European Commission Proposes Cybersecurity Act 2 and NIS2 Updates

On January 20, 2026, the European Commission published a proposal for the updated EU Cybersecurity Act, referred to as 'The Cybersecurity Act 2'. This proposal aims to enhance cybersecurity measures across the EU, particularly for entities under the NIS2 directive, which will now require reporting on ransomware attacks and introduce a new category for small entities. These updates are part of a broader effort to strengthen the EU's cybersecurity framework.