Member states want more power over EU cyber rules than Brussels

The Irish Council Presidency has tabled a compromise proposal for the second Cybersecurity Act, as the European Parliament prepares to debate critical infrastructure protection on Wednesday.

Member states are pushing for decision-making power under the second Cybersecurity Act to be anchored more with themselves than in Brussels, according to background reporting. By November 2026, the Irish Council Presidency had tabled a new compromise proposal for the act. The European Parliament debates the protection of critical infrastructure from cyberattacks in Brussels on Wednesday 11 November 2026 at 15:00.

In September, its Democracy Shield resolution called on the Commission to propose a legal act creating a European Centre for Democratic Resilience. The European People's Party (EPP), the Socialists and Democrats (S&D), Renew and the Greens/EFA backed the plan; the European Conservatives and Reformists (ECR), the Patriots for Europe (PfE), The Left and non-attached members opposed it.

The debate has a security backdrop set out by Parliament itself. On 16 September 2026, it adopted a report warning of increased hybrid attacks against the EU, naming Russia and its proxies as the main culprits. The warning went beyond cyberattacks alone, covering the wider mix of hybrid threats that elected representatives said the Union faces. The day before, it had approved the Democracy Shield report, which sets out recommendations for defending democratic institutions and strengthening the EU's existing toolbox. Both texts came from the same institution now weighing how far cyber rules should reach.

Ukrainian attacks targeted data centres of the Russian technology company Yandex in October 2026, according to a press release cited by reports on the matter. Reports citing Cloudflare Radar data said automated traffic from Yandex networks fell to 0.4 percent of its maximum of the previous two weeks. In the same month, MEPs Sandro Gozi and Tomáš Zdechovský submitted a written question to the European Commission. The two MEPs asked it to investigate what impact outages of Russian bot networks could have on Russian influence operations against European democracies.

The cybersecurity debate is not the only item on the agenda. A debate is scheduled for Thursday 12 November at 09:00 on further EU sanctions against Russia in response to escalating attacks against Ukraine, and on cutting the sources financing the Russian war.