Parliament’s vote concerned the proposed Cyber Solidarity Act and EU cooperation on cyber preparedness. The first-reading position reflected the political agreement on measures intended to improve the detection, monitoring and handling of major cyber threats across borders.

A central element was a network of cross-border cyber hubs. These hubs were intended to collect and share relevant cyber-threat information so that participating actors could identify incidents earlier and develop a more coordinated situational picture.

The position also included an emergency mechanism. It was designed to support preparedness actions and responses to serious incidents within the framework established by the legislative process. It was a proposed EU instrument, not an automatic Norwegian funding or assistance scheme.

An EU Cybersecurity Reserve formed another part of the package. The reserve was intended to provide services from trusted providers during serious or large-scale cyber incidents. Its practical operation depended on the final legal act, eligibility criteria and the arrangements for participation by national authorities.

Parliament’s position also addressed post-incident review. Such review can provide lessons about what happened, how the response worked and what improvements are needed. It should not be treated as evidence that every operational detail was already a binding legal requirement.

Legal status was decisive on 24 April. Parliament had adopted its first-reading position corresponding to the political agreement, but the final Regulation had not yet been published in the Official Journal. The step was not a change to Norwegian law; Norwegian relevance required a later EEA assessment.

The emergency mechanism covered preparedness actions and support during significant or large-scale incidents. The reserve was conceived as services from trusted providers mobilised on request. Organisations still needed an inventory of critical services, log and evidence needs, national contacts and incident-response contracts. A future European reserve could not replace their own response plan or agreed recovery times.

Sources

European Parliament: “Cyber Solidarity Act – text adopted,” 24 April 2024.

European Parliament: “Plans to increase EU cooperation against cyber threats,” 22 April 2024.

For discussion

Which response capabilities must we secure ourselves before a European cyber reserve could assist?