks are frequently targeted at local, regional or national public services and infrastructures. Local authorities are among the most vulnerable targets of cyberattacks due to their lack of financial and human resources. It is therefore particularly important that decision-makers at local level are made aware of the need to increase digital resilience, increase their capacity to reduce the impact of cyberattacks and seize the opportunities provided for by this Regulation.

Removed(4) The Union has already taken a number of measures to reduce vulnerabilities and increase the resilience of critical infrastructures and entities against cybersecurity risks, in particular Directive (EU) 2022/2555 of the European Parliament and of the Council, Commission Recommendation (EU) 2017/1584, Directive 2013/40/EU of the European Parliament and of the Council and Regulation (EU) 2019/881 of the European Parliament and of the Council. In addition, the Council Recommendation on a Union-wide coordinated approach to strengthen the resilience of critical infrastructure invites Member States to take urgent and effective measures, and to cooperate loyally, efficiently, in solidarity and in a coordinated manner with each other, the Commission and other relevant public authorities as well as the entities concerned, to enhance the resilience of critical infrastructure used to provide essential services in the internal market.