2017/0225(COD)COM(2017)477

Cybersecurity Act

Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on ENISA, the "EU Cybersecurity Agency", and repealing Regulation (EU) 526/2013, and on Information and Communication Technology cybersecurity certification (''Cybersecurity Act'')

Stage: In force, reached 7 Jun 2019
In force: In force since 27 Jun 2019 · CELEX 32019R0881
Procedure: Regulation · Ordinary legislative procedure
Lead DG: DG CNECT
Commissioner: Mariya Gabriel
Last activity: 27 Jun 2019

27 entries · record as of 30 Sept 2026

Where it stands

Latest: Publication in the Official Journal, 7 Jun 2019.

Show the earlier record: 18 dates, 4 Aug 2017 to 12 Sept 2018

4 Aug 2017
- Inception impact assessment closed: Review of ENISA Regulation and laying down a EU ICT security certification and labelling, 14 responses · Commission
13 Sept 2017
- Adoption by Commission
14 Sept 2017
- Discussions within the Council or its preparatory bodies
15 Sept 2017
- Discussions within the Council or its preparatory bodies
19 Oct 2017
- Discussions within the Council or its preparatory bodies
23 Oct 2017
- Referral of the legislative proposal to the EP committee responsible (announced in plenary)
27 Oct 2017
- Discussions within the Council or its preparatory bodies
23 Nov 2017
- Discussions within the Council or its preparatory bodies
6 Dec 2017
- Feedback on adopted proposal closed: Review of ENISA Regulation and laying down a EU ICT security certification and labelling, 32 responses · Commission
22 Dec 2017
- Discussions within the Council or its preparatory bodies
11 Jan 2018
- Discussions within the Council or its preparatory bodies
18 Jan 2018
- Discussions within the Council or its preparatory bodies
1 Mar 2018
- Discussions within the Council or its preparatory bodies
6 Mar 2018
- Discussions within the Council or its preparatory bodies
24 May 2018
- Discussions within the Council or its preparatory bodies
29 May 2018
- Discussions within the Council or its preparatory bodies
11 Sept 2018
- Discussions within the Council or its preparatory bodies
12 Sept 2018
- Endorsement by EP plenary of the committee decision to start interinstitutional negotiations

20 Dec 2018
- Discussions within the Council or its preparatory bodies
12 Mar 2019
- Discussions within the Council or its preparatory bodies
- EP position at first reading
27 Mar 2019
- Discussions within the Council or its preparatory bodies
29 Mar 2019
- Discussions within the Council or its preparatory bodies
8 Apr 2019
- Discussions within the Council or its preparatory bodies
9 Apr 2019
- Approval of the EP's first reading position by the Council (adoption of the legislative act)
17 Apr 2019
- Signature by the president of the EP and by the president of the Council
7 Jun 2019
- Publication in the Official Journal

257 amendments

Amendments

Tabled on 8 Mar 2019. The texts are in the amendment documents below.

By committee

ITRE257

By article

Article 50 – paragraph 6 – point d2
Annex -I (new)1
Annex I – paragraph 1 – point 121
Annex I – paragraph 1 – point 151
Annex I – paragraph 1 – point 15 a (new)1
Annex I – paragraph 1 – point 15 b (new)1
Annex I – paragraph 1 – point 5 a (new)1
Annex I – paragraph 1 – point 81
Article 1 – paragraph 1 a (new)1
Article 1 – paragraph 1 – point a1

Show 20 more provisions

Article 1 – paragraph 1 – point b1
Article 10 – paragraph 1 – point a1
Article 10 – paragraph 1 – point b a (new)1
Article 11 – paragraph 1 – point c a (new)1
Article 12 – paragraph 1 – point d1
Article 14 – paragraph 1 – point e1
Article 14 – paragraph 1 – point m1
Article 14 – paragraph 1 – point o1
Article 16 – paragraph 41
Article 18 – paragraph 31
Article 19 – paragraph 21
Article 19 – paragraph 5 a (new)1
Article 2 – paragraph 1 – point 11
Article 2 – paragraph 1 – point 101
Article 2 – paragraph 1 – point 11 a (new)1
Article 2 – paragraph 1 – point 11 b (new)1
Article 2 – paragraph 1 – point 161
Article 2 – paragraph 1 – point 16 a (new)1
Article 2 – paragraph 1 – point 16 b (new)1
Article 2 – paragraph 1 – point 16 c (new)1

Covers 31 of the 257 amendments.

5 acts

Delegated and implementing acts beneath it

By status: 5 published.

Act	Kind	Status	Adoption
Commission Implementing Regulation (EU) 2025/2540	Implementing · Regulation	Published	Q4 2025
Commission Implementing Regulation (EU) 2025/2462	Implementing · Regulation	Published	Q3 2025
Commission Implementing Regulation (EU) 2024/3143	Implementing · Regulation	Published	25/09/2024
Commission Implementing Regulation (EU) 2024/3144	Implementing · Regulation	Published	25/09/2024
Commission Implementing Regulation (EU) 2024/482	Implementing · Regulation	Published	Q2 2022

Titles link to EUR-Lex where the act has been published.

12 documents

Documents

Newest first. Each opens at its source.

Report · A8-0264/2018Parliament
Proposal · COM(2017)0477Commission
Text adopted · OJ L 151 07.06.2019, p. 0015Commission
Committee opinion · PE615.394Parliament
Committee opinion · PE616.831Parliament
Committee opinion · PE619.094Parliament
Report · PE619.373Parliament
Amendments · PE621.015Parliament
Amendments · PE621.098Parliament
Text adopted · Regulation 2019/0881Commission
Text adopted · SP(2019)393Parliament
Text adopted · T8-0151/2019Parliament

1 consultation

Consultations on it

The Commission's Have Your Say consultations linked to this file. Each title opens on the Commission's portal.

Consultation	Feedback deadline	Feedback received
Review of ENISA Regulation and laying down a EU ICT security certification and labelling	6 Dec 2017	46

Summary

Generated

Regulation (EU) 2019/881 establishes ENISA's permanent mandate and a framework for voluntary European cybersecurity certification schemes covering ICT products, services, processes, and managed security services. Certification is voluntary unless EU or Member State law makes it mandatory; the Commission assesses schemes for possible mandatory status.

What the workspace adds on this file

Everything above is the public record. In the workspace, subscribers see this file with their own layer on top.

Why it matters to you

What this file means for your organization, assessed against your own priorities.

What moved

When this file moves, it reaches your own briefing, with a link to its source.

Your contacts on it

Your team's contacts logged against this file: who you met, what was said and the next step.

A first draft

A statement, a member update or a meeting brief on this file, in your organization's voice, with its sources.

Sources: EP Legislative Observatory · EU Law Tracker · EUR-Lex. Record as of 30 Sept 2026. Something wrong on this page? Report an error.

Request access

See this file with your own layer on top: why it matters to you, your contacts on it and a first draft. We’ll schedule a 20-minute walkthrough.

Hosted in the EU · Security →

By submitting, you agree to our privacy policy.