EU's CSA2 Targets High-Risk Suppliers in Cybersecurity Overhaul

• •CSA2 introduces mandatory removal of high-risk suppliers from ICT supply chains.
• •The proposal aims to enhance cybersecurity across critical sectors like energy and telecom.
• •Implementation may face delays due to political disagreements and potential economic repercussions.

On January 20, 2026, the European Commission proposed CSA2, revising the Cybersecurity Act to designate 'high-risk suppliers' in ICT supply chains. This move aims to enhance cybersecurity across critical sectors, including energy and telecommunications, by enforcing the removal of components from designated suppliers. The reforms are expected to impact entities under the NIS2 Directive, with significant penalties for non-compliance. The proposal has sparked concerns over potential retaliatory actions from China, particularly against suppliers like Huawei and ZTE. Implementation challenges are anticipated due to lengthy negotiations and political disagreements within the EU. The overarching goal is to reduce dependence on non-EU suppliers, particularly from high-risk countries. The changes are set against a backdrop of increasing geopolitical tensions and security risks in critical infrastructure.