WHAT IS THE AIM OF THE REGULATION?
Regulation (EU) 2025/38 aims to strengthen the European Union’s (EU) capacity to detect, prepare for and respond to cyber threats and incidents. It lays down measures at the EU level to enhance situational awareness, reinforce preparedness, support coordinated responses and enable structured post-incident reviews, in order to safeguard critical services and increase the overall resilience of the EU.
KEY POINTS
Scope and purpose
The regulation’s general objective is to strengthen solidarity at the EU level while reinforcing the competitive position of industry and services in the EU across the digital economy and contributing to the EU’s technological sovereignty and open strategic autonomy in the area of cybersecurity.
This objective is implemented via three key pillars.
1. European cybersecurity alert system
This system is designed to improve near real-time situational awareness and detection of cyber threats across the EU and consists of:
- national cyber hubs, designated by EU Member States;
- cross-border cyber hubs, established by consortia involving at least three Member States.
These cyber hubs1 detect, analyse and exchange cyber threat intelligence and are supported by advanced tools such as artificial intelligence and data analytics. Funding is implemented by the European Cybersecurity Competence Centre (see summary) (joint procurement of tools, infrastructure and services and grants for their operation).
To ensure effective cooperation, the European Union Agency for Cybersecurity (ENISA) was required to develop interoperability guidelines, including common formats and protocols, by 5 February 2026. The cooperation agreements that cross-border cyber hubs conclude between themselves must be based on these guidelines.
2. Cybersecurity Emergency Mechanism
This mechanism enables coordinated EU support to prepare for and to respond to significant2, large-scale3 and large-scale-equivalent4 incidents, thereby reinforcing the EU’s resilience and solidarity among Member States. It includes the following areas.
-
Preparedness measures, such as:
- the coordinated preparedness testing of entities operating in sectors of high criticality;
- support for other preparedness activities for entities in sectors of high criticality and other critical sectors, including vulnerability monitoring, risk assessments, exercises and training.
-
The EU Cybersecurity Reserve, consisting of incident response services provided by trusted managed security service providers selected through EU procurement procedures.
The reserve supports Member States, EU institutions and competent authorities in non-EU countries associated with the digital Europe programme (DEP), if their DEP association agreement provides for such a possibility and whose participation must be authorised by the Council of the European Union in addressing such incidents.
Requests for deployment of the EU Cybersecurity Reserve may be submitted by:
The European Commission has overall responsibility for the EU Cybersecurity Reserve’s implementation and entrusts the administration and operation of the Reserve to ENISA. The contracting authority (the Commission or ENISA, where applicable, for requests by Member States and by EU institutions, bodies and agencies) decides whether and to what extent to deploy support based on the incident’s scale and severity, the type of entity affected, the potential impact of the incident on the Member States and users affected, the cross-border nature and risk of spillover, and the mitigation measures already taken. The contracting authority must respond within 48 hours.
The requests from DEP-associated non-EU countries are assessed by the Commission.
- Mutual assistance, in which Member States provide technical support to each other in response to significant or large-scale cybersecurity incidents, with EU financial support.
3. European Cybersecurity Incident Review Mechanism
After significant or large-scale cybersecurity incidents, the Commission or the European Cyber Crisis Liaison Organisation Network (EU-CyCLONe) may request a structured review to assess causes and impacts, evaluate the response and extract lessons learned. The review:
- is conducted by ENISA with the support of the computer security incident response teams network and with the approval of the Member States concerned;
- results in a report containing findings and, where appropriate, best practices, lessons learned and non-binding recommendations to improve the EU’s cyber posture.
ENISA may publish a public version of the incident review report, containing only reliable public information or other content with the consent of the affected Member States or parties, subject to confidentiality rules.
Implementation and roles
- The Commission oversees the overall implementation of the regulation, including the EU Cybersecurity Reserve. For the Reserve, it should entrust ENISA, fully or in part, with the operation and administration of the Reserve via a contribution agreement.
- The European Cybersecurity Competence Centre manages grant-based preparedness measures and the deployment of national and cross-border cyber hubs. It must update its mapping of necessary tools, infrastructure and services at least every two years.
- ENISA coordinates the European Cybersecurity Incident Review Mechanism, is entrusted, fully or in part, with the administration and operation of the EU Cybersecurity Reserve and should regularly map the services needed for the EU Cybersecurity Reserve.
Funding
The regulation is financed under specific objective 3 (‘Cybersecurity and trust’) of the DEP.
Additional rules
- The Commission may adopt delegated acts to define the types and number of services to be provided under the EU Cybersecurity Reserve, based on evolving threats and available capabilities.
- Information sharing under the regulation must comply with rules on confidentiality and proportionality, and should not be contrary to Member States’ essential interests of national security, public security and defence.
- Procurement from non-EU-controlled entities may be permitted only under strict conditions, where no adequate EU-based alternatives exist and security interests are protected. The DEP work programme provides for conditions and rules regarding eligibility.
- By 5 February 2027, the Commission must report to the European Parliament and the Council on the implementation and effectiveness of the regulation.
FROM WHEN DOES THE REGULATION APPLY?
The regulation has applied since 4 February 2025.
BACKGROUND
The Cyber Solidarity Act complements existing EU cybersecurity legislation, such as the NIS2 Directive (see summary) and the EU Cybersecurity Act (see summary). It adds operational instruments for preparedness, early threat detection and coordinated response at the EU level, aimed at addressing increasingly complex and cross-border cyber threats. It also amends Regulation (EU) 2021/694 to provide the legal and financial basis for implementing the new mechanisms introduced by the act.
For further information, see:
KEY TERMS
-
Cyber hub. A designated national or multi-country centre that detects, analyses and shares cyber threat intelligence in near real time, supporting prevention and improved awareness of cybersecurity threats across the EU.
-
Significant cybersecurity incident. An incident is considered to be significant if it has caused or could cause severe operational disruption of the services or financial loss for the affected entity, or considerable material or non-material damage to others.
-
Large-scale cybersecurity incident. An incident that causes a level of disruption that exceeds a Member State’s capacity to respond to it or that has a significant impact on at least two Member States.
-
Large-scale-equivalent cybersecurity incident. In the case of EU institutions, bodies, offices and agencies, a major incident, and, in the case of DEP-associated non-EU countries, an incident that causes a level of disruption that exceeds the capacity of the country concerned to respond to it.
MAIN DOCUMENT
Regulation (EU) 2025/38 of the European Parliament and of the Council of 19 December 2024 laying down measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cyber threats and incidents and amending Regulation (EU) 2021/694 (Cyber Solidarity Act) (OJ L, 2025/38, 15.1.2025).
Successive amendments to Regulation (EU) 2025/38 have been incorporated into the original text. This consolidated version is of documentary value only.
RELATED DOCUMENTS
Statement by the Commission (OJ C, C/2025/310, 15.1.2025).
Regulation (EU, Euratom) 2023/2841 of the European Parliament and of the Council of 13 December 2023 laying down measures for a high common level of cybersecurity at the institutions, bodies, offices and agencies of the Union (OJ L, 2023/2841, 18.12.2023).
Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) (OJ L 333, 27.12.2022, pp. 80–152).
See consolidated version.
Regulation (EU) 2021/887 of the European Parliament and of the Council of 20 May 2021 establishing the European Cybersecurity Industrial, Technology and Research Competence Centre and the Network of National Coordination Centres (OJ L 202, 8.6.2021, pp. 1–31).
Regulation (EU) 2021/694 of the European Parliament and of the Council of 29 April 2021 establishing the Digital Europe Programme and repealing Decision (EU) 2015/2240 (OJ L 166, 11.5.2021, pp. 1–34).
See consolidated version.
Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) (OJ L 151, 7.6.2019, pp. 15–69).
See consolidated version.
