Regulation
- Cybersecurity Act 2 in Parliament (8 October). MEP Markéta Gregorová (Greens/EFA) presented her draft reports on the Cybersecurity Act revision and the targeted NIS2 changes. She leads on both files in Parliament’s industry committee (ITRE). She wants three main changes:
- Make cybersecurity certification mandatory by default. The Commission’s version keeps it voluntary.
- Assess high-risk suppliers one by one, including when they work through white-label products or intermediaries.
- Extend supply-chain risk checks beyond 5G to things like inverters, smart meters, home routers, port cranes and medical imaging devices.
- She also backs a single entry point for reporting incidents under several EU laws at once (Agence Europe).
- What she is amending. The Commission proposed this package in January 2026. It gives ENISA a bigger role, including early threat alerts, help with ransomware recovery and running the single reporting point. It also allows bans on components from high-risk suppliers in key assets across the 18 critical sectors. On the NIS2 side, it would ease compliance for about 28,700 companies and create a new “small mid-cap” category (Industrial Cyber).
- Cyber Resilience Act. Since 11 September 2026, makers of digital products must report actively exploited vulnerabilities and serious incidents. The rest of the CRA applies from December 2027.
Innovation
AI security is where the money is going. A round-up from EU-Startups (15 October) highlights:
- Exein (Italy) became a unicorn after raising €234M in September. It secures connected devices and physical AI.
- Hadrian (Netherlands/UK) raised €35.7M in October for agentic AI attack-surface management.
- Fleuret AI (France), founded this year, raised a €4M pre-seed in October for AI-agent penetration testing.
- Earlier in 2026, Qevlar AI (France, €25.8M), NeuralTrust (Spain, €17.2M) and Escape (France, €15.4M) all raised rounds for AI-driven security tools.
