Parliament and Council negotiators failed to reach a final agreement on the Cybersecurity Act at their meeting on Wednesday 28 November. They therefore agreed to meet on 10 December for a final trilogue. Two to three more technical meetings are expected to take place between now and then (see EUROPE 12146).
As a reminder, the draft regulation, presented in September 2017, strengthens the duties of the current European Union Agency for Network and Information Security (ENISA) and establishes a European Cybersecurity Certification Framework (see EUROPE 11865). The co-legislators hoped to reach agreement on this text at their fourth meeting on 28 November. However it was not possible to resolve all outstanding issues in one hour.
According to our information, the co-legislators have managed to resolve some issues during this period, such as the frequency of cybersecurity exercises (Article 6). Although they have not yet reached a solution on the governance of the European Cybersecurity Certification Framework (Articles 20a and 43b) and the involvement of stakeholders or on the mandatory nature of the system (Article 48a). On the latter issue, it is important to qualify the content of the mandate given to the Austrian Presidency on 23 November with regard to what we indicated in EUROPE 12146 (i.e. that the Council could be ready to consider a mandatory system after assessment by the Commission): the last compromise states that "the Council could be ready to consider to foresee a possibility in future legislation after assessment by the Commission". The mandate of the Council’s Presidency requires the European Commission to take into account, in its study, the situation for non-certified products/services, the cost/benefit impact of the measures on manufacturers and users, the legislation in force, the results of a public consultation and the development of an implementation deadline and a transitional period.
As regards the other part of the proposal, the co-legislators are still discussing the technical capacity of the new Agency (Article 7a). The 4-pillar document is available at: https://goo.gl/KCvHck
(Original version in French by Sophie Petitjean)