The Council of the European Union — the body where member-state governments negotiate EU legislation — is set to examine a cybersecurity package covering three fronts: the mandate of ENISA, the EU’s cybersecurity agency; simplification of the NIS2 directive, the bloc’s baseline cybersecurity law for critical and important sectors; and rules addressing security of the technology supply chain. The development was reported by Industrial Cyber on June 6, 2026.

Executive Summary

According to the report, EU member states are turning their attention to a package that bundles three of the most consequential threads in European cyber policy. The first is institutional: what ENISA, the European Union Agency for Cybersecurity, is empowered and resourced to do. The second is regulatory relief: “simplification” of NIS2, the directive that since 2023 has imposed risk-management and incident-reporting duties on energy, transport, health, digital infrastructure, and thousands of other entities. The third is supply chain security — the question of how Europe manages risk from the hardware, software, and service providers that critical operators depend on.

Why it matters: NIS2 is the compliance framework under which most European data centers, cloud providers, and network operators now live. Any change to its obligations, to the agency that coordinates its implementation, or to how vendor risk must be managed flows directly into the budgets and architectures of infrastructure operators — inside the EU and among the non-EU suppliers who sell into it. Council examination is an early but meaningful stage: it signals member states are engaging with the substance, and their negotiating position will shape whatever finally becomes law.

Why Brussels Is Revisiting Rules It Only Just Finished Writing

NIS2 entered into force in 2023, and member states were required to transpose it into national law by late 2024 — a process that ran late in much of the bloc. That a “simplification” effort is on the Council’s table so soon reflects a broader shift in EU policymaking: after a decade of expanding digital regulation (GDPR, NIS2, DORA, the Cyber Resilience Act), the political mood has turned toward reducing overlapping reporting duties and compliance costs, particularly for mid-sized firms, in the name of competitiveness.

For regulated entities, simplification cuts both ways. Streamlined incident reporting and deduplicated obligations across overlapping laws would be a genuine relief — many operators today face multiple reporting clocks for a single incident. But reopening a directive mid-implementation creates its own cost: companies that have spent two years building NIS2 compliance programs now face uncertainty about whether the target will move. The report does not detail which obligations would be simplified, so the practical effect remains an open question.

ENISA: From Coordinator to Something More?

ENISA has existed since 2004 and received a permanent mandate under the 2019 Cybersecurity Act, which also made it the steward of the EU’s cybersecurity certification schemes. But the agency has long been described as carrying responsibilities that outstrip its budget and headcount, and the Cybersecurity Act itself has been under review. A package that “reworks” the mandate suggests member states are deciding how much operational weight — in certification, vulnerability handling, incident support, or supervision — the agency should carry.

The stakes for industry are concrete. If ENISA’s certification role expands, cloud and hardware vendors could face new (or consolidated) EU-level assurance schemes rather than a patchwork of national ones. If its operational-support role grows, member states with thinner national capabilities gain a backstop. Either direction changes who infrastructure operators deal with when regulation and incidents intersect.

Supply Chain Security: The Hardest Problem in the Package

Supply chain security is where cyber policy meets geopolitics. Europe’s critical infrastructure runs on globally sourced components — chips, network equipment, software libraries, managed services — and recent years have demonstrated, from widely exploited software vulnerabilities to compromises of vendor update mechanisms, that attackers increasingly go through suppliers rather than at targets directly. NIS2 already obliges covered entities to manage supply chain risk, and EU bodies have previously conducted coordinated risk assessments of specific technology dependencies.

The unresolved question is instrument choice: guidance and risk assessments, procurement conditions, certification requirements, or exclusion of “high-risk” vendors, as some member states applied to 5G equipment. Each option distributes costs differently between operators, European suppliers, and non-EU vendors. The report does not indicate which approach the package takes — a gap worth watching closely, because vendor-exclusion regimes and certification mandates have far larger commercial consequences than guidance documents.

What Infrastructure Operators Should Take From an Early-Stage Signal

Council examination is not enacted law, and packages change substantially during negotiation between the Council, the European Parliament, and the Commission. The prudent reading for operators of data centers, networks, and cloud platforms is directional: EU cyber regulation is consolidating rather than retreating, the compliance perimeter will keep touching vendor relationships, and ENISA’s role in day-to-day industry interaction is likely to grow rather than shrink.

Practically, that argues for compliance programs built on durable fundamentals — asset inventories, tested incident response, documented vendor risk management — rather than narrow teach-to-the-test implementations of current NIS2 texts. Obligations drafted around outcomes tend to survive simplification exercises; paperwork drafted around specific reporting templates may not.

Background

The EU built its current cyber framework in layers: the original NIS directive of 2016 established the first bloc-wide security obligations; the 2019 Cybersecurity Act gave ENISA a permanent mandate and created an EU certification framework; and NIS2, in force since 2023 with national transposition due in late 2024, dramatically widened the set of regulated sectors and stiffened enforcement. Sector-specific regimes such as DORA for financial services and the Cyber Resilience Act for digital products followed, producing a dense — critics say overlapping — regulatory landscape.

By 2026, that density collided with a renewed EU focus on competitiveness and burden reduction, prompting reviews of recently adopted digital rules. The package now before the Council sits at that intersection: consolidating the institutional architecture around ENISA, easing NIS2 compliance mechanics, and confronting supply chain risk, which incidents of recent years have made a first-order concern for governments and critical-infrastructure operators alike.

Source: EU Council to examine cybersecurity package focused on ENISA, NIS2 simplification, and supply chain security — Industrial Cyber, June 6, 2026, reporting on the Council of the EU taking up the package.