Today I spoke at the extraordinary meeting of the European Parliament's Committee on Industry, Research and Energy (ITRE) on two fundamental files: the proposed Cybersecurity Act 2, which addresses the role of ENISA, European certification and the security of ICT supply chains; and the revision of NIS2 to simplify obligations and align both frameworks.
In both debates I defended the same idea: strengthening our security requires justified decisions and rules that work, not automatisms or new unnecessary burdens.
Assess the risk before restricting
Europe needs to protect its technological supply chains. But identifying a supplier as high-risk must be based on an individual assessment, on evidence and on decisions that can be reviewed legally.
A company's country of origin, ownership or control may be relevant factors. They must not replace concrete analysis. If a risk exists, we must prove it.
We must also act with proportionality: first assess, then check whether the risk can be mitigated through technical, operational or contractual measures and, only when these are insufficient, resort to a ban. Mitigating before banning does not weaken security: it forces every decision to be justified and makes it more robust.
I have also argued that European certification should remain voluntary as a general rule and that duplicate tests and audits should be avoided when a company has already demonstrated compliance through an equivalent scheme. We need a stronger ENISA, but one that complements national authorities and incident-response teams, without duplicating their functions and while respecting member states' competences in security matters.
Report once, not five times
The simplification of NIS2 must solve a practical problem: a company should not have to report the same incident several times to different authorities.
That is why I support a single point of notification, but with one clear condition: it must function as a secure submission channel, not as a central warehouse of all European incidents. ENISA can help information reach the competent authority without needing to retain all of its content.
And if a member state already has a secure, interoperable and equivalent platform, we should make use of it. Simplifying means reusing what works, not building everything anew.
We also need to protect the trust of those who report. We cannot ask a company for sensitive information to manage a crisis and then automatically use that same information to sanction it. If we discourage reporting, we will have less information and less security.
An ambitious and viable post-quantum transition
The transition to post-quantum cryptography is necessary. But the timelines must take technological reality into account, especially in critical energy and industrial systems with long life cycles.
I defend ambitious objectives, transparent monitoring and accountability for those who could migrate and do not. Also a clear mechanism for cases where there are real technical impediments. A deadline impossible to meet does not improve our protection.
My position is simple: evidence before restrictions, mitigation before bans and simplification without unnecessary centralization. Europe will be safer if we build a demanding, proportionate framework that is able to work in practice.
In both debates I defended the same idea: strengthening our security requires justified decisions and rules that work, not automatisms or new unnecessary burdens.
Assess the risk before restricting
Europe needs to protect its technological supply chains. But identifying a supplier as high-risk must be based on an individual assessment, on evidence and on decisions that can be reviewed legally.
A company's country of origin, ownership or control may be relevant factors. They must not replace concrete analysis. If a risk exists, we must prove it.
We must also act with proportionality: first assess, then check whether the risk can be mitigated through technical, operational or contractual measures and, only when these are insufficient, resort to a ban. Mitigating before banning does not weaken security: it forces every decision to be justified and makes it more robust.
I have also argued that European certification should remain voluntary as a general rule and that duplicate tests and audits should be avoided when a company has already demonstrated compliance through an equivalent scheme. We need a stronger ENISA, but one that complements national authorities and incident-response teams, without duplicating their functions and while respecting member states' competences in security matters.
Report once, not five times
The simplification of NIS2 must solve a practical problem: a company should not have to report the same incident several times to different authorities.
That is why I support a single point of notification, but with one clear condition: it must function as a secure submission channel, not as a central warehouse of all European incidents. ENISA can help information reach the competent authority without needing to retain all of its content.
And if a member state already has a secure, interoperable and equivalent platform, we should make use of it. Simplifying means reusing what works, not building everything anew.
We also need to protect the trust of those who report. We cannot ask a company for sensitive information to manage a crisis and then automatically use that same information to sanction it. If we discourage reporting, we will have less information and less security.
An ambitious and viable post-quantum transition
The transition to post-quantum cryptography is necessary. But the timelines must take technological reality into account, especially in critical energy and industrial systems with long life cycles.
I defend ambitious objectives, transparent monitoring and accountability for those who could migrate and do not. Also a clear mechanism for cases where there are real technical impediments. A deadline impossible to meet does not improve our protection.
My position is simple: evidence before restrictions, mitigation before bans and simplification without unnecessary centralization. Europe will be safer if we build a demanding, proportionate framework that is able to work in practice.
