A UN Effect? How the EU Implements the Norms of Responsible State Behavior in Cyberspace

Executive Summary

In 2015, the international community successfully endorsed a catalog of eleven voluntary norms to guide responsible state behavior in cyberspace. Yet, these behavioral expectations of how states should and should not behave in the cyber domain, such as responding to requests for assistance and refraining from intentionally damaging critical infrastructure, do not shape international security through agreement alone. Their ability to enhance international stability and strengthen the resilience of the digital infrastructure on which societies depend on rests predominantly on whether and how governments translate them into laws, institutions, operational procedures, and patterns of cooperation. Over the past decade, UN Member States have made varying levels of progress in this regard, and the shift from commitment on paper to implementation in practice remains challenging.

To address these gaps and accelerate the norms’ practical implementation, regional organizations are increasingly developing their own implementation approaches and support mechanisms. ASEAN published a norms implementation checklist last year, the European Union adopted a contribution on its implementation of the UN cyber norms for the upcoming first plenary session of the UN Global Mechanism on ICT Security next week, and the African Union is also in the process of developing implementation guidelines.

Against this backdrop, there is a need to better understand how states embed the specific responsibilities and expectations of restraint encapsulated in these norms into everyday governance. Given the emergence of a comprehensive cybersecurity policy ecosystem and complex institutional architecture, particularly in the decade since the UN cyber norms were formally institutionalized, the European Union provides a valuable case study for examining these dynamics.

Its experience offers insights into how states and regional actors align, adopt, and adapt their practices through two pathways: explicit and implicit internal implementation via legislation, policies, institutions, and partnerships; and external implementation via cyber capacity-building initiatives supporting norms implementation in partner countries and regions.

Specifically, analyzing the EU’s implementation experience across these pathways yields several key takeaways:

• 55 identified internal implementation activities and additional external implementation examples across eight capacity areas demonstrate that the EU is already implementing the UN cyber norms extensively and at scale across its policy ecosystem. These measures are not confined to a single policy area or institution but are embedded across multiple governance domains.

• The EU’s norms implementation is an inherently dynamic and continuous process. The EU experience demonstrates that implementing the UN cyber norms is not a single downstream step, but a prolonged process of translation, institutionalization, and revision.

• The EU’s implementation is driven by a set of cross-cutting enabling capabilities rather than isolated measures linked to individual norms. These include cybersecurity coordination structures and agencies as well as regulatory regimes for critical infrastructure protection and cooperation in addressing cybercrime.

• The EU’s implementation appears most robust where political commitments are reflected in legislative frameworks with built-in enforcement mechanisms, for example, by defining duties, creating compliance expectations, and empowering oversight actors.

• The EU framework has translated positive commitments into regional practice more readily than prohibitive norms. EU-level implementation efforts are strongest where behavioral expectations can be embedded in existing resilience, preparedness, and capacity building frameworks.

• Critical infrastructure protection is one of the areas where EU measures aligning with the behavioral expectations reflected in the UN cyber norms are strongest. This suggests that norms implementation can advance more quickly when it is tied to concrete public-interest functions.

• The EU largely implements the UN cyber norms implicitly. Many EU measures align substantively with the UN cyber norms, but they are rarely framed as contributions to the UN framework for responsible state behavior in cyberspace.

While the EU likely has one of the most mature norms implementation frameworks worldwide, many of its implementation building blocks – from cybersecurity coordination structures to regulatory frameworks addressing critical infrastructure protection – are also reflected in other implementation-focused initiatives. This points to growing cross-regional convergence around the practical foundations needed to operationalize the framework.

Even though the EU is in many ways unique in its approach to the implementation of the UN cyber norms, its experience can thus also offer insights for other regions and states interested in strengthening implementation. They include the added value of mapping norms also against institutional responsibilities, not only against laws and policies, building in revision pathways to help keep implementation adaptive, balancing common objectives and domestic execution at the regional level, and considering critical infrastructure protection as a particularly feasible and politically actionable starting point for broader norm operationalization.

These findings and reflections point to five recommendations for future EU engagement to accelerate implementation at both the internal and international levels:

1. The EU should strengthen internal socialization of the UN cyber norms across its institutions, bodies, and agencies to ensure a whole-of-EU perspective, so that the norms become part of everyday policymaking, not only diplomatic messaging.

2. The EU should systematically track implementation internally across EU institutions and instruments in order to identify existing practices, spot gaps, clarify responsibilities, and encourage Member State engagement, for example, through an annual internal “UN norms in EU practice” briefing.

3. Building upon its July contribution, the EU should continue to move from implicit implementation to more explicit implementation narratives in public communication and international fora that connect EU instruments and practices to the UN framework. This would serve multiple EU objectives at once, as it reinforces the practical relevance of the UN framework, showcases the EU’s cybersecurity acquis, and supports implementation debates in other regions.

4. The EU should embed a stronger implementation lens into its cyber capacity building efforts, especially recognizing that many of its existing initiatives already support norm implementation, even though they are currently mostly not framed in those terms.

5. Finally, the EU should leverage the UN Global Mechanism to advance the debate on implementation, including through working papers, side events, and technical briefings, and by feeding insights from its implementation experience into any renewed work on a voluntary implementation checklist. In parallel, the EU should deepen cross-regional engagement with implementation initiatives developed by other regional organizations, particularly ASEAN and the African Union, to identify convergence on implementation activities, shared implementation challenges, and emerging good practices. The norms relating to critical infrastructure protection provide the most feasible and politically actionable entry points for broader cross-regional norm operationalization and mobilization.

As the new UN Global Mechanism begins its substantive work this year with a mandate to accelerate implementation, this mapping of the EU’s norms implementation provides cyber diplomats with an evidence base for a more operational understanding of implementation in practice. It can also support them in designing targeted capacity building on implementation of the framework and identifying interlinkages of norms implementation practices across the cyber diplomacy toolkit, particularly with confidence-building measures and international law. Policymakers can use these insights to inform discussions in Global Mechanism working groups and cross-regional dialogues. This is particularly important at a time when the effectiveness of the UN cyber framework increasingly depends less on negotiating new commitments than on embedding existing ones into regional and national practice.

Introduction

Over the past twenty years, states have gradually constructed a framework for responsible state behavior in cyberspace through successive UN working groups, including Groups of Governmental Experts (GGEs) and Open-ended Working Groups (OEWGs). ¹ This framework rests on several core pillars: States have affirmed that international law applies to cyberspace, agreed on 11 voluntary, non-binding norms of responsible state behavior, developed confidence-building measures (CBMs), advanced principles for cyber capacity building, and identified existing and emerging threats to international peace and security stemming from the use of information and communication technologies.

Among these five pillars, the eleven norms adopted in the 2015 UN GGE report (see Figure 1) play an important role. ² These norms provide political guidance for responsible state conduct in cyberspace by including both positive obligations (“do’s”) – such as cooperating to protect critical infrastructure and responding to requests for assistance – and prohibitive commitments (“don’ts”), including the expectation that states should refrain from intentionally damaging critical infrastructure or targeting Computer Emergency Response Teams (CERTs). ³

Figure 1: UN norms of responsible state behavior in cyberspace

The behavioral expectations contained in the norms matter not because they are automatically obeyed, but because they shape the kind of digital societies and international order states choose to build. Whether and how governments translate these commitments into laws, institutions, operational procedures, and patterns of cooperation can not only enhance international stability by increasing the predictability of state conduct. It also affects the security of hospitals, energy systems, public administrations, financial networks, and the wider digital infrastructure on which contemporary societies depend.

In that sense, implementing the UN cyber norms ⁴ is not a narrow technical discussion for diplomats or cybersecurity specialists. It shapes how international order is made concrete, how restraint and responsibility are embedded in everyday governance, and whose experiences and interests ultimately define what “responsible behavior” means in practice. ⁵ The repeated calls for additional guidance on implementation, including in the 2021 report of the UN GGE and the OEWG discussions, underscore that norms acquire meaning not only through diplomatic endorsement, but mostly through how they are operationalized in practice.

This raises a central question: To what extent do international cyber norms shape regional governance and state practice? And more specifically, does the UN framework generate what could be described as a “UN Effect” ⁶ by serving as a global reference point that influences how states approach cybersecurity governance in practice?

The European Union (EU) offers an important case study for better understanding these dynamics. Although the UN framework is directed at UN Member States, the EU plays a significant role in operationalizing international commitments. While EU Member States retain exclusive competence in foreign and security policy, where the framework for responsible state behavior is discussed, many cyber-relevant areas either fall under shared or exclusive EU competences or are strongly shaped at the EU level, particularly in the internal market, justice, and home affairs domains. Cybersecurity has also become embedded across other EU policy areas, where states collaborate and align their approaches. This has produced a comprehensive cybersecurity policy ecosystem and a complex institutional architecture at the EU level, ⁷ much of which has emerged in the decade since the UN norms were formally adopted.

This makes the EU both a useful and a complex implementation arena for studying how states align, adopt, and adapt practices in order to comply with and/or shape collective international behavioral expectations. It also demonstrates how regional organizations can contribute to putting the UN framework into practice, while also revealing the limits and diversity that can accompany implementation across multiple legal and institutional settings.

To unpack how the EU implements the UN cyber norms in its law and policy practice, this paper first delves into the conceptual underpinnings of norms implementation (Chapter 3.1), reviews the current state of norms implementation mapping efforts (Chapter 3.2), and discusses key challenges to norms implementation (Chapter 3.3). It then examines two pathways of implementation at the EU level: internal and external. The internal pathway analyzes how the EU implements each of the UN cyber norms through EU-level legislation, policies, and institutional mechanisms (Chapter 4). The external pathway investigates how the EU supports the implementation of UN cyber norms in other parts of the world through cyber capacity building projects and initiatives (Chapter 5). ⁸

In assessing these pathways, the paper adopts a broad understanding of implementation. Rather than limiting implementation to explicit regional declarations, dedicated implementation strategies, or direct references to the UN framework, it also examines implicit EU-level implementation through regulatory frameworks, institutional arrangements, operational procedures, and capacity building initiatives. What matters for this analysis is not whether a given EU measure was adopted in the name of a specific UN norm, but how closely the measures adopted at the EU level align with that norm’s aims. This approach makes it possible to capture the ways in which regional governance can give practical effect to international commitments even where the connection remains indirect. This paper does not examine implementation activities at the EU Member State-level, including national legislation or activities falling within national prerogatives. This limit necessarily narrows the picture, but it also allows for a more rigorous assessment of what can presently be identified as EU-level contributions to norms implementation. The paper concludes with key takeaways for the EU (Chapter 6), reflecting on the insights that the EU’s experience with implementing the UN cyber norms may offer outside the EU context (Chapter 7), and providing recommendations for future EU engagement to advance norms implementation (Chapter 8).

Given the complexity and rapid evolution of EU cybersecurity policy, this paper should be read as a living document rather than as an exhaustive mapping exercise. At a time when the implementation debate in UN cybersecurity governance gained renewed momentum through the establishment of the permanent UN Global Mechanism on ICT Security (UN GMech), the objective of this paper is not to provide a definitive assessment of the EU’s compliance with the UN framework. Rather, it seeks to identify and assess existing implementation practices that contribute to the operationalization of the UN cyber norms, which can in turn feed into and inform intergovernmental deliberations. This matters because the effectiveness of the UN cyber framework increasingly depends less on negotiating new commitments than on embedding existing ones into regional and national practice and gaining a better understanding of how implementation takes place, including where it remains partial, uneven, or implicit.

From Norm Emergence to Norm Implementation

International relations scholars have long emphasized that norms evolve through processes of emergence, cascade, and internalization, and that practice, contestation, and social interaction shape their content. ⁹ Implementing the UN cyber norms is thus an inherently complex endeavor, as this process operates at the intersection of foreign and domestic policy. While states negotiate norms internationally, implementation depends on how they and regional organizations translate them into domestic and regional legislation, policies, institutional arrangements, operational procedures, and coordination mechanisms. To better understand what happens between norm emergence and norm implementation, the subsequent sections will delve into the conceptual underpinnings of norms implementation, review the status quo of norms implementation mapping efforts, and discuss key challenges to norms implementation.

Norms implementation as a process

The complexity surrounding the emergence and development of normative frameworks stems partly from the fact that implementation is not a one-way process in which states simply absorb internationally agreed norms at the domestic level. Rather, implementation and institutionalization unfold in parallel and mutually reinforce one another. This means that implementation can take place before, during, or after formal institutionalization, leading to different implementation trajectories across countries. It also means that not all states begin implementation from the same starting point and specific legal, political and societal circumstances will require local contextualization.

Broadly, this paper distinguishes three mechanisms (see Figure 2):

• Alignment, where states that contributed to shaping the norms effectively implement them by projecting their existing domestic practices onto the international level,

• Adoption, where states largely transpose the internationally agreed norms into domestic or regional frameworks with minimal modification, and

• Adaptation, where states tailor the norms to their specific legal, political, and institutional domestic contexts.

Figure 2: Mechanisms and sequencing in norms implementation

Differences in legal traditions, political priorities, institutional capacities, and administrative cultures may therefore result in divergent practices despite shared commitments. As the current international security environment shows, even when states subscribe to the same norms or incorporate them similarly into national legal systems, they do not necessarily implement those norms in the same way (adoption vs. adaptation). ¹⁰

In this respect, mapping national and regional implementation experiences can help clarify ambiguities, expose contestation, identify capacity gaps, and generate practice from which more robust and legitimate international understandings can emerge. Implementation therefore represents both a means of operationalizing norms and a mechanism through which they continue to evolve.

State of play in mapping norms implementation

Despite the UN cyber norms having existed for more than a decade, only a limited number of states have publicly articulated systematic approaches to implementation. Australia, ¹¹ Canada, ¹² Russia, ¹³ South Korea, ¹⁴ and the United Kingdom ¹⁵ – alongside a smaller cross-regional group of states advancing their interpretations of the due diligence norm (norm c) ¹⁶ – have published national position papers or implementation-oriented statements connecting domestic measures to specific norms. Within Europe, explicit implementation mapping remains limited. No EU Member State has yet published a comprehensive public mapping of how it implements the full catalog of UN norms. Czechia remains the only EU Member State – and also the only UN Member State overall – to have publicized its responses to the national implementation survey conducted by the United Nations Institute for Disarmament Research (UNIDIR). ¹⁷

Even though there have been limited systematic national efforts to map norms implementation to date, the 2021-2025 UN OEWG has contributed to greater regional engagement on the issue, as regional organizations are increasingly adopting more implementation-focused approaches. ¹⁸ In the area of norms implementation, the Association of Southeast Asian Nations (ASEAN) has emerged as one of the most active regional actors through the development of a norms implementation checklist, accompanied by targeted capacity-building activities, which it adopted and published in February 2025. ¹⁹ Similarly, in 2026, the African Union has advanced its thinking on developing guidelines on norms implementation. In July 2026, the EU will present its contribution on its implementation of the 11 norms of responsible state behavior, connecting each to examples of the EU cybersecurity policy acquis.

Challenges to norms implementation

While states have succeeded in institutionalizing norms through negotiated consensus language, translating these commitments into practical policies, institutional structures, and operational procedures has proven far more difficult. Capacity gaps, persistent divergences, and growing geopolitical tensions have constrained implementation efforts. This became particularly visible during the final phase of the 2021-2025 UN OEWG, where states were unable to substantively advance a proposed voluntary checklist on norms implementation. ²⁰

At the same time, a broader political debate on implementation persists within the UN process. While many states increasingly emphasize the need to prioritize the implementation of existing commitments, others – including Russia, Iran, and Cuba –  argue that implementation has become “overemphasized” and stress instead the need to continue developing new regulatory and legally binding instruments in parallel with technological change. ²¹ Other states, including EU Member States, have strongly opposed this position, maintaining that existing international law remains sufficient and that implementation should take precedence over negotiating additional commitments.

This divergence in views is also clearly recognized in the final report of the 2021-2025 OEWG, which notes that “the further development of norms, and the implementation of existing norms were not mutually exclusive but could take place in parallel.” ²² Therefore, states reached consensus on the purpose of the new permanent mechanism by mandating the Global Mechanism, in the area of norms, to facilitate discussions on “voluntary, non-binding norms of responsible State behavior and the ways for their implementation, recognizing that additional norms could be developed over time.” ²³

The implementation challenge is compounded by the nature of the norms themselves. Because the UN cyber norms are voluntary and only politically binding, implementation rarely follows a standardized or easily measurable pattern. Steps taken to put in place positive commitments, ²⁴ such as building resilience or supporting cooperation, are generally easier to identify than prohibitive norms ²⁵ that require restraint, non-use, or forbearance. Moreover, implementation is often implicit. States may operationalize elements of the UN framework through cybersecurity legislation, regulatory obligations, institutional mandates, incident response mechanisms, certification schemes, cybercrime cooperation, or capacity building initiatives without explicitly linking these measures to the UN norms themselves.

In this context, systematically mapping and documenting implementation practices becomes particularly important for the camp opposing the views of Russia and its like-minded partners. Demonstrating how states are already putting existing commitments into practice can help counter arguments that the current framework lacks practical relevance or cannot adequately address technological developments since the norms’ adoption in 2015.

Internal Implementation: How the EU Implements the UN Cyber Norms

To analyze how the EU implements the UN cyber norms internally, this paper focuses on three main mechanisms of implementation: (1) legislation, ²⁶ (2) policies, ²⁷ and (3) institutions and partnerships. The paper covers legislation already in force as well as published policy documents, institutional arrangements, and other relevant initiatives, but does not include measures still under deliberation. Although this framework is applied specifically to the EU context, this approach also offers a useful framework for undertaking a norms implementation status quo analysis in other regions and countries.

For each of the eleven norms, the following sections are organized into four parts. They begin with the original wording of the norm, followed by a set of key questions for assessing relevant EU implementation practices. ²⁸ Every section then summarizes the actions identified as supporting the norm’s objectives before discussing each corresponding EU-level measure in greater detail. The identified activities deliberately span various fields and dimensions, including strategic, policy, operational, technical, legal, and diplomatic areas, all of which are relevant to norms implementation given their broad nature. ²⁹

The Annex provides a tabular overview of the identified EU implementation activities. The identified activities do not constitute a normative assessment of what (other) states should do in implementing the UN cyber norms.

Interstate cooperation on ICT security (Norm A)

Consistent with the purposes of the United Nations, including to maintain international peace and security, States should cooperate in developing and applying measures to increase stability and security in the use of ICTs and to prevent ICT practices that are acknowledged to be harmful or that may pose threats to international peace and security.

Examples of activities that support the objective of enhancing interstate cooperation in the area of ICT security:

• Integrating international cooperation as a core pillar of cybersecurity strategies and other strategic or policy documents;

• Committing to and promoting the Framework for Responsible State Behavior in cyberspace;

• Establishing a national/regional framework for coordinated response to large-scale cyber incidents and crises;

• Developing a national/regional procedure for diplomatic responses to malicious cyber activities;

• Developing a national/regional posture in cyber defense;

• Articulating a national/regional position on the applicability of international law in the cyber context; and

• Engaging in bilateral, regional, and multilateral cooperation at technical, operational, and diplomatic levels.

The following sections provide an overview of the EU’s approach to implementing these activities.

—   Integration of international cooperation as a core pillar of regional cybersecurity strategies and other strategic or policy documents and commitment to and promotion of the Framework for Responsible State Behavior in cyberspace

International cooperation is one of the key pillars of the EU’s approach to secure its cyberspace and is reflected in many strategic and policy documents. The EU’s latest Cybersecurity Strategy ³⁰ adopted in 2020 clearly states that “international cooperation is essential to keeping cyberspace global, open, stable and secure.” Consequently, the strategy emphasizes that the EU should “work with international partners to promote a political model and vision of cyberspace grounded in the rule of law, human rights, fundamental freedoms and democratic values that bring social, economic and political development globally.” The EU Cybersecurity Strategy is also explicit about the need to advance responsible state behavior in cyberspace. In terms of concrete tools, the strategy proposes several regulatory and institutional solutions.

The EU’s vision and approach to international cooperation have been further refined in the policy document defining the EU’s Cyber Posture, adopted in 2022, which stresses the importance of “continued efforts to uphold and promote the UN Framework for responsible state behaviour” and underlines that “the EU and its Member States will actively work towards strengthening its implementation.”

The EU’s 2025 International Digital Strategy identifies the promotion of a high level of security for the EU and its partners as one of its three core objectives. In the field of cybersecurity, the strategy emphasizes that strengthening the cybersecurity and cyber defense capacities of partner countries would represent a direct investment in the EU’s own security. In this respect, support for EU candidate countries is highlighted as a particular geographic priority. In terms of cooperative measures, the strategy, inter alia, envisages advancing cyber dialogues with partner countries, continued cybersecurity cooperation by the European Union Agency for Cybersecurity (ENISA) with third countries, and the implementation of cyber capacity building projects worldwide (see Chapter 5 for a more detailed discussion on how EU-level capacity building initiatives support the implementation of the UN cyber norms).

—   Establishment of a regional framework for coordinated response to large-scale cyber incidents and crises

The guidance on the implementation of norm a by the 2019-2021 UN GGE highlights the establishment of crisis and incident management mechanisms as one of the means of putting the norm into practice. EU Member States retain the “primary responsibility for the response and remediation in case of a cybersecurity incident, a large-scale cybersecurity incident, or a cyber crisis affecting them.” ³¹ Nonetheless, under the NIS2 Directive, EU Member States are required to designate a national competent authority “responsible for the management of large-scale cybersecurity incidents and crises,” put in place a “national large-scale cybersecurity incident and crisis response plan,” ³² and “identify capabilities, assets and procedures that can be deployed in the case of a crisis.”

These responsibilities are complemented by the relevant provisions of the NIS2 Directive and by the EU’s Cyber Blueprint, which has provided a framework for coordinated responses to large-scale cyber incidents and crises, particularly those with cross-border implications, since 2017 and was updated by Member States in 2025. ³³ The Cyber Blueprint is complementary to existing EU crisis management mechanisms at the EU level such as the integrated political crisis response (IPCR) arrangements. It sets out the modalities and responsibilities of actors at technical, operational, and political levels to clarify interactions among EU Member States’ structures, coordination bodies, and EU institutions, bodies, and agencies across stages ranging from preparedness, detection, and response to public communication and lessons learned.

The European Cyber Crisis Liaison Organisation Network (EU-CyCLONE), formally established through the NIS2 Directive in 2023 (launched already in 2020), supports the coordinated management of large-scale cybersecurity incidents and crises within the European Union. EU-CyCLONe comprises the national cyber crisis management authorities designated by all EU Member States, with the European Commission participating in an observational capacity. Its tasks include “assess[ing] the consequences and impact of relevant large-scale cybersecurity incidents and crises and propos[ing] possible mitigation measures,” as well as “support[ing] decision-making at political level in relation to such incidents and crises.”

—   Development of a regional procedure for diplomatic responses to malicious cyber activities

The Cyber Diplomacy Toolbox adopted by EU Member States in 2017 (with implementation guidelines revised in 2023) provides a detailed overview of tools and instruments at the EU’s disposal to jointly respond to and advance cooperation with third countries in cases of malicious cyber operations against the EU and its allies. ³⁴ The toolbox, inter alia, includes preventive, cooperative, stability, and restrictive measures ranging from awareness raising on EU policies to coordinating political attribution of a cyber operation or campaign. The guidelines lay out a nine step-process for the development of a common EU position. ³⁵ The 2023 guidelines further note the added value of further exploring strengthened cooperation with non-EU countries, private sector entities, and international organizations. Concerning EU-NATO cooperation, the 2023 guidelines stress “possible coordinated responses to malicious cyber activities [... and] seek[ing] potential synergies between the respective crisis management frameworks in the field of cybersecurity,” among other fields for inter-institutional collaboration. Member States and involved EU institutions, bodies and agencies (EUIBAs) commit to “test[ing their] response to scenarios developed on the basis of regular EU risk assessment” once a year in the framework of an “annual dedicated Cyber Diplomacy Toolbox exercise.” EU Member States have used the toolbox for diplomatic responses in support of third countries such as Georgia, ³⁶ Ukraine, ³⁷ the United Kingdom, ³⁸ and Australia. ³⁹ Many declarations and statements issued by the EU in this context make explicit references to the UN framework for responsible state behavior.

—   Development of a regional posture on cyber defense

In addition, the EU has adopted several documents in the area of cyber defense, prescribing the roles and responsibilities of different institutions and mechanisms within the EU and at the national level. ⁴⁰ In 2018, the EU identified cyberspace as a fifth domain of operations. ⁴¹ The EU’s Military Vision and Strategy on Cyberspace as a Domain of Operations and the review of the Cyber Defence Policy Framework (CDPF), established in 2014 and updated in 2018 and 2022, are particularly relevant in this context. The latest 2022 EU Policy on Cyber Defence is built around four pillars aimed at (1) increasing information exchange and cooperation between military and civilian cybersecurity communities by reinforcing EU coordination mechanisms among national and EU cyber defense players, (2) protecting the defense sector from malicious cyber operations by introducing cybersecurity standardization and certification to secure both military and civilian domains, (3) improving cyber defense capabilities, and (4) setting up tailored partnerships in the area of cyber defense. ⁴²  The EU tracks the implementation of its Policy on Cyber Defence through the Cyber Census annually, of which the executive summary is publicly available. ⁴³

At the institutional level, the European Defence Agency (EDA) is responsible for advancing the EU’s cyber defense cooperation and supports Member States’ capability development also in the area of cyber defense. For example, the EDA supports the creation of a risk management model for cybersecurity in the context of military capability supply chains, the establishment of the Cyber Ranges Federation project, as well as the development of specific capabilities for Advanced Persistent Threat (APT) detection and cyber situational awareness. ⁴⁴ The EDA is also responsible for managing the Military Computer Emergency Response Team Operational Network (MICNET), which brings together military CSIRTs of EU Member States. ⁴⁵

—   Articulation of a regional position on the applicability of international law in the cyber context

In 2024, the EU adopted a Declaration on a Common Understanding of International Law in Cyberspace. The declaration directly implements norm a as well as the normative framework as a whole. Through the declaration, the “EU and its Member States reaffirm their full commitment to, and stress the importance of the full implementation of, the United Nations framework of responsible State behaviour in cyberspace, adopted by consensus by the United Nations General Assembly, which affirms inter alia that, international law, in particular the UN Charter, international human rights law and international humanitarian law, fully applies to cyberspace.” The declaration further elaborates the EU’s view on how specific principles and rules of international law apply in the cyber context, such as the principles of state sovereignty and non-intervention or the prohibition of the use of force.

—   Involvement in bilateral, regional, and multilateral cooperation at technical, operational, and diplomatic levels

Additional important cooperation mechanisms are cyber dialogues between the EU and key international partners, including Brazil, China, India, Japan, South Korea, Ukraine, the United Kingdom, and the United States. These dialogues are used to advance cooperation in areas such as cyber diplomacy, crisis management, capacity building, or cybersecurity of critical infrastructure. Certain elements of cyber diplomacy and norms implementation are also discussed in non-cyber specific formats such as bilateral Digital Partnerships and Digital Dialogues, as well as the EU-LAC Digital Alliance and the EU-Western Balkans Regulatory Dialogue. These engagements contribute to norms implementation through addressing topics such as trusted connectivity and resilience of digital infrastructures.

Since 2024, and as of July 2026, the EU has signed 12 security and defence partnerships with Moldova, Norway, Japan, South Korea, North Macedonia, Albania, the United Kingdom, Canada, India, Iceland, Australia, and Ghana. ⁴⁶ The provisions of all of these partnerships also underscore a mutual commitment to multilateral, regional, and bilateral cooperation on cybersecurity governance. ⁴⁷

At the regional level, the EU maintains a partnership with the Organization for Security and Co-operation in Europe (OSCE), which contributes to the maintenance of international peace and security particularly through its 16 agreed cyber CBMs. As a “CBM adopter,” the EU together with three OSCE participating states is especially driving the implementation of CBM 12 that prescribes to “act jointly to reduce tensions.” ⁴⁸

In terms of cross-regional partnerships, the EU and NATO are holding an annual structured dialogue to enhance their collaboration. ⁴⁹ The European Commission and ENISA also participate in the G7 Cybersecurity Working Group. ⁵⁰ The EU is also part of the ASEAN Regional Forum, where it is involved, inter alia, in the development and implementation of cyber CBMs. ⁵¹

These platforms are also used for strengthening cooperation regarding most recent technological developments. In addition to several concrete measures addressing the risks posed by frontier AI models, the EU Action Plan on Cybersecurity and Artificial Intelligence presented in July 2026 highlights the importance of international cooperation to avoid fragmentation, promote interoperability, and pool efforts to mitigate cybersecurity risks associated with AI. ⁵² It explicitly mentions the existing digital partnerships, digital dialogues, or cyber dialogues as instruments to deepen exchanges with partner countries on advanced AI and cybersecurity.

Enhancing interstate cooperation on cybersecurity is a core responsibility of the European External Action Service (EEAS), the EU’s diplomatic service with a network of delegations around the globe. The EEAS plays a central coordination role in the EU’s external action, supporting the High Representative and ensuring consistency between EU policies and Member States’ diplomatic efforts. This includes fostering multilateral and cross-regional engagement, such as representing the EU in the Global Mechanism and convening dialogues with other regions. The EEAS is also involved in coordinated crisis response through mechanisms such as the EEAS Crisis Response Mechanism and its role in the application of the Union’s Cyber Diplomacy Toolbox.

In 2023, the European cybersecurity agency ENISA concluded working arrangements with authorities in Ukraine ⁵³ and the United States, which it continues to maintain. ⁵⁴

Considering all relevant information in case of ICT incidents (Norm B)

In case of ICT incidents, States should consider all relevant information, including the larger context of the event, the challenges of attribution in the ICT environment and the nature and extent of the consequences.

Examples of activities that support the objective of considering all relevant information in case of ICT incidents:

• Designating national CSIRTs, inter alia, responsible for detecting and responding to ICT incidents;

• Establishing regional technical and operational information-sharing mechanisms, including between national CSIRTs;

• Introducing incident reporting obligations;

• Developing capabilities for coordinated regional and intraregional detection and situational awareness of ICT incidents;

• Articulating a national/regional approach to attribution, including the possible pursuit of joint regional attribution;

• Seeking the peaceful settlement of disputes arising from ICT incidents; and

• Adopting guidance on the classification of ICT incidents.

The following sections provide an overview of the EU’s approach to implementing these activities. It should be noted that the political nature of attribution implies that it remains the sole prerogative of individual Member States and they must act unanimously for the EU as a whole to proceed with attribution.

—   Designation of national CSIRTs, inter alia, responsible for detecting and responding to ICT incidents

Under the NIS2 Directive – and previously under its predecessor, the NIS1 Directive from 2016 – EU Member States are required to establish or designate at least one national CSIRT. The Directive also specifies their tasks, including “collecting and analysing forensic data and providing dynamic risk and incident analysis and situational awareness regarding cybersecurity.” ⁵⁵ This ensures that Member States have dedicated institutional capacity to consider all relevant information in the context of ICT incidents, including forensic evidence and the broader operational context.

—   Establishment of regional information-sharing mechanisms, including between national CSIRTs

The EU has put in place a range of regional information-sharing mechanisms at the technical and operational levels that enable the incorporation of multiple sources of information into the assessment of ICT incidents. The EU’s Cyber Posture also stresses the importance of improving the EU’s information-sharing mechanisms between relevant bodies to improve understanding of the cyber threat landscape, including through regular engagements with the private sector. ENISA contributes, inter alia, by producing regular EU cybersecurity situation reports, which aim to support a shared understanding of the threat landscape. ⁵⁶ The CSIRTs Network facilitates the exchange of information between EU Member States’ national CSIRTs on incidents, cyber threats, risks, and vulnerabilities, enabling authorities to draw on inputs from multiple national and technical sources when assessing an incident. ⁵⁷ To support the response to large-scale incidents, the EU has also established a cyber crisis liaison organization network for the national authorities of Member States in charge of cyber crisis management: EU-CyCLONe. The network supports common situational awareness and the assessment of the consequences and impacts of cybersecurity crises. ⁵⁸ CERT-EU also contributes by sharing information on incidents, threats, vulnerabilities, and near misses relevant to EU institutions. ⁵⁹ Furthermore, the EEAS, including through structures such as EU INTCEN ⁶⁰ and the Hybrid Fusion Cell, is equipped to provide additional analytical input

—   Enactment of incident reporting obligations

The EU has established obligations for various entities to report incidents to national competent authorities and/or CSIRTs. This is important for the implementation of norm b because incident-related data from multiple sectors and jurisdictions can improve the completeness and reliability of the information available during the assessment of an incident. The NIS2 Directive prescribes that essential or important entities belonging to 18 sectors (see also Table 1 in Chapter 4.7), including public administration bodies, must notify a significant incident and provide specific information over particular timeframes. The required information should enable EU Member States to determine any cross-border impact of the incident.

Upon assessing an incident’s significance, EU Member States shall, where appropriate, inform other EU Member States and ENISA of the incident, especially when the significant incident concerns two or more Member States. ⁶¹ National Single Points of Contact must share a summary report with ENISA every three months. ⁶² This report shall include “anonymised and aggregated data on significant incidents, incidents, cyber threats and near misses notified.” ⁶³ In turn, ENISA is tasked with briefing the NIS Cooperation Group and the CSIRTs Network about its findings on notifications twice a year. ⁶⁴ Apart from incident reporting obligations, EU Member States shall also encourage the voluntary exchange of information ⁶⁵ among essential and important entities “through cybersecurity information-sharing arrangements in respect of the potentially sensitive nature of the information shared.” ⁶⁶

Other information-sharing and incident reporting rules for specific sectors exist in the framework of the Critical Entities Resilience Directive, the Digital Operational Resilience Act and the Network Code on sector-specific rules for cybersecurity aspects of cross-border electricity flows. The EUIBAs Regulation establishes similar rules for the reporting of incidents within EUIBAs to CERT-EU.

—   Development of capabilities for coordinated regional and intraregional detection and common situational awareness of ICT incidents

In order to be able to consider all relevant information, states must have the capacity to detect ICT incidents and possess comprehensive situational awareness. Even though it remains primarily a national competence, the EU has introduced legislation to help accelerate this objective. The EU’s Cyber Solidarity Act (CSOA) seeks to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cyber threats and incidents. One of its measures includes the establishment of a Cybersecurity Alert System, which is a pan-European network of infrastructure that consists of National Cyber Hubs and Cross-Border Cyber Hubs ⁶⁷ with the objective of enhancing capabilities for coordinated detection and common situational awareness, inter alia, by “pool[ing] relevant data and information on cyber threats and incidents.” This collaboration within and across cross-border cyber hubs can support states in developing a more comprehensive and contextual understanding of ICT incidents, as called for in norm b. Designating a national cyber hub and participating in a cross-border cyber hub is voluntary for EU Member States.

—   Articulation of a regional approach to attribution, including the possible pursuit of joint regional attribution

The Cyber Diplomacy Toolbox outlines the EU’s approach to attribution, which remains a sovereign political decision of each Member State. Even though every Member State makes its own determination with respect to the attribution of malicious cyber activity, this understanding at the EU level is central to allow Member States to take (joint) action. Importantly, the CDT does not attempt to harmonize different methods, procedures, definitions, and criteria for attribution at the national level. Instead, it aims to facilitate the decision-making process at the EU level, including collective assessment of information and developing a shared situational awareness. Measures that are ultimately taken in response to malicious cyber activity also depend on the degree of certainty that can be established in a particular case. In cases where the Member States reach a shared assessment of the situation, they might proceed with a collective attribution and/or coordinate an attribution statement. Available tools also comprise the issuance of diplomatic démarches. ⁶⁸

The CDT’s implementing guidelines provide further details about the EU’s approach to attribution. ⁶⁹ When discussing the appropriateness of coordinating political attribution and whether it should be done privately or publicly, the EU takes into account the following elements: ⁷⁰

• “[…] desired effect of the political attribution contribution to the protection of the integrity and security of the EU, its Member States and their citizens and businesses;

• importance of showing unity within the EU and between its Member States or solidarity with a third party;

• contribution to the advancement of responsible state behaviour, including compliance with international law and respect for voluntary norms;

• ability to influence the behaviour of malicious actors in cyberspace;

• impact on the ongoing work of services such as law enforcement or intelligence services;

• likelihood and impact of a counter-response by any actor (risk of escalation);

• consequences for existing EU external relations, at the international, regional and bilateral levels;

• reputation and credibility of the EU (risk of the bystander effect, risk of manipulation, precedence of a malicious cyber activity);

• predictability and coherence of joint EU responses in previous and/or future cases.”

Although the EU recognized that there is no international legal obligation to reveal evidence on which attribution is based prior to taking an appropriate response, the EU does acknowledge that attribution should be based on an analysis of technical data and all-source intelligence, including the possible interests of the perpetrator. The decision-making process for responding on the basis of an attribution made by one or more EU Member States is discussed in the Horizontal Working Party on Cyber Issues. It also involves the Council’s Political and Security Committee if political guidance is needed, other regional and thematic Council working groups if required, and the Foreign Relations (RELEX) Counsellors Working Party in cases where the EU may opt for imposing restrictive measures. The Court of Justice of the EU plays an important role in ensuring that the addressees of the EU measures (especially sanctions) have received all the necessary information and that the process has followed the rule of law standards.

— Recognition of the need to seek the peaceful settlement of disputes arising from ICT incidents

In addressing responses to an malicious ICT activity attributable to another state, the 2024 EU Declaration on a Common Understanding of International Law in Cyberspace emphasizes that “the parties to any dispute, especially if the continuance of that dispute is likely to endanger the maintenance of international peace and security, shall seek a solution by peaceful means [as reflected in Articles 2(3) and 33(1) of the UN Charter]. Peaceful means include diplomatic measures, recourse to negotiation, mediation, conciliation, arbitration, judicial settlement or any other peaceful means of dispute resolution of their own choice.”

— Adoption of guidance on the classification of ICT incidents

The implementation of this norm is also supported by the 2018 Cybersecurity Incident Taxonomy of the EU’s NIS Cooperation Group, which categorizes the root cause and severity of threats in terms of the nature of the incident, as well as the affected sectors, scale, and outlook, to evaluate the incident’s impact. This taxonomy can help authorities assess “the severity and replicability of an ICT incident,” as mentioned in the 2021 OEWG guidance as a means of operationalization. ⁷¹

Preventing misuse of ICTs (Norm C)

States should not knowingly allow their territory to be used for internationally wrongful acts using ICTs.

Examples of activities that support the objective of preventing the misuse of ICTs in a state’s territory:

• Designating national CSIRTs inter alia, responsible for detecting and responding to ICT incidents;

• Establishing regional information-sharing mechanisms, including between national CSIRTs;

• Developing capabilities for coordinated regional and intraregional detection and situational awareness of ICT incidents;

• Criminalizing wrongful acts involving the misuse of ICTs;

• Adopting standards and procedures concerning the export of cyber-surveillance tools;

• Articulating a national/regional understanding of the applicability of the principle of due diligence in the cyber context.

The following sections provide an overview of the EU’s approach to implementing these activities.

— Designation of national CSIRTs, inter alia, responsible for detecting and responding to ICT incidents

Under the NIS2 Directive, EU Member States are required to establish or designate at least one national CSIRT (see also the section on norm b). This obligation supports norm c by mandating states to build the institutional and technical capacities necessary to detect, analyze, and respond to adverse cyber activities originating from or transiting through their territory.

—   Establishment of regional information-sharing mechanisms, including between national CSIRTs

The EU’s information-sharing and situational awareness actors and mechanisms (including those discussed in the section on norm b) support the aggregation and exchange of technical, operational, and intelligence information relevant to adverse cybersecurity events and incidents. They also provide options for joint response action through Union crisis frameworks. These established channels of trusted information-sharing and cooperation can contribute to reducing the likelihood that malicious ICT activities originating from or transiting through Member States’ territory remain unnoticed and ultimately unaddressed.

— Development of capabilities for coordinated regional and intraregional detection and common situational awareness of ICT incidents

Fulfilling the due diligence obligation contained in this norm presupposes sufficient detection capacity and cooperation with actors such as internet service providers and other relevant entities, so that states can either detect internationally wrongful acts originating from their territory themselves or be informed by others. As discussed in more detail in the section on the EU’s implementation of norm b, the EU Cyber Solidarity Act seeks to enhance the Union’s overall capabilities in this regard, inter alia, through the establishment of a Cybersecurity Alert System, a pan-European network of infrastructure that consists of National Cyber Hubs and Cross-Border Cyber Hubs.

—   Criminalization of wrongful acts involving the misuse of ICTs

The primary aim of norm c is to ensure that states put in place mechanisms – regulatory and institutional – that would prohibit any internationally wrongful activities from originating in EU territory. In the EU context, this has been primarily done by criminalizing misuse of ICTs (see further the section on norm d) as well as putting in place the necessary institutional framework that would strengthen the awareness of the EU and Member State agencies about cyber activities in the EU territory – both those originating inside and outside.

—   Adoption of standards and procedures concerning the export of cyber-surveillance tools

Another dimension of ensuring that territories are not used for malicious activities against other states is reflected in the adoption of concrete standards and procedures, for instance, regarding trade in dual use goods or the production and exports of cyber surveillance tools. To that effect, the EU’s export control regime ⁷² puts in place a comprehensive framework of regulations and institutions to ensure common export control rules, including a common set of assessment criteria and common types of authorizations (individual, global and general authorizations). In addition, the EU General Export Authorizations (EUGEAs) apply to exports of dual-use items to certain destinations under certain conditions, including telecommunications, intra-group technology transfers, and encryption. ⁷³

— Articulation of a regional understanding of the applicability of the principle of due diligence in the cyber context

There are limited EU policy documents explicitly mentioning the due diligence principle. Most importantly, the EU’s 2024 Declaration on a Common Understanding of International Law in Cyberspace reaffirms its applicability in the cyber context. Referencing the International Court of Justice’s 1949 Corfu Channel judgment, EU Member States note the following: “as States have jurisdiction over ICT infrastructure and individuals as referred to in Section 1 above [Section 1 discusses the principle of state sovereignty], they are required to make efforts that this ICT infrastructure is not used by non-State or State actors for acts contrary to the rights of other States, once they know or ought to have known of such activities. States are required to take all appropriate and reasonably available and feasible measures, in the given context, to act against cyber operations that violate rights of another State under international law. The same duty applies for cyber activities within the territory or ICT infrastructure that they otherwise effectively control. If a State does not act with due diligence in relation to cyber activities within or using ICT infrastructure located in its territory, it may commit an internationally wrongful act. At the same time, the due diligence obligation does not require preventive monitoring of all cyber activities and ICT infrastructure in the territory of a State or within its effective control.”

Already earlier in 2018, EU Member States had highlighted the importance of “not us[ing] proxies to commit internationally wrongful acts using ICTs, and [that states] should seek to ensure that their territory is not used by non-state actors to commit such acts” in their Council Conclusions on malicious cyber activities.

Cooperation to stop use of ICTs for crime and terrorism (Norm D)

States should consider how best to cooperate to exchange information, assist each other, prosecute terrorist and criminal use of ICTs and implement other cooperative measures to address such threats. States may need to consider whether new measures need to be developed in this respect.

Examples of activities that support the objective of cooperating across borders to stop the use of ICTs for criminal and terrorist purposes:

• Developing a national/regional framework for the criminalization of wrongful acts involving the misuse of ICTs;

• Developing a national/regional framework to prevent the use of ICTs for terrorist purposes;

• Establishing national/regional law enforcement institutions and coordination structures to cooperate to stop cybercrime;

• Adopting rules to facilitate practical cooperation between judicial and law enforcement authorities;

• Participating in and promoting international instruments to fight criminal and terrorist use of ICTs.

The following sections provide an overview of the EU’s approach to implementing these activities.

—   Development of a regional framework for the criminalization of wrongful acts involving the misuse of ICTs

The EU implements norm d by putting in place a legal framework that aims to improve the prevention, investigation, and prosecution of cybercrime and child sexual exploitation, strengthens capacity across the criminal justice system, and creates modalities for cooperation with industry. The origins of this framework date back to the early 1990s when the discussions about ICT and information security first emerged and therefore predate the formal institutionalization of norm d.

The EU’s legal framework to fight the criminal use of ICTs focuses primarily on three broad categories of crimes: ⁷⁴

• Crimes specific to the internet: The EU’s 2013 Directive on attacks against information systems aims to tackle large-scale malicious cyber activity by criminalizing core offences including illegal access to information systems, illegal system interference, illegal data interference, and illegal interception, as well as the production, sale, or distribution of tools designed to commit these offences, and the incitement, aiding, and abetting of such conduct. It also establishes cooperation obligations for Member States, requiring them to designate an operational national point of contact, using a 24/7 network for information sharing on offences, and responding to urgent requests for assistance in a timely manner.

• Online fraud and forgery, through instruments such as identity theft, phishing, spam and malicious code: In 2019, with the Directive on combating fraud and counterfeiting of non-cash means of payment, the EU updated its legal framework to remove obstacles to operational cooperation, enhance prevention and victims’ assistance, and make law enforcement action against fraud and counterfeiting of non-cash means of payment more effective.

• Illegal online content, including child sexual abuse material, incitement to racial hatred, incitement to terrorist acts and glorification of violence, terrorism, racism and xenophobia: In 2011, the EU adopted the Directive on combating the sexual exploitation of children online and child pornography.

— Development of a regional framework to prevent the use of ICTs for terrorist purposes

To address the challenges posed by the dissemination of terrorist content online, the EU adopted Regulation 2021/784. The Regulation aims to ensure the smooth functioning of the digital single market in an open and democratic society by addressing the misuse of hosting services for terrorist purposes and contributing to public security across the EU. For example, any hosting service provider offering its services in the EU must take active steps to remove terrorist content on its platforms within one hour, once they are alerted by national competent authorities. The law stresses the importance of ensuring that any such efforts need to strengthen safeguards to the freedom of expression, including the freedom to receive and impart information and ideas in an open and democratic society and the freedom and pluralism of the media.

— Establishment of regional law enforcement actors and coordination structures to cooperate to stop cybercrime

The EU’s legal and policy framework is accompanied by a robust institutional architecture. At the center of this system is Europol’s European Cybercrime Centre (EC3), set up in 2013 to bolster the response of law enforcement to cybercrime in the EU and help protect European citizens, businesses and governments. ⁷⁵ The EC3 offers operational, strategic, analytical and forensic support to Member States’ investigations. It performs several functions, such as:

• serving as the central hub for criminal information and intelligence;

• supporting operations and investigations by Member States by offering operational analysis, coordination, and expertise;

• providing highly specialized technical and digital forensic support capabilities to investigations and operations;

• offering support to EU crisis management structures, within the scope of Europol’s mandate, and facilitating the operational, technical and strategic collaboration between law enforcement agencies (LEAs) and other relevant cyber communities and EU institutions, bodies and agencies (e.g. Eurojust, EEAS, ENISA, CERT-EU, Commission, Council, etc.);

• delivering 24/7 operational and technical support to LEAs for immediate reaction to urgent cyber incidents and/or cyber crises via stand-by duty and the EU Law Enforcement Emergency Response Protocol (EU LE ERP); ⁷⁶

• supporting training and capacity building; ⁷⁷

• producing a variety of strategic analysis products that enable informed decision-making on combating and preventing cybercrime;

• maintaining a comprehensive outreach function connecting law enforcement authorities tackling cybercrime with the private sector, academia and other non-law enforcement partners.

The EC3 publishes an annual Internet Organised Crime Threat Assessment (IOCTA). ⁷⁸ The EC3 also hosts the Joint Cybercrime Action Taskforce (J-CAT) whose mission is to drive intelligence-led, coordinated action against key cybercrime threats through cross-border investigations and operations by its partners. ⁷⁹ J-CAT brings together representatives of EU Member States as well as other third countries and also cooperates with the private sector. J-CAT has conducted several high-profile operations aimed at dismantling cybercrime networks and infrastructure (see further the section on norm d).

Alongside Europol, other EU agencies play important roles in judicial and operational cooperation on cybercrime. The EU established the European Union Agency for Criminal Justice Cooperation (Eurojust) in 2002 to support the coordination of cross-border criminal investigations and prosecutions, including in cybercrime cases. It facilitates information exchange, linking national investigations, and promotes joint investigative action. Eurojust also contributes to strategic and legal analysis through publications such as the Cybercrime Judicial Monitor and supports practitioner cooperation through the European Judicial Cybercrime Network. ⁸⁰ Meanwhile, eu-LISA, established in 2011, manages the EU’s large-scale IT systems supporting the Area of Freedom, Security and Justice and contributes to internal security through platforms such as the Joint Investigation Teams Collaboration Platform and e-CODEX.

In addition, the EU has developed several collaborative mechanisms to enhance coordinated action against cybercrime and organized crime. The European Union Cybercrime Task Force (EUCTF) functions as a network of national cybercrime units, EU institutions, and associated non-EU countries (currently Denmark, Iceland, Norway, Switzerland, and the United Kingdom), aiming to promote a harmonized EU approach to combating cybercrime and identifying common operational priorities. ⁸¹ The EU has also established the European Multidisciplinary Platform Against Criminal Threats, EMPACT, for combating serious and organized international crime through four-year policy cycles. ⁸² EMPACT brings together Member States, EU agencies as well as associated third countries, international organizations, and private-sector partners. The current 2026-2029 EMPACT cycle identifies cyberattacks, online child sexual exploitation, and online fraud among its key priorities.

— Adoption of intraregional rules to facilitate practical cooperation between judicial and law enforcement authorities

The EU has also taken steps to facilitate practical cooperation between judicial and law enforcement authorities within the EU. This includes rules for cross-border access to electronic evidence in accordance with fundamental rights, privacy, and due process. Through the e-evidence package, the EU has introduced measures aimed at “mak[ing] it easier and faster for law enforcement and judicial authorities to obtain the electronic evidence they need to investigate and eventually prosecute criminals.” ⁸³  

In that regard, Regulation 2023/1543 introduced two new cooperative mechanisms at the EU level:

• a European Production Order that allows a judicial authority in one Member State to obtain electronic evidence (such as emails, text or messages in apps, as well as information to identify a perpetrator as a first step) directly from a service provider or its legal representative in another Member State;

• a European Preservation Order that allows a judicial authority in one Member State to request that a service provider or its legal representative in another Member State preserve specific data in view of a subsequent request to produce this data via mutual legal assistance, a European Investigation Order or a European Production Order.

Other EU legislation supports cross-border cooperation through additional instruments. They include a voluntary Joint Investigation Teams collaboration platform to facilitate cooperation between competent authorities, including in cybercrime cases ⁸⁴ and the e-CODEX system, ⁸⁵ which enables secure electronic exchange of data in civil and criminal judicial cooperation.

—   Participation in and promotion of international instruments to fight criminal and terrorist use of ICTs

To a large extent, the EU’s approach on international cooperation in the area of cybercrime is built around different provisions of the Council of Europe Convention on Cybercrime (Budapest Convention), which the EU supports as the main international instrument to guide cooperation at the international level. ⁸⁶ All EU Member States are parties to the Budapest Convention. In October 2025, the EU signed the UN Convention against Cybercrime. ⁸⁷

To tackle specific forms of cybercrime and terrorist use of ICTs through international cooperation, the EU participates in several multilateral initiatives. The EU is a member of the International Counter Ransomware Initiative (CRI), which seeks to strengthen global cooperation against ransomware operations through coordinated policy responses, information-sharing, and capacity building. ⁸⁸ The European Commission is a supporter of the Christchurch Call to eliminate terrorist and violent extremist content online. ⁸⁹

Respecting human rights and privacy (Norm E)

States, in ensuring the secure use of ICTs, should respect Human Rights Council resolutions 20/8 and 26/13 on the promotion, protection and enjoyment of human rights on the Internet, as well as General Assembly resolutions 68/167 and 69/166 on the right to privacy in the digital age, to guarantee full respect for human rights, including the right to freedom of expression.

Examples of activities that support the objective of respecting human rights and privacy in the digital age:

• Adopting policies and establishing institutions that promote and protect human rights and fundamental freedoms online and offline;

• Enacting data protection legislation ensuring respect for the right to privacy in the digital age;

• Adopting legislation governing the use of personal data for law enforcement purposes;

• Establishing standards and procedures to ensure compliance with human rights obligations when cyber-surveillance items are exported; and

• Articulating a regional position on the applicability of international human rights law in the cyber context.

The following sections provide an overview of the EU’s approach to implementing these activities.

— Commitment to the promotion and protection of human rights and fundamental freedoms online and offline

The EU Cybersecurity Strategy states clearly that the EU should lead on the protection and promotion of human rights and fundamental freedoms online. To this end, the EU seeks to promote further compliance with international human rights law and standards, as well as operationalizing its Action Plan on Human Rights and Democracy for years 2020-2027, and advance its Human Rights Guidelines on Freedom of Expression Online and Offline. ⁹⁰ Furthermore, the strategy stresses that the EU should make sustained efforts to protect human rights defenders, civil society and academia working on issues such as cybersecurity, data privacy, surveillance and online censorship.

At the core of the EU’s approach is the commitment to the right to protection of their personal data and putting in place robust legal and institutional framework to protect privacy of the EU citizens. The right to privacy is explicitly listed in the EU Charter of Fundamental Rights and in the European Declaration on Digital Rights and Principles, which “puts people at the centre, in line with EU values and fundamental rights.”  The Court of Justice of the European Union and the European Court of Human Rights are important players in the EU’s legal landscape in that they ensure respect for the existing international human rights regime by individual Member States.

— Enactment of data protection legislation ensuring respect for the right to privacy in the digital age

At the center of the EU’s legal framework is the General Data Protection Regulation (GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. The regulation is an essential step toward strengthening individuals’ fundamental rights in the digital age and facilitating business by clarifying rules for companies and public bodies operating in the digital single market. ⁹¹

At the institutional level, the European Data Protection Supervisor (EDPS) serves as an independent EU body responsible for monitoring the application of data protection rules within European institutions and for investigating complaints. ⁹² In addition, the European Data Protection Board (EDPB) is an independent European body established to ensure the consistent application of data protection rules throughout the EU. The EDPB is composed of representatives from the national data protection authorities of the EU/EEA countries and the EDPS. The EDPB tasks consist primarily in providing general guidance on key concepts of the GDPR and the Data Protection Law Enforcement Directive (see below), advising the European Commission on issues related to the protection of personal data and new proposed legislation, and adopting binding decisions in disputes between national supervisory authorities.

— Adoption of legislation governing the use of personal data for law enforcement purposes

The Data Protection Law Enforcement Directive protects citizens’ fundamental right to data protection whenever personal data is used by criminal law enforcement authorities for law enforcement purposes. It particularly aims to ensure that the personal data of victims, witnesses, and suspects of crime are duly protected and facilitate cross-border cooperation in the fight against crime and terrorism. ⁹³

— Establishment of standards and procedures to ensure compliance with human rights obligations when cyber-surveillance items are exported

The EU addresses the importance of upholding human rights obligations also in the context of its export control regime of dual-use items. As a particular category of these dual-use items, the Regulation includes ‘cyber-surveillance items,’ which it defines as “dual-use items specially designed to enable the covert surveillance of natural persons by monitoring, extracting, collecting or analysing data from information and telecommunication systems.” ⁹⁴ As a general rule, all items contained in Annex I of the Regulation require prior authorization. Annex I specifies ten categories of items in detail, one titled telecommunications and information security (category five).

Concerning cyber-surveillance items not included in Annex I, export authorization is required “if the exporter has been informed by the competent authority that the items in question are or may be intended, in their entirety or in part, for use in connection with internal repression and/or the commission of serious violations of human rights and international humanitarian law.” ⁹⁵ Exporters themselves shall notify their respective competent authority in EU Member States, if they are “aware, according to [their] due diligence findings” that the proposed export of such items may “in their entirety or in part” serve any of the above-mentioned use cases. On that basis, Member States, via their competent authorities, “shall decide whether or not to make the export concerned subject to authorisation.” ⁹⁶ To help exporters make such determinations, the Commission has published non-binding guidelines in 2024. ⁹⁷

—   Articulation of a regional position on the applicability of international human rights law in the cyber context

The EU’s 2024 Declaration on a Common Understanding of International Law in Cyberspace underscores the EU’s commitment to promote and protect the enjoyment of human rights online. To that end, EU Member States highlight that “states must comply with their obligations under international human rights law online just as offline. States are under a negative obligation to refrain from acting in violation of human rights, as well as a positive obligation to actively protect the rights of persons within their jurisdiction against such violations.” In the same vein, EU Member States emphasize that their protection is especially important in the cyber context, where the freedom of opinion and expression, the right to privacy, the freedom to seek, receive, and impart information, the freedom of peaceful assembly and association, the prohibition of discrimination and the rights of the child “might be particularly at risk.”

Not damaging critical infrastructure (Norm F)

A State should not conduct or knowingly support ICT activity contrary to its obligations under international law that intentionally damages critical infrastructure or otherwise impairs the use and operation of critical infrastructure to provide services to the public.

Examples of activities that support the objective of not intentionally damaging critical infrastructure:

• Putting in place rules and processes for designating critical infrastructure sectors;

• Articulating a national/regional understanding on the applicability of international law in the cyber context;

• Developing a national/regional position and doctrine on cyber defense; and

• Establishing a cyber command and regional platforms for cooperation and information exchange between cyber commands and military CSIRTs.

Given that EU Member States have full competence over their national security, the EU’s role in the implementation of the UN cyber norms of a prohibitive nature is rather limited. Nonetheless, the EU has taken certain measures that provide an overall framing for its Member States’ behavior in cyberspace, including on aspects related to the objective of norm f. The following sections provide an overview of the EU’s approach to implementing these activities.

—   Regional designation of critical infrastructure sectors ⁹⁸

The NIS2 Directive and the Critical Entities Resilience (CER) Directive identify sectors of critical importance (see further section on norm g). While the designation of critical infrastructure and respective entities remains a national prerogative and there is no agreed upon international definition on what constitutes critical infrastructure, these instruments establish a shared EU-level baseline reference point that could also possibly indirectly be used to guide operators in EU Member States. For example, it could be helpful in cases where information on another state’s critical infrastructure designation is not available, in determining which types of infrastructure could be considered off limits to cyber activities. In addition, the EU’s statements issued following the operations targeting specific entities in Germany, Czechia, Ukraine, and Australia, to name a few, indicate what type of critical infrastructure the EU would consider to be off limits. ⁹⁹

— Articulation of a regional understanding on the applicability of international law in the cyber context

The 2024 EU Declaration on a Common Understanding of International Law in Cyberspace implements the commitment in an interpretative sense by providing contextual guidance to EU Member States on their obligations under international law. In laying out what may in turn constitute ICT activity contrary to such obligations as referred to in the norm, the declaration can support Member States in assessing what conduct – aimed at the critical infrastructure of other states as the specific scenario provided for – would potentially constitute a violation of norm g.

— Development of a regional posture on cyber defense

Cyber defense and the employment of related capabilities in the entire spectrum of military cyberspace operations is a national prerogative of Member States, while relying on a wider ecosystem, including a strong industrial base supported by EU-level capability development (see further also the explainer on cyber defense in Chapter 4.1). For example, the EU’s Military Vision and Strategy on Cyberspace as a Domain of Operations adopted in 2021 lays out the framework conditions and describes the ends and means needed to use cyberspace as a domain of operations in support of the EU’s Common Security and Defence Policy (CSDP) operations. ¹⁰⁰

— Establishment of regional platforms for cooperation and information exchange between cyber commands and military CSIRTs

In recent years, several fora were established to enhance collaboration of the EU’s cyber defense community, inter alia, as envisaged in the EU Policy on Cyber Defence (see further the section on norm a). In 2022, the EU inaugurated the Conference of European Cyber Commanders (CYBERCO), in which representatives of the cyber commands convene twice a year. ¹⁰¹ The EDA acts as CYBERCO’s secretariat with the participation of the EU Military Staff. In addition, on a regular basis, the Cyber Commanders and Cyber Ambassadors of EU Member States meet in a joint conference or come together in other constellations. ¹⁰²

As far as military situational awareness is concerned, in 2026, the EU transformed the Cyber and Information Domain Coordination Centre Permanent Structured Cooperation in Security and Defence Policy (PESCO) project into a permanent EU Cyber Defence Coordination Centre (EUCDCC) to support enhanced situational awareness within the defense community, including all EU military CSDP commanders. ¹⁰³ MICNET was established in 2022, supported by EDA. As MICNET reaches a higher level of maturity, EDA will support Member States in exploring options for collaboration with its civilian counterpart, the CSIRTs network. ¹⁰⁴

Protecting critical infrastructure (Norm G)

States should take appropriate measures to protect their critical infrastructure from ICT threats, taking into account General Assembly resolution 58/199.

Examples of activities that support the objective of protecting critical infrastructure:

• Designating critical infrastructure sectors and put in place procedures for identifying critical infrastructure entities;

• Establishing a regulatory framework for the protection of critical infrastructure;

• Introducing voluntary, coordinated preparedness testing for highly critical entities;

• Establishing regional platforms for cooperation and information exchange in the area of critical infrastructure protection;

• Adopting and testing critical infrastructure-specific crisis and incident management frameworks; and

• Maintaining and supporting the integrity and availability of critical Internet infrastructure.

The following sections provide an overview of the EU’s approach to implementing these activities.

— Designation of critical infrastructure sectors and national identification of critical infrastructure entities

The EU’s main legislative framework for the protection of critical infrastructure is the cross-sectoral NIS2 Directive which provides EU-wide legal measures to boost the overall level of cybersecurity in the EU. The NIS2 Directive is complemented by the Union’s Critical Entities Resilience (CER) Directive, which, although not cyber-specific, is intended to be implemented in a coordinated manner with NIS2 in light of the interdependence between the physical security and cybersecurity of critical entities. ¹⁰⁵ By expanding the scope of the cybersecurity rules to new sectors and entities, the two rulebooks contribute to strengthening resilience and incident response capacities in public and private sectors.

Both the NIS2 Directive and the CER Directive identify sectors of critical importance and impose obligations on Member States, as well as private and public actors within those sectors. While NIS2 distinguishes between sectors of high criticality and other critical sectors, the CER Directive provides a single category of critical sectors:

Table 1: Critical sectors as defined by the NIS2 and CER Directives

The Directives further specify criteria for Member States to determine which entities within these sectors are considered essential or important (under NIS2) or critical (under the CER Directive) and are therefore in scope. The CER Directive also provides for the designation of a subset of entities, so-called “critical entities of particular European significance,” which provide the same or similar essential services in six or more EU Member States and are subject to additional obligations.

— Establishment of a regional regulatory framework for the protection of critical infrastructure

For Member States, the NIS2 Directive requires measures such as a national cybersecurity strategy, a crisis management framework, a coordinated vulnerability disclosure policy, and systems for supervision and enforcement. The Critical Entities Resilience Directive requires Member States, inter alia, to adopt strategies to strengthen the resilience of critical entities, carry out risk assessments, identify critical entities, provide support, and ensure supervision through measures such as audits, inspections, and penalties. For the entities covered, NIS2 requires essential and important entities to implement particular governance and risk management measures and to report incidents. Similarly, the Critical Entities Resilience Directive requires critical entities to assess risks, strengthen their resilience, and report incidents.

In addition to these horizontal initiatives, the EU also mandates protective measures for specific sectors. For instance, in the financial sector, the Digital Operational Resilience Act (DORA) aims to strengthen the IT security of financial entities such as banks, insurance companies, and investment firms. DORA harmonizes rules related to cyber resilience for 21 different types of financial entities and ICT third-party service providers, with a scope that is more wide-ranging than that of the NIS2 and the Critical Entities Resilience Directive. DORA, inter alia, requires financial entities to implement comprehensive ICT risk management frameworks, including incident management and reporting, regular testing (such as vulnerability assessments and scans), and management of risks related to ICT third-party providers.

Furthermore, the EU has taken related legislative protective measures also in the area of electricity through a Network Code on sector-specific rules for cybersecurity aspects of cross-border electricity flows mandating measures in the areas of risk management and incident reporting, among others. The civil aviation sector is also subject to comprehensive EU regulations to ensure its security. ¹⁰⁶ Another example of a sector-specific risk assessment is the EU’s recommendations for mitigating cybersecurity risks in telecommunications and electricity sectors. It highlights the importance of sharing good practices on mitigating ransomware, improving collective cyber-situational awareness and information sharing; improving contingency planning, crisis management and operational collaboration; assessing dependencies on high-risk third-country providers to strengthen supply chain security. ¹⁰⁷

But having legislation in place is just the beginning of the process. An interesting method to support the implementation of the norms through monitoring and accountability are reports on investments in the implementation of the NIS1 and 2 Directives. ¹⁰⁸ These reports by ENISA offer a comprehensive overview of the state’s investment in information security and human resources, which are critical for effective implementation of norm g.

— Introduction of voluntary, coordinated preparedness testing for highly critical entities

The EU Cyber Solidarity Act introduces several new institutional and procedural solutions of a cooperative nature. In the framework of its Cybersecurity Emergency Mechanism, the Regulation puts in place procedures to voluntarily test entities in highly critical sectors under the NIS2 Directive such as finance, energy and health (to be identified by the European Commission) for potential weaknesses that could make them vulnerable to cyber threats with the objective of increasing the overall level of preparedness across the EU. ¹⁰⁹ In practice, the Regulation lists penetration testing and threat assessments as possible preparedness-testing actions for which entities may receive financial support. In addition, support under the Cyber Solidarity Act is not limited to entities in the identified sectors but can also extend to preparedness actions for entities outside those designated for coordinated testing. Such support may include vulnerability and risk monitoring, exercises, and training, and can be provided to Member States under specific circumstances upon request. ¹¹⁰

— Establishment of regional platforms for cooperation and information exchange in critical infrastructure protection

Both the NIS2 and Critical Entities Resilience Directives provide for an institutional set-up to enhance information-exchange between Member States and EUIBAs. The NIS2 Directive provides for the establishment of the NIS Cooperation Group, the CSIRTs Network and EU-CyCLONe. The NIS Cooperation Group’s overall mission is to achieve a high common level of security for network and information systems in the European Union. It supports and facilitates the strategic cooperation and the exchange of information among EU Member States. ¹¹¹ The NIS Cooperation Group has delivered several guidelines and compendium documents, including guidelines on security measures for Top-Level-Domain Name Registries, ¹¹² guidelines for the Member States on voluntary information exchange on cross-border dependencies, ¹¹³ a compendium on cybersecurity of election technology, ¹¹⁴ or the cybersecurity incident taxonomy. ¹¹⁵

On the operational side, the NIS Cooperation Group is supported by the work of the network of Computer Security Incident Response Teams (CSIRTs Network), dedicated to sharing information about risks and ongoing threats as well as cooperating on specific cybersecurity incidents. The NIS Cooperation Group provides strategic guidance for the activities of the CSIRTs network.

In addition, the CER Directive establishes the Critical Entities Resilience Group (CERG), comprising representatives of EU Member States and the Commission. The Group is, inter alia, mandated to “facilitat[e] the exchange of best practices with regard to the identification of critical entities by the Member States” and “exchang[e] best practices related to the notification of incidents.” ¹¹⁶ The CERG and NIS Cooperation Group shall convene at least once annually for a joint meeting.

— Adoption and testing of critical infrastructure-specific crisis and incident management frameworks

In addition to its cyber-specific Cyber Blueprint and cyber crisis management-related provisions contained in the NIS2 Directive, the EU has adopted a Critical Infrastructure Blueprint in June 2024 to coordinate Union-level responses to disruptions of critical infrastructure with significant cross-border relevance. Where incidents affect both the physical and cybersecurity dimensions of critical infrastructure, the two frameworks are intended to be applied coherently to strengthen coordination and leverage synergies. Similar to the Cyber Blueprint, the Critical Infrastructure Blueprint seeks to contribute to shared situational awareness, coordinated public communication, and coordinated responses while clarifying the responsibilities of relevant actors at Member State and Union level and of existing coordination bodies, across operational, strategic, and political levels.

Both frameworks place particular emphasis on regular testing through exercises, including exercises aimed at testing their interplay. In addition, the Cyber Blueprint tasks the Commission with developing an annual rolling program of cyber exercises. One concrete example aimed at testing the EU’s crisis management procedures is ENISA’s biennial Cyber Europe series, which has simulated large-scale cyber incidents and crises affecting critical infrastructure in Europe since 2010, with its eighth edition having taken place in June 2026. ¹¹⁷ This pan-European exercise brings together national cyber security agencies, a number of EU agencies, bodies and networks, and experts covering a range of areas from incident response to decision-making. ¹¹⁸

— Support for the integrity and availability of critical Internet infrastructure

The EU also contributes to the implementation of norm g by taking measures to protect core protocols and supporting infrastructure to ensure the functionality and integrity of the Internet worldwide. In the 2020 EU Cybersecurity Strategy, the European Commission, inter alia, envisaged to develop a contingency plan, supported by EU funding, for dealing with extreme scenarios affecting the integrity and availability of the global Domain Name System (DNS) root system. To that end, it intended to work with ENISA, the Member States, the two EU DNS root server operators, Netnod and RIPE NCC, and the multi-stakeholder community, to assess the role of these operators in guaranteeing that the Internet remains globally accessible in all circumstances.

Responding to requests for assistance (Norm H)

States should respond to appropriate requests for assistance by another State whose critical infrastructure is subject to malicious ICT acts. States should also respond to appropriate requests to mitigate malicious ICT activity aimed at the critical infrastructure of another State emanating from their territory, taking into account due regard for sovereignty.

Examples of activities that support the objective of responding to requests for assistance in cases of malicious ICT acts:

• Establishing a process for mutual operational assistance, including mutual legal assistance;

• Introducing a mechanism to cover costs related to the deployment of expert teams in the context of assistance operations;

• Developing a framework enabling the involvement of the private sector in supporting responses to assistance requests;

• Establishing a framework for coordinated response to large-scale cyber incidents and crises; and

• Conducting regular cyber exercises to strengthen mutual assistance capabilities.

The following sections provide an overview of the EU’s approach to implementing these activities.

— Establishment of a regional framework for mutual operational assistance between EU Member States, including mutual legal assistance

The 2022 EU Policy on Cyber Defence recognizes that significant cybersecurity incidents are often too disruptive for a single or several affected Member States to handle alone. In such cases, mutual assistance and solidarity ¹¹⁹ represent an important feature of the EU’s cooperation mechanisms. In addition, in stipulating the tasks of national CSIRTs in EU Member States, the NIS2 Directive explicitly lists “providing mutual assistance in accordance with their capacities and competencies to other members of the CSIRTs network upon their request” as part of their mandate. ¹²⁰

Moreover, in the framework of the Permanent Structured Cooperation in Security and Defence Policy, PESCO, EU Member States have been collaborating through the project Cyber Rapid Response Teams and Mutual Assistance in Cyber Security (CRRT) since 2018. ¹²¹ The goal of the CRRT project is the development of a cyber capability that can be deployed “as a response to cyber incidents and crises as well as a preventative measure [...] in time of need.” ¹²² In addition to Member States, beneficiaries can also be EU institutions, CSDP missions and operations, as well as EU partner countries. ¹²³ The role of such teams is to provide tailored and targeted short-term assistance upon request and depending on the specific needs in each case.

Response through the justice system is another important part of the EU’s assistance offer. The European Cybercrime Centre hosts the Joint Cybercrime Action Taskforce (J-CAT). Its mission is to drive intelligence-led, coordinated action against key cybercrime threats through cross-border investigations and operations by its partners. ¹²⁴ J-CAT is open to occasional contributions from non-participating countries and non-law enforcement partners on a case-by-case basis. This can also be done within the framework of a J-CAT Attachment Scheme, which provides for a temporary attachment to collaborate on a cybercrime case with links to at least two current J-CAT member countries. Some of its past achievements include arresting 150 individuals for drug sales in dark web, ¹²⁵ 12 targeted for involvement in ransomware operations against critical infrastructure, ¹²⁶ and taking down the Imminent Monitor Remote Access Trojan (IM-RAT) used across 124 countries. ¹²⁷

— Introduction of a regional mechanism to cover costs related to the deployment of expert teams in the context of Member State-to-Member State mutual assistance operations

The EU Cyber Solidarity Act puts in place new procedures and cooperation modalities among EU Member States, such as a comprehensive Cybersecurity Emergency Mechanism to improve the EU’s cyber resilience. ¹²⁸ As part of the Cyber Solidarity Act’s Emergency Mechanism, the Regulation also seeks to enhance “technical assistance from one Member State to another Member State affected by a significant cybersecurity incident or a large-scale cybersecurity incident.” ¹²⁹ In this respect, it provides for the possibility of a supporting Member State to request a grant, funded by the Digital Europe Programme, that covers costs related to the deployment of its experts in another Member State, such as travel, accommodation, and daily allowances.

— Development of a framework enabling the involvement of the private sector in supporting responses to assistance requests

In the framework of its Cybersecurity Emergency Mechanism, the Cyber Solidarity Act also provides for the establishment of a so-called EU Cybersecurity Reserve, a validated pool of incident response services from private service providers (“trusted providers”), which can assist Member States cyber crisis management authorities and national CSIRTs or CERT-EU in addressing significant or large-scale cybersecurity incidents. ¹³⁰ The Regulation stipulates how these users can “request services […] to support response to and initiate recovery from significant cybersecurity incidents, large-scale cybersecurity incidents or large-scale-equivalent cybersecurity incidents.” ¹³¹ The costs for the provision of these services are covered by the Digital Europe Program. ENISA is responsible for administering and operationalizing the EU Cybersecurity Reserve. ¹³² In addition to EU Member States and CERT-EU as users of the Reserve, the Regulation also provides for the possibility that services may be requested by associated third countries under specific circumstances. As of July 2026, the EU has granted Moldova and Ukraine access to these services as well. ¹³³

—   Establishment of a regional framework for coordinated response to large-scale cyber incidents and crises

The EU has put in place an extensive framework for assisting its member states and allies who are victims of malicious cyber activities. The EU’s Blueprint for cyber crisis management applies to cybersecurity incidents which cause disruption too extensive for a concerned Member State to handle on its own or which affect two or more Member States or EU institutions with such a wide-ranging and significant impact of technical or political significance that they require timely policy coordination and response at Union political level.

— Conduct of regular cyber exercises to strengthen mutual assistance capabilities

Exercises are a critical aspect of strengthening cooperation modalities to better meet requests for assistance. The EU’s 2022 Strategic Compass for Security and Defence commits to regular cyber exercises starting from 2022, with the objective of further strengthening the EU’s mutual assistance in the event of armed aggression. Further relevant exercises at EU level include Cyber Europe (see further section on norm g) or CySOPex and BlueOLEx in the area of crisis management. ¹³⁴

Ensuring supply chain security (Norm I)

States should take reasonable steps to ensure the integrity of the supply chain so that end users can have confidence in the security of ICT products. States should seek to prevent the proliferation of malicious ICT tools and techniques and the use of harmful hidden functions.

Examples of activities that support the objective of ensuring ICT supply chain security:

• Introducing a legal framework requiring specific entities to implement supply chain risk management measures;

• Creating a cybersecurity certification framework for ICT products;

• Adopting cybersecurity requirements for products with digital elements through a product safety regulatory framework;

• Expanding product liability frameworks to ICT products;

• Integrating supply-chain security provisions within cybersecurity strategies;

• Conducting and coordinating security risk assessments for critical ICT supply chains;

• Introducing measures to mitigate cybersecurity risks associated with 5G networks;

• Articulating an understanding of key ICT supply chain concepts, risk scenarios, and mitigation recommendations; and

• Issuing advisories, guidance, and reports on supply chain security.

The following sections provide an overview of the EU’s approach to implementing these activities. ¹³⁵

— Introduction of a legal framework requiring specific entities to implement supply chain risk management measures

Through the NIS2 Directive, the EU has established several measures for the essential and important entities within its scope to strengthen supply chain security. These entities must implement appropriate and proportionate technical, operational, and organizational measures to manage risks to their network and information systems, comprising “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” as a minimum requirement. ¹³⁶ In June 2025, ENISA also published technical implementation guidance for the NIS2 Directive, that also includes a dedicated section on supply chain security, that specifically highlights putting in place a supply chain security policy and a directory of suppliers and service providers. ¹³⁷

— Creation of a cybersecurity certification framework for ICT products

The EU’s Cybersecurity Act (CSA) sets the foundations for an EU-wide cybersecurity certification framework for ICT products to enable the creation of tailored and risk-based EU certification schemes. ¹³⁸ The certification framework provides EU-wide certification schemes as a comprehensive set of rules, technical requirements, standards and procedures. In 2024, the EU approved the first Implementing Regulation on the adoption of a European Common Criteria-based cybersecurity certification scheme based on the international standard Common Criteria which was already used to issue certificates in Europe for almost 30 years. This voluntary scheme applies across the EU to certify the cybersecurity of ICT products in their lifecycle. The scheme applies, among others, to biometric systems, firewalls (both hardware and software), detection and response platforms, routers, encrypted storages, databases, and smart cards and secure elements included in passports or other documents of daily use. 

These regulatory efforts are supported through a specific framework of institutions and bodies. The European Cybersecurity Certification Group (ECCG) was established in 2019 to help ensure the consistent implementation and application of the CSA. It is composed of representatives of national cybersecurity certification authorities or representatives of other relevant national authorities. The ECCG supports the preparation of the candidate certificate scheme and the general implementation of the certification framework. ¹³⁹ In addition, a Stakeholder Cybersecurity Certification Group (SCCG) is responsible for advising the Commission and ENISA on strategic issues regarding cybersecurity certification. ¹⁴⁰

— Adoption of cybersecurity requirements for products with digital elements through a product safety regulatory framework

The EU’s efforts to enhance ICT supply chain security have been further strengthened through the Regulation on horizontal cybersecurity requirements for products with digital elements, also known as the Cyber Resilience Act (CRA). The CRA puts in place rules to ensure more secure hardware and software products on the EU market to guarantee that manufacturers, among other addressees, improve the security of products with digital elements throughout the whole life cycle. Measures to that end include the requirement for manufacturers to “draw […] up a software bill of materials ¹⁴¹ in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products” ¹⁴² (see further also the section on the EU’s implementation of norm j). The CRA also strives for more transparency on the market, allowing users to take cybersecurity into account when selecting and using products with digital elements.

— Expansion of product liability frameworks to ICT products

In addition to product safety measures, the EU also contributes to strengthening supply chain security through its product liability framework. The 2024 revision of the EU’s Product Liability Directive enables victims of defective products to bring claims against economic operators, which can in turn incentivize stronger security practices across supply chains. The Directive’s revision now explicitly also includes software, which was previously difficult to cover due to physicality and tangibility requirements, thereby, inter alia, bringing software manufacturers within its scope. ¹⁴³

— Integration of supply-chain security provisions within EU Member States’ cybersecurity strategies

Under the NIS2 Directive, EU Member States are required, as part of their national cybersecurity strategies, to adopt policies “addressing cybersecurity in the supply chain for ICT products and ICT services used by entities for the provision of their services.” ¹⁴⁴

—   Coordination of security risk assessments for critical ICT supply chains

At the Union level, the NIS2 Directive provides for the development of coordinated security risk assessments of critical ICT supply chains, ¹⁴⁵ to be carried out by the NIS Cooperation Group in cooperation with the European Commission and ENISA, to “identify measures, mitigation plans and best practices to counter critical dependencies, potential single points of failure, threats, vulnerabilities and other risks associated with the supply chain.” ¹⁴⁶ These assessments should take into account both technical and non-technical risk factors relevant to the supply chains studied. In January 2026, the NIS Cooperation Group published two coordinated risk assessments on connected and automated vehicles as well as detection equipment. ¹⁴⁷

— Introduction of regional measures to mitigate cybersecurity risks associated with 5G networks

Building upon a coordinated risk assessment of the cybersecurity of 5G networks and Council conclusions on the significance of 5G to the European Economy and the need to mitigate security risks linked to 5G, ¹⁴⁸ the EU’s NIS Cooperation Group adopted a 5G toolbox in January 2020. The objectives of the EU’s 5G Cybersecurity Toolbox are identifying a possible common set of measures to mitigate the main cybersecurity risks of 5G networks to ultimately create a robust framework of measures with a view to ensure an adequate level of cybersecurity of 5G networks across the EU and coordinated approaches among Member States. ¹⁴⁹ This includes “strengthening own 5G capabilities to avoid dependencies and to foster a sustainable and diverse supply chain.” The Cybersecurity 5G Toolbox outlines a catalog of 19 either strategic or technical mitigation measures, which the toolbox complements with ten supporting actions. Strategic measures, inter alia, include the expansion of national regulatory powers and the strengthening of domestic resilience. On a technical level, the Toolbox stipulates concrete measures that involve, for example, the “application of baseline security requirements,” an “evaluati[on of] the implementation of security measures in existing 5G standards,” and the enhancement of “software integrity, update and patch management.” The second Progress report on the implementation of the EU 5G Toolbox by the NIS Cooperation Group provides an overview of the challenges and practices across the EU. ¹⁵⁰  

— Articulation of a regional understanding of key ICT supply chain concepts, risk scenarios, and mitigation recommendations

In January 2026, the NIS Cooperation Group published an advisory ICT Supply Chain Security Toolbox, which EU Member States invited the Group to develop in October 2022 through their Council conclusions on ICT supply chain security. ¹⁵¹ The Toolbox seeks to “define[…] key concepts related to the ICT supply chain, identif[y] potential risk scenarios affecting ICT supply chains within the Union, and provide recommendations to address and mitigate these risks,” thereby also providing a framework for carrying out coordinated risk assessments under the NIS2 Directive. Building on the definition of supply chain incidents – that the document refers to as an “incident […] in which something that should be delivered (e.g. a new software feature or antivirus signature in an update) is not delivered, or should not be delivered (e.g. malware concealed in a software update or a limiting configuration in a component) is delivered” – and four main categories of threats – namely malicious actions, system failures, human error, and natural phenomena or external events – the toolbox develops eleven detailed risk scenarios. These scenarios analyze, for each case, factors such as the type of incident, the threat source, involved supply chain entities, user phases affected, threat actors, vulnerabilities, and resulting impacts. Its annex provides three detailed lists of examples of threats, vulnerabilities, and impacts relevant to ICT supply chains.

— Issuance of advisories, guidance, and reports on supply chain security

As part of its mandate, ENISA is also issuing advisories and publications that address supply chain security. For instance, ENISA published a dedicated threat landscape report on supply chain attacks, provided guidance detailing good practices for supply chain security, or issued an advisory advising on the secure use of package managers in software development. ¹⁵²

Reporting ICT vulnerabilities (Norm J)

States should encourage responsible reporting of ICT vulnerabilities and share associated information on available remedies to such vulnerabilities to limit and possibly eliminate potential threats to ICTs and ICT-dependent infrastructure.

Examples of activities that support the objective of responsibly reporting ICT vulnerabilities and mitigation-sharing:

• Integrating vulnerability disclosure provisions within cybersecurity strategies;

• Designating CSIRTs as coordinated vulnerability disclosure (CVD) coordinators;

• Establishing regional information-sharing mechanisms and collaboration among CVD coordinators;

• Introducing a legal framework requiring specific entities to implement vulnerability disclosure and handling measures;

• Establishing a legal framework addressing vulnerability handling and reporting requirements for products with digital elements;

• Developing and supporting vulnerability management initiatives;

• Issuing advisories, guidance, and reports on vulnerability disclosure policies and vulnerability mitigation.

The following sections provide an overview of the EU’s approach to implementing these activities. ¹⁵³

—   Integration of vulnerability disclosure provisions within EU Member States’ cybersecurity strategies

Under the NIS2 Directive, EU Member States are required, as part of their national cybersecurity strategies, to adopt policies on “managing vulnerabilities, encompassing the promotion and facilitation of coordinated vulnerability disclosure.” ¹⁵⁴ As part of its work on providing an overview over national cybersecurity strategies, ENISA maintains an overview of how Member States have put this commitment in place. ¹⁵⁵

— Designation of national and EU CSIRTs as coordinated vulnerability disclosure coordinators

The EU addresses Coordinated Vulnerability Disclosure (CVD) through regulatory and institutional means. According to the NIS2 Directive, each Member State must designate one of its CSIRTs as a coordinator for the purposes of CVD. The main task of such coordinator is to act as a “trusted intermediary,” including facilitating, where necessary, the interaction between the organization or a person reporting a vulnerability and the manufacturer or provider of the potentially vulnerable ICT products or ICT services. The CVD coordinator shall ensure that diligent follow-up action is carried out with regard to the reported vulnerability and shall ensure the anonymity of the natural or legal person reporting the vulnerability. In addition, ENISA has worked on developing mechanisms to encourage the use of CVD practices and supported Member State CSIRTs in the adoption and development of CVD policies at the national level. The EUIBAs Regulation designates CERT-EU as an equivalent CVD coordinator for the Union entities.

— Establishment of regional information-sharing mechanisms and collaboration among national coordinated vulnerability disclosure coordinators

The NIS2 Directive also provides for the cooperation of national CVD coordinators with their counterparts in the Union. Specifically, if, upon reporting of a vulnerability, they determine that the vulnerability “could have a significant impact on entities in more than one Member State,” national CVD coordinators shall interact with their counterparts in other EU Member States through the framework of the CSIRTs Network. This is of relevance because the CSIRTs Networks tasks comprise “exchang[ing] relevant information about incidents, near misses, cyber threats, risks and vulnerabilities” and “at the request of a member of the CSIRTs network potentially affected by an incident, to exchange and discuss information in relation to that incident and associated cyber threats, risks and vulnerabilities.” ¹⁵⁶ The NIS Cooperation Group is, inter alia, responsible for providing guidance on developing and implementing national CVD policies.

—   Introduction of a legal framework requiring specific entities to implement vulnerability disclosure and handling measures

Through the NIS2 Directive, the EU has established several measures for the essential and important entities within its scope to incorporate vulnerability disclosure. These entities must implement appropriate and proportionate technical, operational, and organizational measures to manage risks to their network and information systems, comprising “security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure” as a minimum requirement. ¹⁵⁷ In June 2025, ENISA also published technical implementation guidance for the NIS2 Directive, that also includes a dedicated section on vulnerability handling and disclosure. ¹⁵⁸

—   Establishment of a legal framework addressing vulnerability handling and reporting requirements for products with digital elements

Furthermore, the EU has addressed vulnerability management – including their disclosure – with vulnerability handling requirements provided for in the Cyber Resilience Act. For instance, the regulation requires that “manufacturers shall have appropriate policies and procedures, including coordinated vulnerability disclosure policies, to process and remediate potential vulnerabilities in the product with digital elements reported from internal or external sources.” ¹⁵⁹ This includes, inter alia, systematically documenting relevant vulnerabilities that manufacturers become aware of, identifying and documenting vulnerabilities and software components, and ensuring that vulnerabilities are fixed or mitigated in a timely manner. The CRA also introduces reporting obligations, requiring manufacturers to notify any actively exploited vulnerability to the respective national authority and ENISA as soon as they become aware of it. In addition, the CRA provides that importers and distributors of products with digital elements must promptly inform manufacturers if they become aware of vulnerabilities in those products. The regulation further imposes obligations on so-called open-source software stewards, requiring them to establish and document a cybersecurity policy that specifically addresses vulnerability handling, contributes to fostering voluntary reporting to national authorities or ENISA, and promotes information-sharing on discovered vulnerabilities within the open-source community.

—   Development and support for vulnerability management initiatives

The NIS2 Directive also mandates ENISA to develop and maintain a European Vulnerability Database (EUVD) serving as a repository of all reported vulnerabilities. ¹⁶⁰ The Database should include “information describing the vulnerability; the affected ICT products or ICT services and the severity of the vulnerability in terms of the circumstances under which it may be exploited; and the availability of related patches and, in the absence of available patches, guidance provided by the competent authorities or the CSIRTs addressed to users of vulnerable ICT products and ICT services as to how the risks resulting from disclosed vulnerabilities can be mitigated.” ¹⁶¹

ENISA launched the EUVD in May 2025. ¹⁶² Since January 2024, ENISA has acted as a Numbering Authority for the Common Vulnerabilities and Exposures (CVE) program (CNA) authorized to assign CVE Identifiers (CVE IDs) and publish CVE Records for vulnerabilities discovered by or reported to EU CSIRTs. In November 2025, ENISA has elevated its role in the CVE program and became a CVE Program Root which, inter alia, entails “taking on additional responsibilities including the identification, onboarding, and support to other CNAs within its scope.” ¹⁶³

— Issuance of advisories, guidance, and reports on vulnerability disclosure policies and vulnerability mitigation

At the EU level, the NIS Cooperation Group, ENISA, and CERT-EU are involved in the issuance of advisories, guidance, and reports on vulnerability disclosure policies and vulnerability. In 2023, the NIS Cooperation Group adopted guidelines on implementing national CVD policies. The guidelines address the roles involved in implementing a CVD policy, the legal challenges states may encounter when establishing such a framework, the key elements such mechanisms should include, and recommendations to support their adoption by states. ¹⁶⁴ The same year, ENISA published a report on developing national vulnerability programs. ¹⁶⁵ A year earlier, in 2022, ENISA issued a report on the CVD landscape in the EU. ¹⁶⁶ The report provides an overview of the CVD practices in all EU Member States, identifies good practices, and offers concrete recommendations for addressing legal, economic, political and operational challenges associated with CVD processes. ENISA’s recommendations encompass defining the role of ethical hackers in relevant national laws to establish a framework for ethical security research around vulnerabilities and developing incentives for security researchers to actively participate in CVD research. Back in 2022, the report found that Belgium, France, Lithuania and the Netherlands undertook CVD policy work and have implemented policy requirements while other Member States were at different stages or have not implemented a CVD policy yet. ENISA and CERT-EU are also active in issuing advisories and statements that include remediation recommendations, addressing, for example, the exploitation of specific vulnerabilities, how to identify them, and ways to mitigate their potential impact. ¹⁶⁷

Not harming emergency response teams (Norm K)

States should not conduct or knowingly support activity to harm the information systems of the authorized emergency response teams (CERTs/CSIRTs) of another State. A State should not use authorized emergency response teams to engage in malicious international activity.

Examples of activities that support the objective of not harming foreign CERTs/CSIRTs:

• Establishing a legal framework defining the roles and responsibilities of CSIRTs;

• Facilitating cooperation among CSIRTs and participation in CSIRT networks; and

• Publishing and maintaining a list of declared national CSIRTs at a regional/international level.

Given that EU Member States have full competence over their national security, the EU’s role in the implementation of the UN cyber norms of a prohibitive nature is rather limited. Nonetheless, the EU has taken certain measures that provide an overall framework for the role that CERTs/CSIRTs play within its cyber ecosystem. The following sections provide an overview of the EU’s approach to implementing these activities.

—   Establishment of a legal framework defining the roles and responsibilities of national CSIRTs and CERT-EU

Although the EU has introduced measures concerning the establishment of CSIRTs, there are no legal EU-wide rules concerning the prohibition of malicious activity against other CERTs or CSIRTs. The second component of the norm – setting out the expectation that states should not use authorized emergency response teams to engage in malicious international activity – is more directly reflected in EU legislation through the strictly bounded mandates of national CSIRTs and CERT-EU, which restrict the intrusive scope of these entities.

Under the NIS2 Directive, national CSIRTs of EU Member States should, inter alia, have the following tasks in relation to essential and important entities:

• “monitoring and analysing cyber threats, vulnerabilities and incidents at national level and, upon request, providing assistance of essential and important entities regarding real-time or near real-time monitoring of their network and information systems;

• providing early warnings, alerts, announcements and dissemination of information […] on cyber threats, vulnerabilities and incidents, if possible in near real-time;

• responding to incidents and providing assistance […];

• collecting and analysing forensic data and providing dynamic risk and incident analysis and situational awareness regarding cybersecurity;

• providing, upon […] request […], a proactive scanning of the network and information systems of the entity concerned to detect vulnerabilities with a potential significant impact;

• participating in the CSIRTs network and providing mutual assistance in accordance with their capacities and competencies to other members of the CSIRTs network […].” ¹⁶⁸

The EUIBAs Regulation stipulates the mandate of CERT-EU and its tasks, including “offer[ing] standard CSIRT services for Union entities,” “coordinat[ing] the management of major incidents,” and “provid[ing], upon the request of a Union entity, proactive non-intrusive scanning of publicly accessible network and information systems of that Union entity.” ¹⁶⁹

—   Facilitation of cooperation among CSIRTs and participation in CSIRT networks

The NIS2 Directive explicitly mentions that CSIRTs may establish cooperation with such teams in other countries and that EU Member States should ensure that exchange of information between these bodies is effective, efficient and secure. The CSIRTs may also cooperate for the purpose of providing cybersecurity assistance. CERT-EU is also a member of the Forum for Incident Response and Security Teams (FIRST). ¹⁷⁰ While not explicitly prohibiting malicious conduct, such arrangements can create routine coordination mechanisms and foster personal contacts that establish clear mutual expectations of non-malicious activity between the CSIRTs and authorities involved.

—   Publication and maintenance of a list of declared national CSIRTs in the EU

On its website, the CSIRTs Network maintains a list of declared national CSIRTs in the EU. This contributes to the clear identification and recognition of authorized CSIRTs of EU Member States, which should thus be considered off limits as targets. In doing so, the list reduces potential ambiguity regarding which entities qualify as protected CSIRTs under this specific norm. ¹⁷¹

External Implementation: How the EU Supports Norms Implementation Through Capacity Building

Despite the growing political fragmentation within the UN cyber-related processes, states have consistently agreed on the need to accelerate international assistance to support the implementation of the framework of responsible state behavior in cyberspace. ¹⁷² The UN GGE 2021 report identified a set of concrete goals for such capacity building, including policy and strategy development, legislation and regulation, incident response capacities, protection of critical infrastructure, cybercrime and criminal justice capacities, confidence-building and cooperation, public awareness and education, and broader support for resilience and secure digital development. ¹⁷³

Nonetheless, while the link between capacity building and norms implementation is, in theory, widely recognized and reflected in policy documents and UN discussions, the connection remains largely indirect in practice. ¹⁷⁴ Often, states strengthen laws on cybercrime, establish reporting obligations for critical infrastructure operators, improve vulnerability handling procedures, or create crisis coordination mechanisms without ever framing these efforts as part of the UN norms agenda. Also, in 2022, EU Member States “emphasi[zed] the need to better connect the EU’s cyber capacity building strategy with the UN norms of responsible State behaviour in cyberspace.” ¹⁷⁵

Still, most capacity building initiatives are instrumental for norms implementation because the UN norms are not self-executing. They can shape state behavior only when states possess the institutions, legal frameworks, operational procedures and human expertise necessary to implement them in practice. Capacity building is therefore not just a supporting activity around norms implementation. In many cases, it is one of the principal ways implementation actually happens and can function as a bridge between international agreement and domestic practice. ¹⁷⁶ As a result, states – and regions – can contribute to implementation not only by adopting or adapting their domestic and regional frameworks to establish the prerequisites for putting these behavioral expectations into practice, but also by supporting others in developing and enhancing the capacity to do the same. ¹⁷⁷

This chapter analyzes how the EU does the latter by exploring ways in which it supports the implementation of the UN cyber norms through capacity building in partner countries and regions. This chapter uses the capacity building goals identified by the UN GGE as an organizing framework to show how each capacity area matters for implementing the UN norms and to illustrate each capacity area with examples of relevant EU projects or initiatives. ¹⁷⁸ The examples included for the EU’s external implementation pathway are intended to illustrate existing efforts rather than provide an exhaustive overview, especially given the complexity and breadth of the cyber capacity building landscape.

Policy and strategy development

Policy and strategy development is fundamental for norms implementation because the UN framework requires states to translate broad international expectations into national priorities, institutional mandates and implementation pathways. Without national strategies and policy frameworks, implementing the norms on cooperation, due diligence, assistance, critical infrastructure protection or human rights respecting cybersecurity remains fragmented and dependent on ad hoc political choices rather than sustained governance. For example, in its guidance on norm a, the 2021 UN GGE encouraged states to put in place or strengthen relevant policy, legislation, review processes, crisis-management mechanisms and whole-of-government partnerships in order to support cooperation and stability in the use of ICTs. Also in its discussion of other norms, the report repeatedly linked implementation to national structures, ICT-related policies, and coordination mechanisms. Policies and strategies can thus help states identify priorities, assign roles, sequence reforms and create a strategic framework through which individual norms can be implemented coherently rather than in isolation.

Legislation and regulation

As the implementation activities identified in Chapter 4 underscore, implementation requires domestic rules and efforts that specify institutional responsibilities, investigative powers, resilience obligations and safeguards to move from political endorsement to practical operationalization. Implementing the norms on preventing misuse of ICTs, prosecuting cybercrime, protecting critical infrastructure, responding to requests for assistance, reporting vulnerabilities or respecting privacy and human rights thus significantly benefits from legislation or regulation that clarifies duties, powers, safeguards and accountability. ¹⁷⁹ Legal capacity is thus not peripheral to norm implementation but represents one of its principal enabling conditions.

Incident response capacities

States rely on incident response capacities, including CERTs/CSIRTs, to implement the UN norms, as many of its expectations require them to detect, ¹⁸⁰ analyze, mitigate, and recover from malicious ICT activity. A state cannot meaningfully implement norms on due diligence, attribution, cooperation, requests for assistance, critical infrastructure protection or vulnerability handling if it lacks a competent technical body capable of receiving reports, analyzing incidents and coordinating responses. ¹⁸¹

Cyber crisis prevention and management

Cyber crisis prevention and management capacities are essential for implementing the UN cyber norms because several of them become most relevant during high-impact incidents: the obligation to consider all relevant information, the expectation to cooperate, the commitment to protect critical infrastructure and the norm on responding to requests for assistance all depend on having crisis-management structures, playbooks and chains of communication already in place. The past UN processes have explicitly encouraged mechanisms for crisis and incident management under norm a and underlined the importance of consultation, notification, acknowledgement, and assistance procedures under norms b, c and h.

Critical infrastructure protection

One of the key areas for norms-related capacity building – and strengthening cyber resilience more broadly – is the protection of critical infrastructure. Enhancing these capacities enables states to give effect to several norms simultaneously: those relating to non-damage, protection, and assistance related to critical infrastructure as well as those pertaining to due diligence, supply chain security and vulnerability disclosure. At the same time, these norms are among the most operationally demanding in the framework. They require states to identify critical sectors, assess risks, establish protective measures, coordinate with infrastructure owners and operators, and prepare to provide or request assistance when incidents occur.

Cybercrime and criminal justice capacities

Addressing cybercrime and strengthening criminal justice capacities has historically been one of the most advanced cyber capacity building efforts. ¹⁸² This capacity area is particularly indispensable to the implementation of norm d, which calls on states to cooperate in exchanging information, assisting one another, prosecuting terrorist and criminal use of ICTs and implementing other cooperative measures. It is also relevant to other norms, because a state, for instance, cannot take appropriate and feasible steps against internationally wrongful acts or malicious activity emanating from its territory if it lacks investigative and prosecutorial capacities. ¹⁸³ Efforts aimed at enhancing criminal justice capacities in partner countries can therefore not only be confined to supporting domestic law enforcement but also contribute to wider norms implementation by making states able to cooperate, investigate and respond lawfully.

International partnerships and cyber diplomacy

Given that the UN framework is built on the premise that stability in cyberspace depends on cooperation among states and engagement with other stakeholders, states need capacities to engage with other countries and build partnerships. Norm a is explicitly about cooperation to increase stability and security, while other norms benefit from consultation, notification, requests for assistance, multistakeholder exchanges and regional platforms. Capacity building initiatives can help create the partnerships, shared understandings, and trusted channels necessary to carry out these functions.

Awareness, education and cybersecurity culture

Governmental capacities in the areas of awareness, education and cybersecurity culture are often underestimated in norm implementation debates. Yet, they are important because norms are implemented not only through laws and agencies but are linked to the behavior of users, operators, officials, researchers, and companies that make up the wider cybersecurity (policy) ecosystem. Without awareness and trained personnel, states may have institutions on paper but remain limited in sustaining secure practices, protecting infrastructure, or handling vulnerabilities. ¹⁸⁴ Strengthening human capital and skills therefore matters for norms implementation because several norms, especially those addressing critical infrastructure protection, vulnerability disclosure, and human rights, presuppose a public sector workforce and stakeholder community able to understand and apply good practices.

Takeaways

The implementation of the UN cyber norms is ultimately about one simple idea. Cyber norms only matter when they show up in everyday decisions and shape what governments actually do in the cyber domain. The EU provides an instructive case for examining how abstract UN commitments turn into concrete practices, especially because the EU pursues different implementation mechanisms concurrently, albeit to varying degrees.

The EU’s experience indicates several important conclusions about that process:

1. The EU already implements the UN cyber norms extensively and at scale across its cyber policy ecosystem. Existing EU instruments and mechanisms – such as the NIS2 Directive, the Cyber Solidarity Act, cyber diplomacy tools, cyber capacity building initiatives, and the activities of actors like ENISA and the CSIRTs Network – contribute to the operationalization of all eleven norms. The implementation of UN cyber norms in the EU is therefore already embedded across multiple domains of governance rather than driven by a single policy area, institution, or instrument.

2. The EU’s norms implementation is an inherently dynamic and continuous process. The EU experience demonstrates that implementation is not a single downstream step, but a prolonged process of translation, institutionalization, and revision. As digitization expands and critical sectors become more interconnected, the EU has treated many of its implementation mechanisms, especially legal instruments, not as fixed endpoints, but as tools that it has repeatedly updated to broaden coverage, clarify obligations, and address practical shortcomings identified during initial stages of implementation.

3. The EU’s implementation is driven by a number of cross-cutting enabling capabilities, rather than by isolated measures contributing only to individual norms. These capabilities include, at a minimum, cybersecurity coordination structures and agencies, strategic cybersecurity frameworks, the establishment of national and EU CSIRTs, regulatory frameworks addressing critical infrastructure protection and cybercrime cooperation mechanisms, as well as the establishment of policies, institutions, and resources for participation in regional and international policy debates.

4. The EU’s implementation is most robust where legislative frameworks reflect political commitments through defined duties and compliance expectations, designated authorities, audit or monitoring functions, and built-in enforcement mechanisms. In the EU’s case, this becomes particularly evident for the norms covering areas such as critical infrastructure protection, data protection, cybercrime cooperation, vulnerability management, and supply chain security.

5. The EU framework has translated positive commitments into regional practice more readily than prohibitive norms. Given that EU Member States retain primary competence over national security matters, the EU’s role in implementing UN cyber norms framed as prohibitions is expectedly limited. EU-level implementation efforts are strongest where the EU can embed behavioral expectations in existing resilience, preparedness, and capacity building frameworks.

6. Critical infrastructure protection is one of the areas where EU measures aligning with the behavioral expectations reflected in the UN cyber norms are strongest. Many EU initiatives in this field also closely intersect with related normative objectives, including supply chain security and vulnerability management.

7. The EU’s implementation remains largely implicit and there is a resulting disconnect between European cyber policy efforts and their link to the UN framework. As Chapters 4 and 5 show, many EU-level measures substantively align with the UN cyber norms, yet EU institutions and agencies rarely explicitly articulate EU legislation, policies, institutional activities, partnerships, and capacity building initiatives as contributions to the UN framework for responsible state behavior in cyberspace.

Taken together, these takeaways provide a nuanced answer to the question of whether international cyber norms generate a “UN Effect” in the EU context, demonstrating how such an effect may (or may not) manifest itself within the Union’s legislative, political, and institutional practices. On the one hand, the implicit nature of the EU’s implementation suggests a limited effect, as many measures are not adopted explicitly because of the UN norms but instead reflect broader internal policy priorities and institutional objectives. On the other hand, this may precisely reflect a deeper form of norm diffusion in which most of the behavioral expectations encapsulated in the norms have already become so deeply embedded in governance structures and practices that their normative influence operates at a tacit level.

Implications

Looking beyond the EU’s internal dynamics, the EU case also needs to be situated within broader international efforts to operationalize cyber norms. Its implementation experience has not developed in a vacuum, but forms part of a wider set of regional and international efforts to translate agreed behavioral expectations into practice. Comparing these efforts shows that while the EU likely has one of the most mature norms implementation frameworks, many of the same building blocks – including, for example, cybersecurity coordination structures and agencies, strategic cybersecurity frameworks, the establishment of national and EU CSIRTs, and regulatory frameworks addressing critical infrastructure protection and cybercrime cooperation – also feature in other implementation-focused initiatives, including the ASEAN norms implementation checklist, the 2021 OEWG guidance, the OEWG II Chair’s voluntary implementation checklist proposal, and relevant UNIDIR research.

This points to growing cross-regional convergence around the practical foundations needed to operationalize the framework. Even though the EU is in many ways unique in its approach to the implementation of the UN cyber norms given its governance and institutional structure that are difficult to replicate elsewhere, its experience can thus also offer insights for other regions and states interested in strengthening implementation:

• Implementation extends beyond formal declarations, national implementation plans, or projects explicitly labelled as “norms” initiatives. The EU case illustrates that a narrow understanding of implementation risks overlooking where much of the practical operationalization of the framework already takes place. In a similar vein, many capacity building and reform initiatives in areas such as cybercrime, incident response, certification, data protection, and critical infrastructure protection contribute not only to national policy goals but also to fulfilling agreed international behavioral expectations, even when they are not framed in these terms.

• Implementation is most effective when anchored in institutions with concrete mandates. Given that norms are not self-executing, institutional structures and partnerships help embed international behavioral expectations in administrative routines rather than leaving implementation dependent on potentially episodic diplomatic attention. Implementation can therefore benefit from mapping norms not only against laws and policies, but also against institutional responsibilities, identifying which bodies operate in the relevant area, which authorities review compliance, who coordinates assistance, who engages non-governmental actors such as industry, and who feeds implementation lessons back into regional and international discussions.

• Implementation is not a linear but a dynamic, iterative process. The EU’s experience highlights the importance of built-in revision pathways, including review clauses, periodic reporting, post-incident lessons-learned mechanisms, impact assessments, and institutionalized exchanges between policy, technical, and diplomatic communities. Mechanisms like these can help keep implementation adaptive in response to evolving risks, technologies, and institutional capacities. In turn, domestic and regional practice also helps clarify, refine, and sometimes reshape the meaning of norms. It also demonstrates that there is no single way of operationalizing norms and that states can employ those mechanisms that are best suited to their domestic and/or regional context.

• Implementation of positive and prohibitive commitments can proceed at different paces. The EU’s case suggests that states and regional bodies may find it easier to make progress on norms that can be embedded in resilience and preparedness frameworks than on norms of a more politically restrictive nature. This sequencing matters particularly for regional implementation strategies because it highlights where early momentum can most likely be leveraged.

• Critical infrastructure protection constitutes a particularly feasible and politically actionable starting point for broader norm operationalization. Often, implementation can advance more quickly when tied to concrete public-interest functions such as ensuring the continuity of essential services, strengthening the resilience of financial and energy systems, protecting health services, and maintaining the stability of digital infrastructure.

• Regional implementation involves balancing common objectives and domestic execution. Many EU-level legislative and policy instruments often leave precise implementation modalities such as institutional placement, sequencing, budgetary arrangements, and procedural details to Member States, resulting in substantial variation across 27 national systems. This indicates that convergence on regional implementation priorities does not necessarily require identical institutional designs, while at the same time underscoring the importance of having mechanisms in place to compare progress across institutional contexts.

Recommendations for the EU

The findings and reflections outlined in Chapters 6 and 7 have several strategic implications for the EU’s future external engagement. In particular, they inform five recommendations for how the EU can follow through on the ambition it expressed at the Global Mechanism’s organizational session – namely to “put our words into action on the ground” and make “actionable and tangible progress on the implementation of the UN framework for responsible state behaviour in cyberspace” – into concrete action. ¹⁸⁵

Strengthening internal socialization of the UN framework

Even though implementation is a simultaneous foreign and domestic policy exercise, EU and national actors still discuss UN cyber norms primarily through diplomatic institutions. Given that implementation often depends on actors beyond those circles, closer interaction among different EU stakeholders and communities is essential. Increasing awareness of the UN cyber norms can thus not only improve coherence between EU cyber diplomacy and internal cybersecurity governance but also foster closer interaction among the EU’s cyber policy communities. This would also advance the objective set out in the EU’s 2020 Cybersecurity Strategy, which called for internal market, law enforcement, diplomatic, and defense communities to work more closely together. ¹⁸⁶ This paper has identified concrete links between existing EU instruments and international commitments and highlighted the stakes that different EU-level actors hold in the implementation of cyber norms. Together, these can serve as practical entry points for such internal socialization.

Tracking implementation internally

As a whole-of-government endeavor involving multiple stakeholders, effective operationalization also requires mechanisms to monitor and trace progress across diverse institutional settings without reducing assessment to a binary checklist. A comprehensive account of EU-level implementation, including the role of its capacity building initiatives, can help clarify how responsibilities are distributed, where remaining gaps lie, and how the EU, Member States, and partners can collectively strengthen responsible behavior in cyberspace. Importantly, norms should not only be mapped against laws and policies but also against institutional responsibilities. Building on Recommendation 8.1 above, this approach can help ensure that institutions across different branches of government are aware of their roles and interests in implementation and can coordinate the measures undertaken to that end.

For example, the EU could organize an annual internal “UN norms in EU practice” briefing for relevant agencies and Commission directorates, using one norm, such as the one on critical infrastructure protection, to illustrate how different EU instruments and institutions contribute to its implementation. The Horizontal Working Party on Cyber Issues (HWPCI) and relevant agency boards could carry out similar exercises.

Learning from other discussions, doing so systematically at the EU level could also generate important dynamics within the Union. In the debate on the applicability of international law in cyberspace, Member States first developed national positions and only later converged on a common EU position. In the case of norms, a comprehensive EU-level account of implementation could work the other way around, stimulating further national mapping exercises and encouraging broader Member State engagement in implementation discussions.

Moving from implicit implementation to explicit external narratives

Demonstrating how existing international commitments are already being operationalized not only has internal benefits. For the EU, making its implementation pathways more explicit is particularly important given that its starting point for norms implementation is different from that of many other countries. Although the situation varies among the UN Member States, all have endorsed the norms and increased their engagement in shaping how the norms are understood and implemented. Communicating how the EU’s own regulatory and governance models contribute to these efforts – with the EU’s July contribution on norms implementation representing an important first step – can therefore provide a practical reference point, strengthen the EU’s role as a partner for dialogue, capacity building, and the exchange of lessons learned, and increase international awareness of the EU’s cybersecurity policy ecosystem. This is particularly important at a time when some states continue to question the adequacy of existing norms and international law in cyberspace, for which explicit implementation narratives can provide a concrete counterpoint.

Embedding norms implementation in cyber capacity building

While EU Member States have already underlined the need to better connect the Union’s cyber capacity building strategy with the UN norms framework, ¹⁸⁷ the examples provided in Chapter 5 indicate that concrete programs only partially reflect the implementation of the framework in their design and delivery. Implementation mapping exercises like this paper offer an evidence base for making that connection more explicit in practice. They can help identify which capacities – for example, incident response, cybercrime investigation, critical infrastructure resilience or participation in international processes – are most critical for implementing specific norms and where the EU’s external action already addresses these areas. For decision-makers, this should not necessarily mean adopting a top-down approach of translating norms into capabilities. A more effective approach would recognize how fundamental capabilities addressed through capacity building activities, based on the needs of partner countries, can, as a side effect, enable states to implement the substance of UN norms from the bottom up. This means there is no need to reinvent the wheel. Rather, already small but meaningful adjustments in the framing and political embedding of capacity building activities can strengthen the norms implementation lens and help avoid treating norm implementation and cyber capacity building as separate agendas when, in practice, they are deeply intertwined.

Leveraging the UN Global Mechanism and cross-regional platforms as implementation hubs

The launch of the UN Global Mechanism offers several concrete entry points to advance these recommendations. At the UN level, the EU could, for example:

• build on its July contribution by developing and publishing implementation-oriented working papers or mapping notes that show how particular norms (or clusters of norms) are implemented through specific instruments;

• organize side events focused on the implementation of specific norms, such as those on critical infrastructure protection (norms f–h), supply chain security, or assistance;

• facilitate technical briefings by operational actors – such as ENISA, the CSIRTs Network, or relevant regulators – in Mechanism working groups to illustrate how commitments are translated into procedures and institutional practice at the EU level; and

• feed insights from its own experience into any renewed work on a UN voluntary implementation checklist.

In parallel, the EU should deepen cross-regional engagement with norms implementation initiatives developed by other regional organizations, particularly ASEAN and the African Union. This would help identify overlaps, exchange experiences, and develop follow-up cooperation. Joint implementation-focused working papers, informal dialogues, or side events could address specific norms, common implementation challenges, and emerging good practices. The norms relating to critical infrastructure protection provide the most feasible and politically actionable starting point for broader cross-regional norm operationalization and mobilization.

Annex

Annex I: Checklist of possible norms implementation activities

Annex II: Overview of EU norms implementation activities

Acknowledgements

The authors would like to thank Cristian Michael Tracci, Eugene Tan, Helene Pleil, Sven Herpig for the time they devoted to providing thorough feedback on earlier drafts of this paper. Any omissions and mistakes are the sole responsibility of the authors. The authors also extend their gratitude to Alina Siebert and Luisa Seeling for their assistance with the editing and layout of this publication.

Research and analysis have not been commissioned by any entity.