Committee on Industry, Research and Energy Extraordinary meeting
Legend
Transcript markers
- text Sentence being played
- text Search result
- text Intervention cited by the link you opened
Click a sentence to play the video from that moment. Select text to quote it with the speaker, timestamp and link.
More options
Offset
Transcript offset
Export
Live capture
Versions of this video
Transcripts may differ slightly from one version to another.
ITRE European Parliament
Follow its sittingsMohammed Chahim
I would not dare, sorry Chair, I would not dare to comment anything after Mr. Ehler has used very, very explicit words. I can only say I underline them. And I think they should stop playing these games. It's really, really, we worked really hard this summer to get this done. We are really pushing hard the Council to take this proposal serious.
We are managing that. We are working with the budget people in the Parliament to fix a budget already for the 2027 budget so that we don't have any delays with doing the work. Then please stop these internal politics between the different DGs. Work for Europe, work for critical raw materials because industry is needing it. Thank you.
Borys Budka
Thanks a lot for this. And thanks to all of you from, of course, the rapporteur and the shadows and your team, teams for the effort you've made last time. And of course, I also agree what Christian Ehler has just said. So first we will have the test vote, so as always, I can't see Dan because always Dan is asking the question for test vote, to be or not to be. So first the testing vote, just let's try it.
So the question is are we here? And let's try it. 76. Five more. Okay, but everything is okay.
Yeah. Thanks. And first we will vote by show of hands on compromise amendment.
So who is in favor? Who is against? Abstentions? So it has been adopted. Thanks a lot.
And now for the whole by roll call vote, I open the vote. The vote is closed and it is adopted. So thank you very much. And now one minute break.
Tsvetelina Penkova
Alright colleagues, may I please ask you to take your seats as we are aiming to continue with the agenda. Perfect, that was a strong start of this morning, but we still have a few more items on today's agenda. Please do allow me to inform you that item number 10 of our agenda, the exchange of views with the Irish Minister for Culture, Communications and Sports has been cancelled due to cancellation of travel of the Minister. You have been informed about that via email this morning, so we're going to have a shorter meeting. But still, without further ado, let us move to item number 6, which is under the topic of the European Union Agency for Cybersecurity, the European Cybersecurity Certification Framework and the ICT supply chain security.
So, we have 40 minutes for this discussion on the CSA2 regulation.
The rapporteur, Madame Markéta Gregorová, will present the draft report for about six minutes. After that, I would invite the shadows to take the floor for three minutes each, and we'll continue with catch-the-eye followed by replies. I'll also invite the rapporteur of the IMCO committee, Madame Maria Grapini, for two minutes each. All members who want to take the floor are invited to put their nameplates vertically in their holders, and I'll invite the Commission representative, Madame Despina Spanou, the Deputy Director-General at DG CONNECT, to take the floor for two minutes. And I'll remind everyone to please stick to their allocated time.
And now, without further ado, let's start with the rapporteur from our committee. So I'll give the floor to Madame Gregorová to make her presentation for six minutes.
Markéta Gregorová
Thank you very much, Madam Chair. I would like to start with very much thanking my shadows, of course also the opinion rapporteur from IMCO and the Commission. I do support the Commission's proposal. Europe really needs one framework in this field, not 27, and I think that the Commission is the right body to run it.
My report doesn't narrow the proposal, it makes it enforceable. The principle that runs through the whole report is the following: every power is used on evidence within fixed deadlines under regular review with Parliament informed at the same time as the Member States. The need for a review is very real today. Questionable equipment in our networks, grids and critical infrastructure. Ransomware against hospitals and municipalities.
Companies reporting the same incident several times to several authorities. The proposal addresses all three and so does my report. I will take the three parts of the proposal in order: first supply chain, then certification, then ENISA. Supply chain: I definitely fully share the objective of Article 100. The draft report pursues it at the level of the supplier.
The Commission's criteria stay. They are applied to the supplier through an evaluation matrix in a new annex: ownership and control, evidence on the supplier and mitigation factors. Mitigation factors count. A supplier that meets the Cyber Resilience Act or opens its source code to audit is assessed on that basis. No country is named in the regulation, although country is still a criteria.
The ownership and control test looks at who actually controls the supplier, wherever it is registered. Every listing needs specific and substantiated evidence, a right to be heard, a reasoned decision, and access to court. That is what makes a listing durable under legal challenge. A notification from a national authority opens an assessment; it doesn't produce a listing on its own. Circumvention through licensing, white-labeling, or intermediaries is accounted for in the draft.
Lists are adopted under the advisory procedure; in urgent cases, acts apply immediately. The risk is not only in 5G, and that is why there is a new Annex 2a, with inverters, smart meters, home routers, port cranes, and medical imaging. The Commission assesses them within 12 months, and consumer-owned devices are, of course, excluded. As for mobile networks: phase-out from 36 to 24 months, one published extension of 12 months on a demonstrated burden, fixed and satellite only after a Union-coordinated risk assessment.
Equipment bought lawfully before entry into force can be compensated under Article 17 of the Charter. And last but not least, sorry, second to least, certification. We still have ENISA, I'm not forgetting it. We have all collectively failed to make certification work under CSA 1. Many promises were made, almost none were kept.
This is why I go a different route. I turn the default in Article 71.3 around. Certification is mandatory unless Union law says otherwise. A voluntary scheme that nobody has to use does not create a market. A mandatory scheme with mutual recognition does.
In return, companies will get certification once, valid everywhere. No second audit, no national top-up, recognized in public procurement. So I support the presumption of conformity under other Union law and the limits of national schemes where a Union scheme exists, because I want companies to save time and save money, and with this we can. CyberPosture builds on the Belgium CyberFundamentals and the Spanish ENS, tiered with a free entry level for SMEs. 12 months for a candidate scheme is not realistic.
I propose 24 after a published needs and a feasibility assessment. The assessment is published so that industry and the standard bodies know what is coming before the work starts. And now last but not least, ENISA, titles 1 and 2. Today, one incident can mean several reports to several authorities under several deadlines. That costs time exactly when time matters and the organization needs to deal with the vulnerability or threat or breach.
So new Article 15a, a single entry point. One report covers NIS 2, GDPR, DORA, eIDAS, CER and the CRA. National authorities and CSIRTs remain the addressees. Federated, encrypted end-to-end by default, ENISA has no access to content. Nothing is kept beyond 72 hours.
Early alerts go to CSIRTs first. I also introduce a ransomware helpdesk, one Union service, free in all official languages. Reporting a payment is not in itself grounds for liability. Cybersecurity Reserve, at least 60% from providers established in the Union and not controlled from outside it. Union capacity for Union emergencies.
ENISA consults stakeholders, including the open source community and SMEs, on the model of Article 9 of the CRA. And importantly, no new task to ENISA without the money and the posts. Let me finish by saying that we have the urgency, the data, the evidence, and the increasing threat levels to accomplish all the tasks. What we are missing is the political unified will. My goal is a strong mandate going into trilogue.
I look forward to your amendments and the internal negotiations that we have ahead of us. Thank you.
Tsvetelina Penkova
Thank you, thank you Madam Rapporteur, and thank you for being very precise with the time as well. We continue with the shadows now, three minutes each. We start with EPP and Mr. Tobé.
Tomas Tobé
Well, thank you Chair and thank you Rapporteur. We all know that every single day, hostile states, organizations, criminals target European business and public authorities with cyberattacks, of course undermining the trust in our societies and also imposing significant costs for our companies.
My first message is basically that of course we welcome the revision of the Cybersecurity Act, and also I would like to underline that we need to adopt it swiftly. It is clear that we need to give ENISA sufficient resources to actually carry out its mandate and also already the task that we already have decided even during the last mandate. And we must also create, I would say, a strong framework to keep the high-risk vendors out of sensitive ICT supply chains and also of course to deliver on the certifications so it is fit for purpose. I must say to the rapporteur, I strongly welcome your draft report. I think it goes in the right direction.
I'm not fully convinced yet that mandatory EU-wide certification is really feasible, but let's discuss and let's work together on that. From EPP, we are now of course preparing all our amendments.
The focus will be to prepare us more for what we see with advanced AI models, how ENISA can work more closely together with Europol in the fight against cybercrime, and also of course that we need to keep the administrative burden on European industry to a minimum. So I very much look forward to this work together. Let's try to deliver it as quick as possible and make sure also that we can get Council to come with us. Thank you.
Jens Geier
Vielen Dank, Frau Präsidentin. Erstmal mein Dank an Frau Gregorová für den Berichtsentwurf, den wir gesehen haben. Aus meiner Sicht gibt's insgesamt fünf Felder, auf denen wir Änderungen vornehmen wollen zum Kommissionsentwurf. Eins ist das ENISA-Mandat, das wir stärker sehen wollen und eben auch auf technologische Risiken ausrichten, dabei auch künstliche Intelligenz, Quantencomputing und Post-Quanten-Kryptographie zu erfassen. Klar, dass das dann am Ende mit mehr Stellen und mehr Aufgaben und auch mehr Geld einhergehen wird, liegt auf der Hand.
Wir wollen, dass der Single Entry Point keine Parallelinfrastruktur zum digitalen Omnibus schafft, deswegen müssen wir schauen, wie wir da in unserem eigenen Vorgehen dafür sorgen, dass es keine Widersprüche gibt. Wir sind dafür, dass die ENISA, Entschuldigung, europäische und internationale Standardisierung unterstützt, aber keine Parallelstruktur zu den bestehenden Organisationen Organisationen aufbaut und wir wollen die Bildungsperspektive bei ENISA stärken. Beim Cybersecurity Certification sind wir dafür, von freiwillig zu verpflichtend überzugehen. Wir sind haben uns intensiv mit dem Thema Trusted ICT Supply Chains beschäftigt und wollen da die Erarbeitung von Risikoeinschätzung von sechs auf drei Monate verkürzen. Ich denke, wir sehen alle die Dringlichkeit, dass die Europäische Union beim Thema Cyberattacken handlungsfähig wird und wir wollen an der Logik, was ein High-Risk-Supplier angeht, der Kommission erstmal grundsätzlich festhalten.
Also das bedarf einer intensiven Diskussion, ob wir uns mit Unternehmen oder mit Ländern befassen und ich denke, wir sollten das bei den Schattenberichterstatterverhandlungen noch mal intensiv gemeinsam bewerten, was da was da notwendig ist.
Mir ist um eines sehr gelegen. Wir haben eigentlich eine parallele Risikosituation bei der Telekommunikation, aber auch bei den Energienetzen. Heute sind Unternehmen außerhalb der EU in der Lage, über einen Kill-Switch Energieanlagen abzuschalten. Entweder weil man sie warten muss oder weil es etwas finsterere Angelegenheiten gibt, weswegen man die Energieversorgung innerhalb der Europäischen Union einschränken möchte. Ich finde, wir sollten sehr darauf achten, dass so ein Kill-Switch, und das wäre ein Thema für den CSA 2, dass so ein Kill-Switch nicht außerhalb der Kontrolle der Europäischen Union liegt, wie auch, dass Daten, die erhoben werden, nicht auf Servern liegen, die nicht der europäischen Gesetzgebung unterliegen.
Also ich wäre dafür, den Geltungsbereich des CSA 2 auszuweiten auf elektronische Bestandteile von Elektrizitätsnetzen.
Das meint nicht die Kraftwerke, das meint nicht die Leitungen, aber das meint die Technik, die genau dazwischen liegt oder teilweise eben auch, wie bei Windrädern, bei der Energieerzeugung eine Rolle spielen. Vielen Dank.
Tsvetelina Penkova
Thank you. We don't have the shadow from the Patriots present in the room, so we're going to move to ECR with Mr. Diego Solier. You have the floor for three minutes.
Diego Solier
Thank you, President. I'm going to speak in Spanish. Gracias, Presidenta, y muchas gracias a la señora Gregorová por todo el trabajo que está realizando. Desde ECR compartimos plenamente el objetivo de esta propuesta, lo que es reforzar la seguridad de nuestras cadenas de suministro TIC y dotar a ENISA de las herramientas necesarias para responder a un entorno de amenazas mucho más complejo. La cuestión no es si debemos actuar, la cuestión es cómo hacerlo sin sustituir el análisis de riesgo por automatismos.
Nuestra primera prioridad es muy clara: la identificación de proveedores de alto riesgo debe ser individual, basada en pruebas y jurídicamente revisable. El país de origen, la propiedad, el control pueden ser elementos relevantes, pero no deben sustituir la evaluación concreta del proveedor. Si existe un riesgo real, hay que demostrarlo. Segunda prioridad: la proporcionalidad.
Una prohibición debe ser el último recurso y no el primero. Primero evaluamos el riesgo, después vemos si se puede mitigar ese riesgo mediante medidas técnicas, operativas o contractuales y solo cuando esas medidas no sean suficientes debemos pasar a una prohibición. Ese enfoque no debilita nuestra seguridad, la hace más sólida porque obliga a justificar cada decisión. Tercera prioridad: certificación útil, no burocracia adicional. La certificación europea debe seguir siendo voluntaria como regla general, especialmente para evitar costes innecesarios, sobre todo para pymes e innovadores.
Y cuando una empresa ya ha demostrado cumplimiento mediante un esquema equivalente, no tiene sentido obligarla a repetir esos mismos ensayos, auditorías y procedimientos. Cuarta prioridad: necesitamos una ENISA más fuerte, pero también una arquitectura institucional clara. ENISA debe complementar a los CSIRTs y a las autoridades nacionales, no nunca duplicar su trabajo. Y debemos preservar los derechos de los Estados miembros en relación con los intereses esenciales de seguridad, incluido el artículo 346 de los Tratados. Querida Gregorová, vemos bastante terreno común.
Queremos una evaluación individual, transparencia, revisión periódica y debido proceso. ECR quiere trabajar sobre esa base.
Pero nuestra posición es sencilla: evidence before restriction, mitigation before prohibition and security without unnecessary bureaucracy. Gracias.
Bart Groothuis
Thank you, Chair. And before I thank the rapporteur for an excellent report, good starting point, I would like to thank the European Commission, which is also present here, which is much appreciated, as the Deputy Director-General here. It's a good report. And in 2020, the European Commission tried to put forward the 5G toolbox. And the 5G toolbox was soft law, and the European Court of Auditors looked at it and it says, this is not working.
This is not about technical risks. It's about non-technical risks. The non-technical risks entail that Chinese law obliges any company to compel with any request of the Chinese intelligence community. Chinese law obliges companies to give security vulnerabilities, such as software vulnerabilities and zero-days, exclusively to the Chinese government so they can use and leverage it exclusively. And above all, since last Thursday, the Chinese military is in control of technology and data here in Europe when President Xi would decide to mobilize its army.
We have to take that into account. So I would like to say this is our chance to make supply chain security enforceable here at EU level.
So thank you for that proposal. On the rapporteur, a very welcome start. I'd say a very, very welcome. I think that we support your way of phasing out 5G, fixed and satellite, long overdue, like I said. But, and we also support your certification proposals, but like the EPP, we have some doubts on the mandatory, the mandatory schemes.
For ENISA, it's very obvious that they should become a cybersecurity agency with AI in its core. An AI cybersecurity agency, which is not in the mandate now. So we're putting forward significant amendments to make sure that ENISA is on the top branches in a world when it comes to AI. The phasing out of high-risk vendors. For us, that's significant to do.
But it's about timing. If we start from step one in the current proposal, then there will be no European competitive left. So I think that you already, the European Commission has already said that Chinese competitors can no longer fund for EU funding and for Horizon funding. We have the, we have everything in place. Now do it, and as fast as possible.
And the same goes for PV inverters. Inverters in our electricity grid, but also about battery technologies, battery management systems.
They are equally vulnerable for our society, and I would like to see that in. Last thing I'd like to point out is that the EC, this law is not just this law. This law has references to the ECF, to the IAA. It has references to the business wallet. It has references to the single market and customs program.
This is the basis for those safety nets in those legislative files. So I guess that country designation, designating a country as high risk is essential for us to keep it in. And the Parliament should be bold on this because this is the safety net in all these legislative framework. It's not small beer, like I say. I look forward to working with rapporteur and other shadows to strengthen the ambition in the proposal.
And thank you again, rapporteur, for the excellent report you put forward.
Tsvetelina Penkova
Thank you. We have no speaker from the Left, so we're moving to ESN with Mr. Markus Buchheit. We have it noted. No, okay, I don't see any reaction, so I assume we don't have anyone from ESN then. I'm reminding you that now is the time for the catch-the-eye interventions if anyone wants to jump in.
I don't see. Okay, so in that case we move to the opinion-giving committees and as I've already mentioned, we have the rapporteur from IMCO, Madame Guzenina, you have the floor for two minutes.
Maria Guzenina
Thank you, dear Chair. To begin with, I thank rapporteur Markéta Gregorová for the good work she's doing and all the other members of this committee, including the members of my own committee where we've worked really closely on this file because it's of uttermost importance at this moment. At the moment in IMCO, the negotiations are still ongoing. We have one thing that we need to resolve. All the other matters are more or less tucked in, but it's about the mandatory or voluntary approach to the certification.
And I see that in this committee also, you have not found unanimous approach to this very important issue.
Maria Guzenina
I believe that the system in Europe at the moment is too fragmented. And we cannot rely on the companies' own announcements whether they are reliable or not. And therefore in IMCO I am proposing that we have a mandatory certification for the most critical parts. I think if we can resolve this matter in IMCO in a favorable way and the message comes to this committee as well, maybe that will be of help to Madame Gregorova's rapporteurship as well, because as we are facing every day our governments, our hospitals, energy networks, banks and companies, cyberattacks, this is the reality we're living in at the moment. And it's only going to get more difficult with quantum.
We need to be prepared for this and therefore the mandatory certification for the most critical parts that are covered in this legislation. I think in the future we will look back to this process here in European Parliament and if we can find agreement on mandatory for the most critical we will be proud of ourselves. Because then we're protecting our businesses, we're protecting our citizens and we're also protecting our democracy. Thank you.
We need to be prepared for this.
Tsvetelina Penkova
Thank you so much. We don't have a speaker from the other opinion giving committee but so the time we're moving quite well with the time and now I would like to invite the Commission representative Madam Despina Spanou. Thank you for being here with us. Please you can have the floor for for two three minutes of course we're going to be generous with the time unless you need it. Thank you.
Thank you. Well you're being generous with us today with this report. Thank you very much honorable members. Congratulations to the rapporteur and the shadow rapporteurs and to the rapporteur from the IMCO committee as well. This is a very important milestone that we are reaching.
Despina Spanou
Since we made this proposal in the early parts of this year, in January 2026, we have only seen things going worse in the area of the threat landscape, with growing geopolitical tensions, rapid technological developments. We have recent incidents that demonstrate we are in another era of cybersecurity. We have no longer only traditional IT systems being hit. We have compromise of AI platforms. We have independent AI agents that attack systems by themselves.
They exploit vulnerabilities. They steal credentials. We have ransomware attacks to hospitals, healthcare suppliers. So I think we're all called here to do something with the CSA that is even bigger than what we aimed to do when we tabled the proposal as European Commission. So we welcome the occasion of today.
Despina Spanou
We welcome this report, which follows the lines of the proposal of the European Commission. I will start like the honorable rapporteur started with the supply chain framework. If you want to deal with external threats, you have to start working from within. And this is what this proposal is about. It is about making sure that high-risk suppliers do not dominate some of our most critical infrastructure, which is the case today.
If you take the example of 5G, we started already seven years ago the removal of high-risk suppliers through a voluntary toolbox. We have 13 member states that have already implemented de-risking to a larger or smaller extent, but they have done. Some member states have completely removed high-risk suppliers, including the current presidency of the European Union. And this is an example that we already take forward, but there are more. And yes, why not add certain markets that we didn't have enough to add in the annexes when we made our proposal, but indeed certain areas mentioned by the rapporteur merit consideration.
The supply chain framework needs to be operational. What is very important and what I would like to share with you is that also at the level of the member states, we see great support. When you go to the Council of Ministers, you do not hear a single minister saying we do not need this framework. So there we can really go fast. The devil is in the details.
Despina Spanou
It is how we're going to do it, maintaining an approach about the criteria concerning certain countries that pose cybersecurity concerns is an essential element of this proposal. So we will need to find a way, and we will act as the honest brokers as always, for this to be maintained, always aiming at not destabilizing the markets, finding alternatives.
We need to accompany whatever we do in the supply chain, whatever we de-risk, we need to accompany with support measures. That is evident. We're not going to leave our markets hanging without suppliers. So this is a holistic approach. That's why it is important that we advance because it also has a geopolitical dimension.
Everybody's watching that part of the proposal, the supply chain and how we're going to do it, and our suppliers are also looking at it for the credibility of their supply chains and for the stability of the markets and the predictability of the markets. So there we will work with you, the Council, especially thanks to the Irish presidency. The minister is not here, but I know my colleagues from the presidency are listening. They've done a fantastic job. And if we arrive at a conclusion by the end of this year on this framework, I think we will have a very good basis to accompany you in the negotiations between the co-legislator.
Then on ENISA. We heard even proposals that ENISA should become even an artificial intelligence agency. Well, the news is that it has become that de facto, if I can use the legal expression. You know that recently we adopted an action plan on cybersecurity and artificial intelligence in the European Commission where ENISA plays a key role.
Actually, Europe wouldn't be able to do many things without this agency. And when we talk about the European Agency for Cybersecurity, we are reinforcing also all European agencies for cybersecurity because they run ENISA. We should not forget ENISA is not run by the Commission. Yes, we have a seat at the table at the management board, but it is run by the member states. So anything we do to reinforce ENISA, we reinforce all European cybersecurity agencies.
That has to be clear. There's no competition there. One becomes larger, the other ones become smaller. Everybody gets more support. And we are thankful for the support of the rapporteur and of many of you to the collaboration with Europol on cybercrime because cybersecurity has no silos.
You can't distinguish one type of attacks from another. Ransomware is a typical cybercrime. It continues to be the number one type of cyberattack in the European Union. So it is very important that we have this help through the collaboration with Europol and to see how we also offer help through the helpdesk on top of the help that member states, some member states may give, of course.
Despina Spanou
When it comes to ENISA, I would also like to say that the support to its resources is fundamental. ENISA is too small for what it is called to deliver and we are thankful also that you offer some further elements there. It is already doing a tremendous piece of work as I mentioned in the area of cyber and AI, but also in the area of certification and I come to that. As the honorable rapporteur from the Internal Market Committee mentioned, the certification is our tool for a European market, for what we are all here to serve. And this idea of a certification for cyber posture which will allow companies to prove in one go that they are compliant with European cyber rules is a fundamental part of our proposal.
So we are thankful also for the support that you have lent to that and we see a lot of support also in the Council, so I think there we can achieve a very solid agreement, if I may say so. On the issue of certification, standardization and all these issues, just to mention just a word on the technical specifications we would put in our proposal. At the end of this year, there is a very important instrument that comes to be implemented in the European Union, the Cyber Resilience Act.
What is the Cyber Resilience Act? It is the security by design for every interconnected product that circulates in our internal market. It is the act that says that this should not only have safety properties outside, but also inside. So for that to work, we need standards. And we are not going to have all the standards that we need.
This is why we have made this proposal for ENISA to be able to issue technical specifications that can help us advance with the implementation, that can help the operators advance with the operations of the Cyber Resilience Act. So just as a technical specification that is actually very substantial. And with that, Mr. Chair, I'd like to close. I'd like to thank you for the support you have offered to the proposal. We will remain the honest broker.
I think we're reaching really a very important moment for our security in Europe through this proposal, and we will be there together with the Irish presidency to see where we get and hopefully an agreement early in next year. Thank you very much.
Tsvetelina Penkova
Thank you. And now please do allow me to pass the floor back to the rapporteur for her final remarks for four minutes.
Markéta Gregorová
Thank you very much. Thank you to all the speakers, shadows, opinion givers. I am very happy to hear that we have a lot in common and a common ground, which is stronger European cybersecurity.
I would like to point out towards few issues that were mentioned. First of all, I very much agree with my Renew colleague Bart that AI vulnerability discovery has been turned upside down and very massively accelerated. And I plan to propose further amendments to my report which you will be receiving shortly or maybe received yesterday evening regarding inclusion of AI as a policy area and strengthening ENISA in this regard. Because although I agree with Despina it has started, of course ENISA deserves a proper mandate. As for the mandatory certification, I have seen that it caused some waves, so let me just briefly react to it.
The voluntary certification has been now tested for seven years and has delivered one scheme, although many other schemes were promised.
Since the EU adopted exactly one scheme, the products in 2024, the other two on cloud and 5G has been stuck in mostly political negotiations. So I do not think we can reasonably defend a model that failed on its own terms. Today also, companies certify if they are on the whole market up to 27 times. Under the report they certify once, with a free entry level for SMEs. So the burden falls, it doesn't rise.
And it's also nothing new, because NIS2 and CRA both empower the Commission to make certification mandatory by delegated act, and both texts passed by large majority, including all the groups here. So the question today is not whether certification can be mandatory, because it can, but if Parliament decides the scope now in the legislative text or leaves it to the Commission later. I am happy to discuss that further in our negotiations. Last but not least, allow me also small comment on what colleague from S&D mentioned. The electronic components are very interesting addition and I'm happy to talk about it further and potentially include it, because I agree that control of our critical infrastructure must be firmly in European hands.
And allow me to mention the recent almost catastrophe in German solar energy, which showed the potential danger. A hacker could have shut down hundreds of thousands of solar installations, thereby causing a widespread power outage. But fortunately, it was one of the good guys, a white hacker. Yeah, this time. It didn't have to be a good guy.
So I think with this we realize how big of a threat there really is and I am very much looking forward to working with all of you on this file. Thank you.
Tsvetelina Penkova
Thank you, thank you, Madam Rapporteur. And now we continue with the same similar topic, whereby moving to item number seven. We have almost the same team of parties involved on this one and we're going to be discussing for the next 15 minutes the amending directive 2022/2555 as regards simplification measures and alignment with the proposal for the Cyber Security Act 2. So without a further ado, please let me pass the floor back to Madam Markéta Gregorová to present the draft for two minutes and then the shadows will take the floor for one minute each.
Markéta Gregorová
Thank you again, Madam Chair.
Again, this is a targeted file which I would hope to follow the same logic as under CSA 2. There is a reason why those two are combined in sort of a one package and that would be report once and keep the scope meaningful. What does it mean when I say meaningful? That DNS providers stay in regardless of size. A small DNS provider can take down services just as a large one can.
The long-term care providers and chemical distributors come back in. Both hold assets where an incident hits vulnerable people or critical supply. As for the supply chain, Article 21.5 moves from implementing to delegated acts, so Parliament has scrutiny. New guidelines on supply chain security with protection for open source developers. Ransomware reporting should have a purpose limitation, no penalty for reporting, encryption end-to-end, of course, and deletion periods.
Entities report when they can trust the channel, which is very important and currently very low on the European market, talking to various cyber security involved organizations.
Markéta Gregorová
And last but not least, the cyber posture certificate will be valid in all Member States, not subject to 27 national decisions. I, of course, welcome any amendments from my colleagues, but let's also keep in mind the very important point with NIS2 revision. In many Member States, it has not been implemented yet, and as such, there is a huge portion of unpredictability. And the amount of complaints I've been hearing about already difficulties that some companies face when implementing NIS2, and now hearing about us revising NIS2 and them not knowing if they should pause the implementation or start predicting what we will implement, this is not the environment we should be creating for our companies. So let's really keep a tight focus on the target, simplify, yes, but with a good predictability for our companies.
Thank you.
Tsvetelina Penkova
Thank you. I will go now to the shadow rapporteurs for one minute each, and anyone who wants to take part in this debate, please put your nameplates vertically so we can include you after the shadows. And we're moving to EPP with Mr. Tobé.
Tomas Tobé
Thank you, Chair, and thank you, rapporteur, for your draft report. I think it is easy for us in this room to agree that the NIS2 directive is a cornerstone of the European cybersecurity acquis, but I'm fully on the line of the rapporteur. I mean, one of the main problems is that it is not fully implemented in Member States. We're not here to name and shame, but seriously, that is perhaps the main problem that we need to fix, politically at least. I think, I must say, when I have looked on the amendments from the rapporteur, and I must say that I think that they are ambitious, but at the same time actually mindful when it comes to the reporting burden for companies.
And this is actually a great mix, I would say, and this is a very good foundation for us in the upcoming negotiations.
We will of course table amendments. We will try to improve the coherence with the Cyber Security Act of course and other cyber security legislation. Of course, we're trying to even more reduce unnecessary duplication when when possible. I don't know if it is a smart idea what Commission has done to in a way to reopen this in parallel with the Digital Omnibus and the Cyber Security Act. But but let's see.
Let's work together. Perhaps it would have been good to have this in a more coordinated approach. But but let's do the work together now. I think that it's I think it's on the table now. And I think we are in the same we are on the same track here.
So let's get it done together. Thank you.
Jens Geier
Danke Frau Präsidentin. Nach dem Gesagten kann ich mich kurz fassen. Wir sind dafür, dass wir die notwendigen Änderungen, die wir im CSA identifiziert haben, für die NIS dann da auch übernehmen. Und wir sind der Meinung, dass die verpflichtende Zertifizierung dann da natürlich auch sehr gut passen würde. Dankeschön.
Thank you. Patrizia Toia not here. ECR, Mr. Solier.
Diego Solier
Gracias presidenta. Gracias señora Gregorová. Desde ECR apoyamos el objetivo de esta revisión: menos burocracia y más seguridad. Pero simplificar no debe significar centralizar. El mejor ejemplo es el nuevo punto único de notificación de incidentes.
Las empresas no deberían de tener que comunicar el mismo incidente varias veces a diferentes autoridades utilizando sistemas distintos. Pero para nosotros el modelo debe ser muy claro: un router y no un repositorio. ENISA puede facilitar el envío de información a la autoridad competente, pero no necesita almacenar el contenido de todos los incidentes europeos. Y tampoco debemos destruir los sistemas nacionales que ya funcionan. Si un Estado miembro dispone de una plataforma segura, interoperable y equivalente, debe poder conectarla al sistema europeo.
La idea es muy buena.
Simplificación significa reutilizar lo que funciona y no construirlo todo otra vez de nuevo. Segunda prioridad: proteger la información que pedimos a las empresas. Si queremos que una empresa informe rápidamente de un incidente o de un ataque, debemos darle confianza. No podemos pedirle información sensible para gestionar una crisis y después utilizar esa información para, de alguna forma, sancionarla. Si destruimos esa confianza, reduciremos la notificación y tendremos menos seguridad.
Y la tercera prioridad: la transición hacia una criptografía postcuántica, donde todos estamos de acuerdo en la dirección. Pero el Parlamento debe legislar sobre la realidad tecnológica de hoy, no sobre un calendario político. Hay sistemas críticos, especialmente en energía e industria, con ciclos de vida de muchos años. Por eso defendemos objetivos claros, ambiciosos, pero también un mecanismo transparente cuando un plazo no pueda cumplirse por razones técnicas reales.
En resumen, one report not five, secure routing not central storage, ambitious transition not impossible deadlines.
Tsvetelina Penkova
Thank you. We're moving to Renew with Mr. Morten Løkkegaard for one minute.
Morten Løkkegaard
Thank you, Chair. And thank you to the rapporteur. I share the view of most of you. This is a critical moment for us. I think that we need this piece of legislation and I think we need harmonization most of all.
For those of us who negotiated NIS2 some years ago, it's quite a mystery that so many countries still haven't implemented this. I would share the view of the EPP colleague that this is by far the biggest problem right now, that we are coming up with yet another revision of this and most companies that I talk to do not even know what the status is right now. And coming from Denmark, we are even some steps further than most countries. So it is a big, big problem and I think we have to, but that's a different discussion, but we have to as a Parliament face this issue about lack of implementation in all our Member States.
It's a really, really big problem. Oh, well, anyway, to coming to this particular issue, I think that this is a nice draft report. I think of course this the targeted update should should make the rules clear as you as you rightly say, simplify compliance and ensure that NIS2 is implemented more consistently across the Union. That's a no-brainer, I guess. Given the difficulties and national divergences that have emerged, we must deliver swiftly and and with real impact.
So far so good. The draft report contains several positive elements, particularly on harmonization, supply chain guidance and avoiding duplicate reporting. However, we are as a group concerned about certain parts, including the deletion of the proposed scope clarifications. Our amendments include a report once approach, as some of you have mentioned, protection of sensitive company information and practical support for the transition to post-quantum cryptography. We are also examining further concrete measures to strengthen cybersecurity for citizens and businesses.
Increased cybersecurity does not have to mean increased burdens. I guess we can all agree on that, so let's let's move on that on that track.
Just a word on the certification discussion. We still have concerns, we are still skeptical towards the mandatory approach, but of course we will take up the discussion, including the information that the rapporteur gave on this issue. I think it needs a thorough discussion, and we are of course prepared to go into that. But our starting point is that we don't need an extra layer of to make things even more complicated to businesses, so let's have a thorough discussion on that. But I look forward to the discussions.
Tsvetelina Penkova
Thank you. Thank you, I see that we have Mr. Groothuis who wants to take the floor in the catch-the-eye, and that's it, so please for one minute.
Bart Groothuis
Thank you very short, thank you to all, and as the initial NIS2 rapporteur, I don't want to be judge and jury in my own case, so I'm glad that you do. But I have two short requests.
When we convene in Brussels and we have our phones with us and we click on a malware domain, we get a red screen by the Belgian providers saying this is malware, there's net neutrality, you can do whatever you want, you can click, but it's malware, don't. Which is a good way to support citizens, right? But when we're in France, in Strasbourg, and we click on the same malware domain, it serves you malware, it infects your phone. What I want to see in Europe is we get into the daily lives of our citizens protecting them, that all providers feel a clear legal framework to block malware domains across Europe. We have an NIS2 ecosystem which provides with the domains curated and then make sure that we do it.
The second thing I'd like to put forward, and I will put forward an amendment for that. The second I'd like to say is when I was in Ukraine, I learned that Ukraine treats water, telco, the critical infrastructure as sovereign infrastructure. Of course American firms, they operate there and they keep the critical infrastructure safe.
They have telemetry, they have logging, they do that. But what the Ukrainians say: this is our sovereign infrastructure. We want from all logging and telemetry, all cybersecurity data on our own infrastructure, we want a carbon copy, a CC of that to our CSIRT. We want to see what is going on on our own infrastructure. And with all these hybrid attacks, I believe this is what we should do in this phase of the European cybersecurity legislation.
So I'll put forward an amendment to say we need logging and telemetry from these American and Israeli firms to our own CSIRTs. Thank you very much. It's a matter of sovereignty. Thanks.
Tsvetelina Penkova
Thank you. Now I will invite again the Commission representatives, Madame Despina Spanou, the Deputy Director-General at DG CONNECT, to take the floor for one minute, but please stick to the time because we're already kind of behind our agenda.
I will, Madam Chair. Thank you very much for giving us the floor and thank you for the comments. The honorable member Mr. Tobé said we don't know if it's smart that we opened this. The intention was not to open, just a clarification. This is part of our simplification exercise.
Despina Spanou
It was just adopted together with the proposal for the Cybersecurity Act at the same time because there is a certain coherence. It is part of helping our providers to implement our flagship legislation, the NIS2, which is the best cybersecurity law probably in the world and the first of its kind. So it is about implementation and clarification. Imagine that today if you're a hotel and you have one solar panel, you qualify as a critical infrastructure entity under the NIS. This is part of the clarification that we wanted to provide.
If you're a supermarket selling washing liquids, they qualify as chemicals, you fall under the NIS too.
This was not the purpose. It was not to flood the regulators and those that enforce the rules with this kind of obligations. It was about targeting the right operators for critical infrastructure. So this is the kind of clarifications we provide. One last thing on implementation.
We have referred recently three countries to the European Court of Justice because they did not implement NIS2 yet. We have one country that is almost complete and all the others have done their job. So we are finally, finally there, I would say, almost. Thank you very much, Mrs. Chair.
Tsvetelina Penkova
Thank you, thank you, Madame Spano. And now I'll pass the floor back to the, to our rapporteur, Madame Gregorova, for her final remarks for a minute, please.
Markéta Gregorová
Yes, thank you, Madame Chair. Thank you to the shadows, of course, former authors and the Commission. As I said, NIS2 and CSA2 move together with the same reporting logic, same timetable, and the single entry point only works if both texts say the same thing. So that's what I think we should aim for.
Of course, most of the NIS2 amendments are technical, but where they are political on scope and ransomware, I am happy to further discuss with the shadows in the future. Thank you.
Tsvetelina Penkova
Thank you. As a conclusion of those two items, the proposal for the Cyber Security Act 2 and the simplification measures, please note that the deadline for amendments for both is the 13th of October at noon. And now we move to item number eight, which is on the amending directive 2018/2001, I'm not going to list them all, with regards to acceleration of permit-granting procedure. The trilogue, the second trilogue on permitting directive took place two days ago on the 6th of October in the afternoon here in Strasbourg. And now I would invite the rapporteur from the Parliament, Mr. Fuglsang, to take the floor and present the developments on the file at this stage in the trilogue process.
Niels Fuglsang
Thank you, Chair, and thank you also for chairing the trilogue two days ago here in Strasbourg.
We're talking about the permitting directive part of the grid package, which aims to speed up the permits for renewable energy and for grid infrastructure. We know that we have pretty big problems here because it can take up to nine years to get a permit for wind turbines to establish wind turbines in Europe, and also it takes on average five years to get permits for building transmission grids in Europe. So that's, of course, not a very good situation. It's unacceptable, and we need to do it faster. And so that's what we are negotiating.
We had, as you said, a trilogue two days ago, the 6th of October, here in Strasbourg, and I think we're making good progress with the Irish presidency. We are discussing, we did discuss at the trilogue, which was the second trilogue with the Irish presidency, the questions on introducing overriding public interest for grid projects and renewable energy, the question of exempting repowering of renewable energy and repowering refurbishment of grids from certain environmental assessments. We discussed the use of digitalization to make the permitting process digital instead of using large stacks of physical paper.
We also discussed the question on benefit sharing and independent facilitator. These questions are about involving the local communities and making sure that they have a share of the benefits so that they also will accept to a larger degree the build-out of energy projects. And we discussed the questions of certain exemptions, question of whether we should have exemptions in general for environmental legislation, different pieces of environmental legislation, also nitrogen legislation, that in some cases when you build renewable energy projects you emit nitrogen in building them, but in the long run you will actually reduce the emissions of nitrogen because you will have a cleaner form of energy. And finally we discussed the question of adequate resources to make sure that member states have the adequate resources in their administrations to process the permitting.
On all these topics, I believe we we made good progress. We are not closing a deal, of course, yet, but we'll have the third trilogue on the 17th of November. And we made a good plan, I believe, for for getting there and for for finding an an agreement on these points. We are still some way from each other on certain areas, for example, on digitalization, where we, the Parliament, want a digitalized process, while the the Council stands more firm on on a point of view where they say they don't want to have obligatory, mandatory digital processes, which is hard for us to understand because we really think that this could speed up the permitting process. But that's one of the things where we disagree, but we we're working in a constructive manner.
Also, thank you to the good colleagues here, the shadow rapporteurs from all the political groups, really, in the Parliament. So I'll keep you updated. And message is that we are we're working in the same direction, which is to speed up the permit. Everybody agrees on that, so that's why I think we might be able to to find each other. Thank you.
Tsvetelina Penkova
Thank you, Niels, and and good luck with this very very important piece of legislation, a key part of the the grids package, on which we are working on together, which easily moves me to item number nine on our agenda, where I'll report back on the first trilogue on the TEN-E regulation, which is quite related to what we were just discussing on the permitting directive, one of the big priorities of this of this House.
I will be very brief, simply because we just had the the first trilogue on the TEN-E revision on the 30th of September. So basically, it was the formal meeting to launch the inter-institutional negotiations and allow the Parliament, the Council, and the Commission to present their key priorities and positions. On behalf of the Parliament, we did emphasize that the revision must help Europe develop infrastructure that is more secure, resilient, and leads to more affordable energy system. Our mandate, as we are all aware, seeks to strengthen the European dimension of the infrastructure planning and to ensure that the investment to respond to the identified needs and benefit clearly our citizens and industry. The Council on their on their side also underlined the importance of effective planning, network security, resilience, and facilitating the infrastructure development.
The exchange did show that on a broader level, we do share very similar objectives, while differences remain between some of the approaches we're going to be undertaking, but this just requires a bit more work at the technical level and of course at the political political debate.
Everyone on the table agrees that we need to move fast with this regulation, so we are quite committed to be able to finish the negotiations by the first week of December as it's planned so far. I would like to thank the shadow rapporteurs and our technical teams for their preparation, cooperation and a very, very constructive work so far, and let's keep that good spirit and atmosphere until we are ready with the regulation. And I will continue to engage constructively with the Council and Commission on the basis of the Parliament's mandate and will keep the members of the committee informed of how the developments are ongoing. I'll stop here. Thank you.
I don't see any more desires for interventions. As we said, item number 10 has been cancelled. Any other business? I don't see anything. The next meeting of this committee is going to take place on the 19th of October in Strasbourg in the evening.
This is still TBC, but just keep in mind for your agendas that next session on Monday evening. Have a nice day, good luck with the votes and with the travels today.
Ask anything about this video — I analyse its transcript to answer.