Across the European Union's institutional landscape, lawmakers in the Parliament and Council are crystallising their positions on a dense cluster of regulatory proposals. Simultaneously, the Commission is preparing the groundwork for additional policy measures. The following overview captures the most significant regulatory movements affecting the RIPE community.

  • BEREC has initiated a public consultation on its Draft Work Programme 2027, featuring an updated report on IP Interconnection and a dedicated workshop examining IPv6 deployment.
  • The Digital Networks Act is generating substantial debate, with stakeholders raising alarms about scope, potential regulatory overlap and consequences for net neutrality and market competition.
  • Refinements to the Network and Information Security Directive 2 (NIS2) and a review of the EU Cybersecurity Act have entered the legislative pipeline, exposing disagreements on designating "high-risk suppliers", certification frameworks and ENISA's future responsibilities.
  • The Cloud and AI Development Act draft faces scrutiny from co-legislators, while member states develop national approaches to technology sovereignty and allocate resources for AI infrastructure expansion.
  • The European Commission released implementation guidance on the Cyber Resilience Act as new reporting obligations commenced.
  • A revised EU Standardisation Regulation proposal aims to reshape the development process for EU harmonised standards.
  • The forthcoming EU Quantum Act intends to strengthen quantum capabilities and may affect quantum-resistant cryptography adoption and national transition schedules.

BEREC Work Programme 2027

BEREC released its Draft Work Programme 2027, which addresses multiple strategic priorities including universal connectivity, strengthening the Digital Single Market and fostering environmentally sustainable, secure and resilient digital infrastructure.

The programme incorporates substantial input into ongoing policy discussions, notably the Digital Networks Act. It also introduces new analytical areas, such as examining how generative AI affects Internet openness.

BEREC will deliver a refreshed report on IP Interconnection to reassess and supplement prior analysis. Additionally, the body plans a Workshop on IPv6 Deployment to compile empirical data and operational insights on how organisations are rolling out Internet standards and protocols to enhance network scalability and security.

The draft programme is open for public feedback until 31 October, with formal adoption scheduled for early December 2026.

Digital Networks Act

The Digital Networks Act (DNA) proposal has appeared repeatedly in recent RIPE meeting agendas and will receive additional attention at RIPE 93 in Sofia.

In June, a joint statement endorsed by two co-chairs of the RIPE Cooperation Working Group and a wide range of civil society, consumer and industry partners articulated significant reservations about the DNA proposal's effects on net neutrality and the IP interconnection marketplace. The statement's signatories contend that merging the Open Internet Regulation into the broader DNA framework threatens to weaken fundamental net neutrality safeguards. They caution that the proposal strips away crucial interpretative language and risks subordinating net neutrality to other priorities such as network performance and business-to-business cooperation.

The joint statement also criticises Articles 191-193 for establishing "ecosystem cooperation" and dispute resolution mechanisms in the IP interconnection sector. Despite BEREC's conclusion that no market failure exists, the signatories argue these provisions remain poorly defined and introduce unnecessary complexity; they warn of potential "network fees" entering through indirect channels. The coalition urges EU co-legislators to preserve the Open Internet Regulation as a standalone legal text and eliminate it entirely from the final version.

The proposal will advance through European Parliament committee votes and Council deliberations in the coming months. BEREC has produced 19 thematic papers dissecting critical elements including scope, resilience and readiness, net neutrality and interaction with the Cybersecurity Act 2.0 proposal. The main recommendations emphasise greater alignment and streamlining to eliminate duplication and overlapping rules.

BEREC also released a report titled Europe's Telecom Reality Check, which presents an optimistic assessment of the EU telecommunications sector and challenges the notion that industry consolidation would drive increased investment. The report instead emphasises robust competitive pressures, reasonable pricing, expanded network coverage and healthy financial performance. Performance metrics differ across member states, though several nations are outperforming their global peers, according to the analysis.

NIS2 targeted amendments

Policymakers are working to refine the second Network and Information Security Directive (NIS2) through targeted amendments, concentrating on streamlining reporting requirements and clarifying which entities fall under the rules.

Proposed modifications include broadening the directive's reach to encompass additional organisation types (including digital identity and business wallet providers, submarine data infrastructure operators), reclassifying "small mid-cap" firms as Important Entities and exempting micro and small DNS service providers based on organisational size. Further considerations include mandating that EU member states embed post-quantum cryptography (PQC) transition plans within their national cybersecurity strategies.

The RIPE NCC submitted comments on the preliminary draft. While acknowledging the regulatory relief extended to certain entities, the organisation urged decision-makers to conduct rigorous security and cost-benefit evaluations before imposing new reporting obligations. The RIPE NCC also underscored the necessity of preserving open, bottom-up and multistakeholder governance structures to sustain the Internet's globally coordinated technical operations.

The European Parliament's Committee on Industry, Research and Energy (ITRE) commenced deliberations on its draft report last week, led by MEP Markéta Gregorová. The Rapporteur prioritises data minimisation and retention of IP range oversight by national authorities, backs a single entry point (SEP) for incident reporting and requests standardised guidance to prevent supply-chain obligations from being inappropriately transferred to free and open-source software (FOSS) communities or unregulated organisations. A final settlement is unlikely before March 2027.

Cybersecurity Act 2.0

Negotiations surrounding the EU's Cybersecurity Act 2.0 are intensifying in both the Council and European Parliament.

Within the Council, member states are advocating for greater influence in determining which entities qualify as "high-risk suppliers" rather than ceding this authority solely to the Commission. The Council's preliminary stance also seeks to ease the phase-out approach by offering flexible implementation schedules and a more measured, risk-based framework that accounts for equipment lifecycles and available alternatives.

In the Parliament, the draft ITRE report authored by MEP Markéta Gregorová proposes requiring all NIS2 Essential Entities to obtain certification within twelve months under a new special certification programme. This programme would evaluate an organisation's overall "cyber posture" and provide presumptive compliance with NIS2 requirements.

Regarding supply-chain security, the draft recommends assessing individual vendors through concrete evidence rather than applying blanket country-based restrictions, while compressing the general phase-out window for mobile network equipment to 24 months.

A constructive element in the draft ITRE position explicitly protects FOSS communities from designation as commercial suppliers under supply-chain obligations. Nonetheless, business representatives caution that introducing mandatory cyber-posture audits alongside existing NIS2, Cyber Resilience Act and Critical Entities Resilience Directive obligations would generate substantial regulatory redundancy and complexity. Overly demanding equipment replacement timelines are also facing pushback.

Both the Council and Parliament will refine their respective positions over the following months, seeking to establish their negotiating positions ahead of trilogue discussions anticipated to commence in 2027.

Technology sovereignty package

The concept of digital sovereignty, as examined in a prior RIPE Labs article on sustaining the commons amid digital sovereignty concerns, raises consequential questions presenting both challenges and possibilities. The European Commission's Technological Sovereignty Package seeks to strengthen European capabilities and lessen reliance on foreign technology providers across semiconductors, cloud infrastructure, artificial intelligence and energy systems, yet it simultaneously raises critical questions regarding market openness, technological capacity and genuine alternatives.

The Cloud and AI Development Act (CADA) stands among the most contested components, establishing a four-level sovereignty assurance framework for public sector cloud procurement and provisions to expedite data centre deployment. The package is complemented by non-binding measures, including a fresh EU Open Source Strategy, designed to diminish dependence on proprietary technology vendors, foster EU-based alternatives and mitigate vendor lock-in risks.

CADA's binding requirements apply to cloud computing service providers serving public sector clients. However, the delegated act mechanism under Article 31(3) potentially permits the Commission to broaden applicability to private sector and critical infrastructure operators at a later stage. Another significant consideration involves defining cloud computing services, since different architectures and service models (Infrastructure as a Service, Platform as a Service or Software as a Service) or deployment models (public, private or hybrid) entail different operational controls and isolation properties. Through CADA, the Commission intends to establish that jurisdictional control and certified governance would constitute the legal benchmarks. As the European Parliament and Council begin examining the proposal, a principal challenge will likely involve maintaining precise boundaries on scope, definitions and sovereignty standards.

The proposal tasks national authorities with designating competent bodies and undertaking risk evaluations. The extent to which all member states adopt a harmonised interpretation of sovereignty remains uncertain, as divergent approaches could produce an inconsistent framework.

CADA remains open for public input until 11 November 2026.

Cyber Resilience Act guidance and standards

Standardisation bodies are completing harmonised standards to establish technical requirements for products with digital elements (PDEs) subject to the Cyber Resilience Act. The Commission has released a frequently asked questions document on Cyber Resilience Act implementation and a Guidance Document to facilitate compliance.

Reporting obligations for actively exploited vulnerabilities through the ENISA Single Reporting Platform took effect on 11 September 2026. This requirement will extend to FOSS stewards beginning 11 December 2027.

European standardisation reform

European Standardisation Organisations (ESOs) are undergoing substantial institutional transformation under the proposed revision of the European Standardisation Regulation.

Departing from the conventional "New Legislative Framework" approach, the European Commission intends to permit alternative standards development bodies to participate whenever ESOs fail to produce required standards within expected timeframes. This reform seeks to restructure how standards bodies including CEN-CENELEC and ETSI function, reducing drafting and delivery periods. It also aims to modernise participation, access and standards availability, particularly following European Court of Justice decisions on public access to harmonised standards. These modifications emerge amid worries that Europe is losing competitive ground in critical and emerging sectors including artificial intelligence, cybersecurity, quantum technology and sustainable technologies.

While reaffirming that standards will remain voluntary, the draft proposal tends to expand reliance on international standards, yet simultaneously grants the Commission power to reject global frameworks when judged ineffective or misaligned with stated policy aims. It establishes enhanced oversight of ESOs and creates a "Centre of Excellence" intended to enhance operational efficiency.

The Commission's feedback window extends through 10 December 2026.

Quantum Act on the horizon

The forthcoming EU Quantum Act will work to advance research and industrial development in quantum technologies and coordinate the transition to post-quantum cryptography (PQC). The proposal is anticipated on 18 November.

In preparation, the NIS Cooperation Group has released a frequently asked questions document addressing concepts such as quantum risk evaluation, projections and hybrid approaches, alongside information on critical milestones, resource prioritisation and national transition roadmap responsibilities.

Staying engaged

The RIPE NCC will monitor these regulatory movements and identify opportunities for the RIPE community to participate as proposals advance through the legislative process. Should you wish to discuss implications for your organisation or share insights from your experience, the RIPE NCC welcomes your input.