EU Proposal to Expand Cybersecurity Act and Restrict High-Risk Technology Suppliers

The European Commission unveiled a revised EU Cybersecurity Act proposal that would allow the bloc to identify and potentially exclude “high-risk” suppliers—including those deemed vulnerable to third-country influence—from critical digital infrastructure across 18 essential sectors. The proposal also aims to streamline and accelerate EU-wide cybersecurity certification, reflecting a shift toward treating supply-chain security as both a technical and geopolitical risk-management issue.

Reporting highlighted that the proposal, while not naming countries, is widely viewed as targeting Chinese vendors and supply dependencies—particularly around network equipment and connected energy technologies such as solar inverters that may connect to cloud services and create potential access paths into the energy grid. Separate coverage of the same Commission initiative noted plans to expand ENISA’s mandate, including closer operational cooperation with national authorities to help counter threats such as ransomware, but emphasized that the proposal still requires negotiation and approval by the European Parliament and member states before it can take effect.