The amendments to the Cybersecurity Act (CSA) promulgated on 13 February 2026 complete the transposition of Directive (EU) 2022/2555 (NIS2). The amendments introduce a new regulatory framework that substantially expands the personal scope of the Act, specifies risk management obligations, refines the incident notification regime and significantly raises sanction thresholds. Entities within the scope of the CSA should take immediate steps to achieve compliance with the new requirements.
I. Expanded Personal Scope. New Categorization of Entities
The new legislation distinguishes between two categories of obligated entities:
- essential entities
- important entities.
The classification determines the intensity of supervision and the level of applicable sanctions.
Essential entities are defined as entities of the types listed in Annex I to the law (energy, transport, banking, financial markets, healthcare, water supply, digital infrastructure, and ICT service management) that exceed the upper limit for medium-sized enterprises within the meaning of Article 3, item 1 of the SME Act, providers of qualified certification services and DNS services, regardless of size, as well as entities designated as operators of essential services prior to the entry into force of the amendment.
All other entities listed in Annexes I and II that meet the criteria for medium-sized enterprises (50 or more employees or an annual turnover exceeding EUR 10 million) qualify as important entities. Annex II has been significantly expanded and now covers postal and courier services, waste management, the chemical industry, the food industry, the manufacture of medical equipment, electronics, mechanical engineering, automotive manufacturing, and, in the field of digital services, online trading platforms, search engines, and social networking platforms.
Regardless of size, entities under Article 4, item 3 CSA are also covered: sole providers of an essential service; entities whose disruption would threaten public safety or health; entities of critical sectoral importance at national or regional level.
II. Risk Management and Reporting Obligations
1. Risk Management Measures (Article 22 CSA)
Essential and important entities must implement appropriate and proportionate technical, operational and organisational measures. The mandatory minimum scope includes:
- risk analysis policies;
- incident handling procedures;
- business continuity and disaster recovery plans;
- supply chain security assessment;
- multi-factor authentication (MFA);
- encryption policies;
- staff training in cyber hygiene.
Attention should be paid to the supply chain security obligation under Article 22, item 2, point 4 CSA. Entities must assess the cybersecurity vulnerabilities and practices of their direct suppliers, which in practice requires the inclusion of relevant clauses in commercial contracts.
2. Incident Notification Obligations (Article 23 CSA)
Upon a significant incident, entities must notify the Sectoral CSIRT within the following deadlines:
- early warning – within 24 hours of detection;
- notification with initial assessment – within 72 hours (trust service providers – 24 hours);
- final report – within one month of the notification.
Concurrently, entities must inform affected service recipients without undue delay.
III. Sanctions Regime
The amendments introduce sanction thresholds comparable to those under Regulation (EU) 2016/679 (GDPR). Failure to comply with Articles 22 and 23 CSA entails:
- essential entity: up to EUR 10,000,000 or 2% of global annual turnover (whichever is higher), but no less than EUR 25,000;
- important entity: up to EUR 7,000,000 or 1.4% of turnover, but no less than EUR 12,500.
Personal liability applies to managers and governing body members – fine from EUR 500 to EUR 5,000. The competent authorities have the right to publish their decisions on established violations, thus extending the range of enforcement measures to include reputational consequences. A transition period is provided for: for violations committed before the amendments come into force, fines and property sanctions are reduced by 50%.
IV. Recommended Actions
In view of the above, entities potentially falling within the scope of the amended CSA should take the following steps in the short term:
- Legal analysis: determine the entity category and applicable obligations.
- Registration: prepare for entry in the register under Article 6 CSA.
- GAP analysis: audit compliance with Article 22 CSA and prepare a remediation plan.
- Contractual framework: include cybersecurity clauses in supplier contracts.
- Internal policies: develop risk management policies and incident response procedures.
Conclusion
The transposition of Directive NIS2 isn’t a formal regulatory act, but reflects a lasting change in the approach of the legislator, whereby cybersecurity is treated as a shared responsibility of the public and private sectors.
For businesses, the practical significance of the amendments boils down to three main conclusions. First, the scope has been significantly expanded, and many companies that previously had no obligations under the Cybersecurity Act now fall within its scope. Second, the requirements are specific and verifiable, and the law does not allow for formal compliance without actual implementation of measures. Third, the sanction regime aims at preventive investment in compliance, which is more cost-effective than a reactive approach after an inspection or incident.
Entities falling within the scope of the law shouldn’t view compliance solely as a regulatory burden. The established risk management framework, secure supply chain, and incident response readiness are both a legal obligation and a competitive advantage in an environment where customer and partner trust increasingly depends directly on the level of cybersecurity.
The article above is for information purposes only. It is not a (binding) legal advice. For a thorough understanding of the subjects covered and prior acting on any issue discussed we kindly recommend Readers consult Ilieva, Voutcheva & Co. Law Firm attorneys at law.
