MEPs to debate shielding critical infrastructure from cyber attacks

The debate builds on a September report naming Russia the EU's primary security threat and follows the Commission's proposed Cybersecurity Act overhaul. The file now sits with the Parliament's industry committee.

Members of the European Parliament will debate how to shield Europe's critical infrastructure and supply chains from cyber attacks on 11 November. It builds on the September report, adopted in plenary, that named Russia the EU's primary security threat. An agenda slot is a plan, not a result.

The debate follows the cybersecurity package the European Commission, the EU's executive, proposed on 20 January 2026. At its centre sits a revised Cybersecurity Act, which the Commission says should strengthen cyber resilience and capabilities. It also aims to stop member states from fragmenting the EU's digital single market with separate rules, so that one set of cyber rules holds across the union.

It would tighten security for the ICT supply chains that connect Europe's networks, according to the Commission's proposal. It would also reinforce ENISA, the EU's cybersecurity agency, in supporting Member States and the EU in managing cybersecurity threats.

The file now sits with the Parliament's industry committee, ITRE, which picked Markéta Gregorová of the Czech Greens to steer the revised Act through. Member States raised issues with the revised Cybersecurity Act, including ENISA's increased operational role, clarity of definitions, voting rules, resources and participation in certification.

The Council, the EU's body of member state ministers, imposed restrictive measures on nine Russian persons and four organisations for malicious cyberactivities against the EU and its member states on 13 July. As of 3 November, no step in the procedure 2026/2948(RSP) had been recorded, so whether the debate turns into one stays open.