Regulation (EU) 2025/38 laying down measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cyber threats and incidents and amending Regulation (EU) 2021/694 (Cyber Solidarity Act)
In force since 4 February 2025, the twentieth day after publication (Art. 26; OJ L 2025/38, 15.1.2025), with no separate application date. It also amends Regulation (EU) 2021/694 (Art. 22). Read on 27 Oct 2026 in the Official Journal text retrieved from the Publications Office's Cellar; the Publications Office's metadata records it in force from that date.
In short: what you need to know
Objective: Union capacities to detect, prepare for and respond to cyber threats and incidents: a European Cybersecurity Alert System of national and cross-border cyber hubs, a Cybersecurity Emergency Mechanism with an EU Cybersecurity Reserve, and a European Cybersecurity Incident Review Mechanism.
Key dates: Entry into force 4 February 2025the timeline →
Sanction ceiling:not establishedNone: no provision of the Regulation sets fines or penalties (the Official Journal text, searched in full on 27 Oct 2026, contains neither word).enforcement →
What does the Cyber Solidarity Act do?
Union capacities to detect, prepare for and respond to cyber threats and incidents: a European Cybersecurity Alert System of national and cross-border cyber hubs, a Cybersecurity Emergency Mechanism with an EU Cybersecurity Reserve, and a European Cybersecurity Incident Review Mechanism.
Regulated actor
Member State · Public authority
Protected party
not established
Territorial reach
not established
Implementation model
Directly applicable
Enforcement mechanism
not established
When does the Cyber Solidarity Act apply? Key dates
Entry into force, application and transposition are different events and are kept apart. A date at month precision is shown as a month rather than invented as a day.
The applicability engine holds no rule for this instrument yet. Absence of a rule is absence of knowledge, not evidence that the instrument does not reach you.
What does the Cyber Solidarity Act require? Key provisions
3 provisions recorded. This is what the dataset holds, not the whole instrument — an article that is not here has not been entered, which is a different statement from its not existing.
Article
Heading
Binds
Applies
Art. 3
Establishment of the European Cybersecurity Alert SystemA pan-European network of National Cyber Hubs and Cross-Border Cyber Hubs, joining on a voluntary basis, is established to enhance the Union's detection, analysis and data-processing capabilities in relation to cyber threats and the prevention of incidents (3(1)). A Member State that decides to participate designates or establishes a National Cyber Hub (Art. 4(1)). The actions are funded from the Digital Europe Programme (3(3)).
not recorded
no application date recorded for this article
Art. 14
Establishment of the EU Cybersecurity ReserveAn EU Cybersecurity Reserve of response services from trusted managed security service providers assists its users, upon request, in responding to and initiating recovery from significant, large-scale or large-scale-equivalent cybersecurity incidents (14(1)–(2)). Its users are Member States' cyber crisis management authorities and CSIRTs, CERT-EU, and competent authorities of third countries associated to the Digital Europe Programme (14(3)). The Commission has overall responsibility for its implementation (14(4)).
not recorded
no application date recorded for this article
Art. 21
European Cybersecurity Incident Review MechanismAt the request of the Commission or EU-CyCLONe, ENISA, with the support of the CSIRTs network and the approval of the Member States concerned, reviews and assesses a specific significant or large-scale cybersecurity incident and delivers an incident review report to EU-CyCLONe, the CSIRTs network, the Member States concerned and the Commission (21(1)). The report may draw recommendations (21(4)), and ENISA may issue a publicly available version (21(5)).
not recorded
no application date recorded for this article
How is the Cyber Solidarity Act enforced?
No enforcement recorded
This dataset holds no enforcement action under this instrument. That is what the record says; it is not a finding that none has been taken.
The instrument record itself was last verified on 27 October 2026; every claim below carries its own date.
No claims attached
No claim in the dataset is tagged to this instrument.
How does the Cyber Solidarity Act interact with other EU laws?
1 recorded interaction with other instruments — each with a direction, the provisions that carry it and its own sources. Direction is preserved as recorded: an instrument that amends another is not the same as one amended by it.
The other instrument's provisions operate through definitions, bodies, means or populations this instrument establishes, and say so. Recorded only on an express reference in the DEPENDENT instrument's text; the locator is in that text. Direction: from = the enabling instrument. Added 27 Oct 2026 (docs/V2-DATA-DESIGN.md §1.4).
The Cyber Solidarity Act defines CSIRTs, entities, the entities of sectors of high criticality and other critical sectors, risk, incident, significant and large-scale cybersecurity incidents and managed security service providers by reference to NIS2.