Cybersecurity Act review: AmCham EU calls for greater industry engagement and evidence-based certification criteria
News
21 Jan 2026
Digital

The European Commission’s proposal to revise the Cybersecurity Act (CSA2) comes at the right moment, as Europe faces an evolving range of cyber threats. With its measures to reinforce ENISA and make harmonisation the key to a more resilient Single Market, the proposal brings the Act closer to the realities of today’s fast-moving cybersecurity ecosystem. 

However, the Commission’s proposal still fails to go far enough on providing a platform for more active industry engagement. It rightly formalises existing structures but falls short of creating mechanisms that allow for regular expert-level exchanges and meaningful industry feedback into the CSA2 framework, building on lessons learned from the past years. Such exchanges are essential, given industry’s role as a front-line defender against cyber threats. 

Now, as the file moves to the European Parliament and the Council of the EU, the co-legislators must ensure certification schemes under the CSA2 remain based on technical criteria. The EU’s cybersecurity needs should be a matter for sober, technical analysis. AmCham EU therefore supports the proposal's structural distinction between technical certification and non-technical supply chain risks. Maintaining this separation prevents restrictive requirements that limit choice, reduce competition and slow innovation. 

The same approach is necessary for the proposal’s provisions to secure critical infrastructure under the new ‘Trusted ICT Supply Chain Framework’ (Title IV). These measures must also be underpinned by an objective, evidence-based approach to ‘non-technical risks’. At the same time, measures involving restrictions on data transfers must be aligned with international agreements to avoid unintended disruptions to global operations. 

Ultimately, US companies share the EU’s commitment to securing the region’s digital resilience. AmCham EU members invest heavily in security and stand ready to support the delivery of a framework that keeps Europe open, secure and competitive. 

Related items

News
7 Jul 2026

Branching out with AI

Meta’s open-source Canopy Height Maps helped the European Commission’s Joint Research Centre improve its 2020 Global Forest Cover map, demonstrating how artificial intelligence can strengthen Europe’s ability to monitor forests and advance climate and biodiversity goals. Developed with the World Resources Institute, the maps use Meta’s DINO self-supervised computer vision model to estimate tree height from satellite imagery. This helped researchers apply the five-metre threshold used in many international forest definitions and better distinguish forests from other tree-covered land, including agricultural tree crops. The resulting product, available through the EU Forest Observatory, provides one of the most comprehensive open views of global forest cover. Read more on Invested in Europe.

Digital
Read more
Read more about Branching out with AI
News
19 Jun 2026

Examining Europe’s AI ambitions with the Cypriot Presidency of the Council of the EU

How can Europe strengthen its digital resilience while remaining open to the partnerships that drive AI innovation? On Wednesday, 17 June, Malte Lohan, CEO, AmCham EU, addressed this at a conference organised by the Cypriot Presidency of the Council of the EU in Nicosia, Cyprus. Discussions focused on how Europe can build a more resilient digital ecosystem while remaining an attractive destination for investment and innovation. Mr Lohan underlined that secure supply chains and trusted partnerships are essential to Europe’s AI competitiveness. He also highlighted the role of US businesses as committed partners in helping Europe build and compete globally, while stressing the need for balanced policies that strengthen resilience and give companies the confidence to invest in Europe.

Presidency
Digital
Simplification
Read more
Read more about Examining Europe’s AI ambitions with the Cypriot Presidency of the Council of the EU
News
5 Jun 2026

Tech Sovereignty Package: positive steps for energy resilience, but a risky gamble for digital competitiveness

This week the European Commission unveiled its Tech Sovereignty Package. While the Package’s energy proposals mark a significant step forward for EU energy resilience, the Cloud and AI Development Act (CADA) proposal overlooks the reality of global technology supply chains and introduces significant legal uncertainty and fragmentation for businesses.

The central question for the Tech Sovereignty Package is how to build resilience without undermining competitiveness. Concerns around overdependence on a limited number of providers, the risk of external disruption to service continuity and the long-term position of the EU’s digital industries are all legitimate. However, greater sovereignty will only be sustainable if it is built on a competitive, diverse and innovative digital ecosystem. The technologies that underpin the global digital economy are developed through highly international supply chains, with innovation spread across multiple markets.

Viewed through this lens, the individual proposals in the Package vary in the extent to which they reinforce resilience while preserving openness and competitiveness. In particular, the proposed CADA risks discriminating against providers that rely on global supply chains – both those based in Europe and those in third countries – even where they offer superior resilience.

‘An origin-based approach is too blunt for such a complex global market’, said Malte Lohan, CEO of the American Chamber of Commerce to the European Union, commenting on the Package.

‘A more credible path to achieving greater resilience and control in such an interconnected landscape is to define sovereignty in terms of outcomes: secure and reliable technologies, customer choice, strong safeguards against undue interference and a business environment that supports investment and growth. That points to a risk-based framework where the EU is open to working with trusted partners. This trust should be assessed on the basis of objective standards rather than origin alone’, Mr Lohan added.

Last year alone, US technology firms operating in Europe and their supply chains supported €1.0 trillion in EU GDP, equivalent to 5.4% of total output. The scale of this contribution underscores the need for the EU to preserve an open environment with legal clarity and proportionality in any restrictions or safeguards that would impact commercial operations.

The Package’s Strategic Roadmap for Digitalisation and AI in energy is a positive step that could help unlock the benefits of digitalisation for Europe’s energy needs, enabling faster and more flexible grids. Digitalisation provides new opportunities to strengthen the reliability and resilience of energy systems. If executed well, the roadmap could support the growing demand of Europe’s digital and AI sectors for low-carbon energy.

Ultimately, the importance of the Tech Sovereignty Package extends well beyond the technology sector itself. Manufacturers, healthcare and life sciences, financial services, mobility, energy and retail all increasingly depend on access to advanced digital technologies to innovate and compete. For the Tech Sovereignty Package to support these sectors, it must ensure companies in Europe continue to benefit from economic openness.

Digital
Read more
Read more about Tech Sovereignty Package: positive steps for energy resilience, but a risky gamble for digital competitiveness