The European Union’s ability to detect and respond to EU cybersecurity incidents faces significant gaps, particularly in information-sharing and coordination between national and EU-level bodies, according to a new report by the European Court of Auditors (ECA). The auditors said the EU has made progress in developing a cybersecurity cooperation framework, but several measures needed to support an effective response to significant and large-scale incidents are still incomplete. Cybersecurity incidents can disrupt public services, businesses, critical infrastructure and the EU’s internal market. While member states remain primarily responsible for responding to such incidents, the EU has a role when attacks cause major disruption, significant financial losses or substantial harm, or when incidents affect several countries and exceed the response capacity of a single member state.

EU Cybersecurity Incidents Face Information-Sharing Gaps

The ECA identified insufficient information exchange as a major weakness in the EU’s cybersecurity response system. The Cyber Blueprint, adopted in 2025, largely clarifies roles and responsibilities for managing major cybersecurity crises. However, the cooperation between two key EU cyber networks has not yet been formally defined. The auditors said this affects cooperation between the CSIRTs network, which brings together national teams responsible for handling cyber incidents, and EU-CyCLONe, which supports cooperation during EU-level cyber crises. Information-sharing is also affected by differences in national security laws and the ongoing implementation of updated EU cybersecurity rules, including the NIS 2 Directive. According to the auditors, these factors can make it harder for EU networks to identify threats early and coordinate an effective response. “The EU has made progress in building a cybersecurity cooperation framework, but it is not yet working as effectively as it should,” said George-Marius Hyzler, the ECA Member responsible for the audit. “When a serious cyber incident occurs, timely and actionable information is essential. Without it, networks and mechanisms lose much of their added value.”

European Cybersecurity Alert System Still Delayed

The audit also found that the European Cybersecurity Alert System was not operational at the time of the assessment. Two hubs examined by the auditors, ATHENA and ENSOC, had not started operating because of procurement delays. The system also lacked several elements needed for operation, including cooperation agreements, a common classification system and technical standards. The findings come as the EU continues to invest in cybersecurity. Under the 2021-2027 EU budget, €1.4 billion has been allocated to cybersecurity through the Digital Europe Programme, the EU’s main source of cybersecurity funding.

Overlap Among EU Cybersecurity Bodies

The ECA also identified overlapping responsibilities among some EU bodies involved in monitoring cybersecurity threats. The European Commission’s cyber situation centre, established in 2022 and largely supported by external providers, carries out work that the auditors said partly duplicates existing capabilities at the European Union Agency for Cybersecurity (ENISA). These capabilities include monitoring threats and developing cybersecurity situational awareness. The auditors called for better coordination to reduce duplication and strengthen the overall effectiveness of the EU’s cybersecurity framework.

Funding Checks Raise Security Concerns

The report also highlighted weaknesses in checks on some organisations receiving EU cybersecurity funding. These checks are intended to reduce risks linked to intrusion or influence by non-EU states and prevent sensitive security information from being shared with non-EU authorities. However, while grant beneficiaries are responsible for assessing the ownership and control of third parties receiving financial support, the European Cybersecurity Competence Centre does not verify those assessments. The ECA warned that this could expose sensitive infrastructure, operational data and security-critical technologies to security risks. The audit covered the period from 2022 to 2025 and assessed whether EU actions effectively supported the detection of and response to significant and large-scale cybersecurity incidents. Audit missions were conducted in Ireland, Greece and Italy.

The European Commission has adopted the EU KIDS Act, a proposal that would introduce new age restrictions and safety requirements for online platforms used by children across the European Union. The proposal would prevent social media platforms from allowing children under 13 to access their services and establish an EU-wide minimum age of 15 for minors to open accounts independently.

The EU KIDS Act would also shift the burden of proof to online service providers, requiring them to demonstrate that their services are safe by design and appropriate for younger users.

Commission President Ursula von der Leyen said the proposal is intended to give parents greater control over how children use digital services.

“Today, our children are engaging with the most sophisticated technologies ever created. Technology that was never created with their wellbeing in mind. Our KIDS Act is reversing the burden of proof - it is for platforms to show they are safe by design. And we put parents back in the driving seat, giving them the tools to help their children navigate a safer online world,” von der Leyen said.

EU KIDS Act Sets New Social Media Age Limits

Under the EU KIDS Act, children between 13 and under 15 would not be able to create autonomous social media accounts. Instead, they could use mini accounts managed through a parent or guardian's account, with access limited to age-appropriate social media and video-sharing services.

These mini accounts would include safeguards such as restricted social contacts and screen time of up to one hour per day.

Children between 3 and under 13 would not be permitted to access social media. They could, however, use specially designed child-friendly video-sharing services through guardian-managed accounts. Parents would also receive tools to restrict an adult device to those services when it is given to a child, with exposure limited to a maximum of one hour per day.

Safety-by-Design Rules Target Addictive Features

The proposal would introduce safety-by-design obligations for online services offering social media, video sharing, online video games, AI companions and chatbots to users under 18.

The proposed rules would prohibit addictive features and profiling-based recommendation feeds that can draw minors toward harmful content. Infinite scrolling without stopping points, reward mechanisms and push notifications during sleeping hours would also be restricted.

The proposal would further prohibit unsolicited contact from strangers. AI companions and chatbots would have to be turned off by default and could not simulate interpersonal relationships in ways that create emotional dependency.

Minor profiles would be private by default, while geolocation, camera and microphone access would be turned off. Platforms would also need to provide tools allowing minors to block or mute users, manage their time and control, tune and reset recommender systems.

Privacy-Preserving Age Assurance Proposed

The EU KIDS Act would require online services and app stores to use age assurance tools. The proposal points to the EU age verification app as one possible approach, with the system designed not to retain identity documents or biometric data.

Social media and video-sharing platforms would be expected to perform age verification when users create new accounts. For existing accounts, providers would estimate a user's age using reasonable indicators, such as the account creation date or credit card details.

EU Plans Faster Enforcement

The proposal would require very large online platforms to prove that their services are safe by design. Providers would submit compliance plans to the European Commission and an independent auditor, which would assess new services, features or functionalities.

If the Commission identifies shortcomings based on an auditor's report, it could require providers to propose corrective measures. The enforcement framework would build on existing structures under the Digital Services Act and Artificial Intelligence Act.

For noncompliance, the proposal includes expedited enforcement procedures under which the Commission should conclude investigations within 90 days.

Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, said the proposal would allow children to use digital services while increasing safeguards and accountability for platforms.

“With our EU KIDS Act, we make sure our children can enjoy their rights online - to learn, stay connected and explore. We also give parents the tools to accompany their kids to navigate a safe digital world. All of this by keeping the pressure high on platforms, because they must prove their services do not harm,” Virkkunen said.

EU KIDS Act Moves to Parliament and Council

The legislative proposal has now been submitted to the European Parliament and the Council for examination and adoption.

The proposal follows recommendations from the European Commission's Special Panel on Child Safety Online, which included more than 60 experts from areas including civil society, education, public health, child psychiatry and technology.

The Commission said public support for stronger online protections is also growing. According to the 2026 Special Eurobarometer on the Digital Decade, 92% of Europeans consider strengthening protection for children and young people online a top policy priority.

The U.S. House of Representatives has passed the bipartisan GUARD Act, legislation aimed at strengthening law enforcement efforts against elder financial fraud, cryptocurrency investment scams and other financial crimes targeting older Americans. The bill, H.R. 2978, passed on September 15, 2026, and now heads to the Senate.

The GUARD Act, or Guarding Unprotected Aging Retirees from Deception Act, was co-led by Representatives Josh Gottheimer, Zachary Nunn and Scott Fitzgerald. The legislation would provide state, local and Tribal law enforcement agencies with additional resources to investigate fraud, track stolen funds and pursue criminals involved in increasingly complex financial schemes.

GUARD Act Targets Elder Financial Fraud and Crypto Scams

Under the GUARD Act, law enforcement agencies could use existing federal grant funding to investigate elder financial fraud, general financial fraud and pig butchering crypto scams.

The funding could support the hiring of analysts and other experts, as well as specialized training for investigators handling complex and often transnational financial crimes.

The bill would also clarify that federal law enforcement agencies can assist state, local and Tribal law enforcement partners and fusion centers with blockchain tracing tools and related technology. The goal is to help investigators follow the movement of funds and identify individuals involved in cryptocurrency-related scams.

The legislation also directs the Treasury Department, FinCEN and federal partners to report to Congress on the scale of financial scams in the United States. The report would examine how much Americans lose each year, how many scams are linked to overseas actors and organized crime, and the effectiveness of existing enforcement efforts.

‘Pig Butchering’ Scams Under Focus

The legislation specifically addresses pig butchering crypto scams, a form of financial fraud in which criminals build trust with victims before persuading them to put money into fraudulent investment opportunities.

The term refers to the process of building up a victim's confidence and encouraging larger investments before the criminals steal the funds.

According to the information provided with the legislation, the FBI's 2025 Internet Crime Complaint Center report recorded $20.9 billion in total internet crime losses in 2025, a 26% increase from 2024. Cryptocurrency-related losses reached $11.37 billion across 181,565 complaints, while investment fraud accounted for more than $8.6 billion in losses.

Bill Moves to Senate

Gottheimer said the legislation would give investigators tools and resources to pursue fraudsters, recover stolen money and address criminal networks operating from overseas.

Nunn said the bill followed concerns raised by an Iowa sheriff's deputy about local officers lacking the tools needed to track criminals and recover victims' money.

The GUARD Act has received support from organizations including AARP, the Iowa State Police Association, the Financial Technology Association, Consumer Bankers Association, America’s Credit Union Association, Digital Chamber, National Police Association, Crypto Council for Innovation and Iowa Bankers Association.

With House passage complete, the legislation now moves to the Senate for consideration.

European Commission President Ursula von der Leyen has proposed an Emergency Security Protocol that would allow any European Union member state to trigger a coordinated response to security incidents including cyberattacks, sabotage and drone incursions. The proposal was announced during von der Leyen’s 2026 State of the Union address in Strasbourg, where she called for a new European security strategy in response to what she described as rising threats across the bloc. Recent incidents in Denmark, Lithuania and Poland, along with an attempted drone attack in Leipzig, were cited as examples of the changing security environment.

Emergency Security Protocol Would Bring EU Governments Together

Under the proposed Emergency Security Protocol, a single member state could trigger the mechanism, prompting all 27 EU governments to convene. The proposed framework would be designed to coordinate a European response, deter further escalation and mitigate the consequences of an incident. Von der Leyen presented the mechanism as a European counterpart to NATO’s Article 4, which allows alliance members to consult when the territorial integrity, political independence or security of a member is threatened. The EU proposal, however, was presented as a mechanism for incidents that fall below the threshold of armed aggression but still pose a national security threat. The proposal does not yet specify what decisions would follow such a meeting or whether the mechanism would create predetermined responses to specific types of incidents.

Cyberattacks and Hybrid Threats Drive Security Push

The Emergency Security Protocol comes as the EU considers how to respond to a broader range of hybrid threats. Von der Leyen cited cyberattacks, sabotage, arson and drone incursions as threats that are increasing across Europe. She argued that existing EU institutions and decision-making processes have not kept pace with the changing security environment. As part of the proposed European security strategy, she called for a European counter-hybrid playbook and greater agreement on how member states should respond to incidents that threaten national security without amounting to conventional armed aggression. The EU already has mutual-assistance and solidarity provisions. Article 42(7) of the Treaty on European Union provides for mutual assistance when a member state is the victim of armed aggression, while Article 222 of the Treaty on the Functioning of the European Union contains a separate solidarity provision.

EU Security Council Also Proposed

Alongside the Emergency Security Protocol, von der Leyen proposed creating a European Security Council focused on the security of the continent. The proposed format would include EU leaders and partners such as Canada, Norway, Ukraine and the United Kingdom. The initiative is intended to provide a broader forum for discussions on European security as the bloc reassesses how it responds to emerging threats. The Commission is also expected to outline further details through its forthcoming European security strategy.

Decision-Making Questions Remain

The proposed mechanism comes as questions remain over how quickly the EU can reach collective decisions during security crises. Many decisions under the bloc’s common foreign and security policy require unanimity, meaning individual governments can block measures supported by other member states. EU sanctions are also adopted unanimously. Von der Leyen did not specify whether the proposed protocol would change those decision-making rules, establish agreed responses in advance or primarily provide a framework for consultation. She also announced a European Instrument for Strategic Enablers, covering capabilities including air and missile defence, strategic transport, air-to-air refuelling, space systems and cyber capabilities. The initiative is intended to be aligned with NATO. The Emergency Security Protocol, European security strategy and proposed European Security Council form part of a wider effort outlined in the 2026 State of the Union address to strengthen coordination around Europe’s changing security environment. Further details are expected as the Commission develops its proposed security strategy.

Manufacturers selling connected products in the European Union face a new legal duty starting Sept. 11. Report actively exploited vulnerabilities to authorities within 24 hours of confirming them. The obligation arrives 15 months ahead of the Cyber Resilience Act's full application date of Dec. 11, 2027, making it the regulation's first hard deadline.

The CRA covers products with digital elements placed on the EU market, a category broad enough to take in enterprise software, consumer IoT devices, industrial controllers and much of the component software beneath them.

Under Article 14, manufacturers must file an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident affecting product security, a fuller notification within 72 hours, and a final report within 14 days of a corrective measure becoming available — one month in the case of severe incidents.

Reports go through a Single Reporting Platform operated by ENISA. A manufacturer submits once to a designated national computer security incident response team, which then shares the notification with CSIRTs in other member states where the product is sold, with ENISA receiving it in parallel. The European Commission has said the platform will be operational by the September date and has been undergoing functional and security testing.

Where the Deadline Bites

The awareness standard is what will generate arguments. The trigger is a reasonable degree of certainty that a vulnerability is being exploited or that an incident has severely compromised product security — a judgment call that must be made in hours, often on partial telemetry, and one that manufacturers cannot defer by declining to investigate.

Two further wrinkles are drawing attention from compliance advisers. Reporting duties survive end of support, unlike most of the CRA's other vulnerability-handling requirements, which means legacy product lines remain in scope. And importers or distributors that rebrand a product or substantially modify it inherit manufacturer obligations outright.

Penalties for breaching core manufacturer obligations reach €15 million or 2.5% of global annual turnover, whichever is higher.

Readiness Questions on the Cyber Resilience Act

Practitioners have raised two gaps. The reporting platform is scheduled to be ready by the deadline rather than in advance of it, leaving little room for manufacturers to rehearse submissions. And the harmonised standards that will define what adequate compliance looks like are still working through public enquiry, so companies are building processes against a moving target. The CRA's requirement that manufacturers publish a coordinated vulnerability disclosure policy does not apply until December 2027.

The effects reach past manufacturers. Enterprises that buy connected products will begin receiving vendor notifications on the vendor's clock rather than their own, and will need a route from a supplier advisory into incident triage — plus a fast assessment of whether the same event triggers separate duties under NIS2 or DORA.

Friday's start date has an immediate real-world test case. Adobe confirmed this week that a maximum-severity Magento flaw, CVE-2026-75650, has been exploited against merchants since Sept. 4. Had the same sequence begun a week later, the 24-hour clock would have applied.

Read: Attackers Exploit Unpatched Magento Zero-Day to Backdoor Online Stores