Where the law stands, Dossier 2026/0011(COD)
European Union Agency for Cybersecurity (ENISA), the European cybersecurity certification framework, and ICT supply chain security and repealing Regulation (EU) 2019/881 (The Cybersecurity Act 2)
Ordinary legislative procedure (COD): Parliament and the Council decide together as equals. · First reading
A proposed EU law. Parliament and the Council must agree on the same text: Parliament adopts its position, then negotiates with the Council.
Where it stands
Committee work
In committee: ITRE (Industry, Research and Energy) is preparing the report (draft published 18 September 2026).
- Referred to committee(done) 25 March 2026
- Committee work ITRE (Industry, Research and Energy) preparing the report
- Tabled for plenary(to come)
- Plenary vote(to come)
- Negotiations with the Council(to come)
- Published as law(to come)
No plenary decision on this dossier is in our records yet.
Who works on it
- Lead committee
- Industry, Research and Energy
- The MEP who drafts the report and negotiates it on behalf of the committee.
- Markéta Gregorová (Greens)
- An MEP who follows a report on behalf of their own group when another group holds the rapporteur.
- Tomas Tobé (EPP), Jens Geier (S&D), Aleksandar Nikolic (Patriots), Diego Solier (ECR), Bart Groothuis (Renew), Marc Botenga (The Left), Markus Buchheit (ESN)
- Committees giving an opinion
- Internal Market and Consumer Protection· rapporteurMaria Guzenina (S&D)
The text, version by version
Newest first.
Committee draft· 18 Sept 2026
Timeline
Newest first.
Committee stage 2 steps
18 September 2026
Draft report published
The rapporteur’s first text in ITRE (Industry, Research and Energy). Members can table amendments before the committee votes.
25 March 2026
Referred to the ITRE (Industry, Research and Energy) committee
The lead committee prepares the report; IMCO (Internal Market and Consumer Protection) gives an opinion.
Official record: Legislative Observatory, 2026/0011(COD)