Teatis - COVER NOTE From: Senate of the Parliament of the Czech Republic Subject: Proposal for a Regulation of the European Parliament and of the Council on the European Union Agency for Cybersecurity (ENISA), the European cybersecurity certification framework, and ICT supply chain security and repealing Regulation (EU) 2019/881 (The Cybersecurity Act 2) -[5611/26 - COM(2026) 11 final] Proposal for a Directive of the European Parliament and of the Council amending Directive (EU) 2022/2555 as regards simplification measures and alignment with the [Proposal for the Cybersecurity Act 2] -[5627/26 - COM(2026) 13 final] - Reasoned opinion on the application of the Principles of Subsidiarity and Proportionality - COM(2026) 11, COM(2026) 13

9972/26

JAI.2 EN/CS

Council of the European Union

Brussels, 2 June 2026 (OR. en, cs)

9972/26

CYBER 265 JAI 701 DATAPROTECT 183 TELECOM 286 MI 566 IND 383 CADREFIN 255 FIN 791 BUDGET 24 CSC 374 CODEC 1068 INST 236 PARLNAT 128

PARLNAT

Interinstitutional Files: 2026/0011 (COD) 2026/0012 (COD)

COVER NOTE

From: Senate of the Parliament of the Czech Republic

date of receipt: 28 May 2026

To: The President of the European Council

Subject: Proposal for a Regulation of the European Parliament and of the Council on the European Union Agency for Cybersecurity (ENISA), the European cybersecurity certification framework, and ICT supply chain security and repealing Regulation (EU) 2019/881 (The Cybersecurity Act 2) -[5611/26 - COM(2026) 11 final]

Proposal for a Directive of the European Parliament and of the Council amending Directive (EU) 2022/2555 as regards simplification measures and alignment with the [Proposal for the Cybersecurity Act 2] -[5627/26 - COM(2026) 13 final]

- Reasoned opinion on the application of the Principles of Subsidiarity and Proportionality

Delegations will find enclosed the reasoned opinion1 of the Senate of the Czech Republic on the above.

1 The translation(s) of the opinion may be available on the Interparliamentary EU Information Exchange website

(IPEX) at the following address: https://secure.ipex.eu/IPEXL-WEB/document/COM-2026-0011 ;

https://secure.ipex.eu/IPEXL-WEB/document/COM-2026-0013

SENATE OF THE PARLIAMENT OF THE CZECH REPUBLIC

Courtesy translation

15TH TERM

439th

RESOLUTION OF THE SENATE

Delivered on the 25th session held on 27th May 2026

on Package on the Cybersecurity Act 2

- Proposal for a Regulation of the European Parliament and of the Council on

the European Union Agency for Cybersecurity (ENISA), the European

cybersecurity certification framework, and ICT supply chain security and

repealing Regulation (EU) 2019/881 (The Cybersecurity Act 2) /Senate Print

no. N 164/15, COM(2026) 11/

- Proposal for a Directive of the European Parliament and of the Council

amending Directive (EU) 2022/2555 as regards simplification measures and

alignment with the [Proposal for the Cybersecurity Act 2] /Senate Print no.

N 165/15, COM(2026) 13/

The Senate I.

1. Supports, in general, the objectives of the submitted proposals aimed at strengthening the Union’s cyber resilience;

2. Recalls that already during discussion of the original Cybersecurity Act, the Senate emphasized that ENISA should primarily complement the activities of the Member States in the field of cybersecurity; therefore stresses the need to preserve ENISA’s predominantly supportive and coordinating role and to avoid the creation of parallel communication channels or direct links with regulated entities;

3. Is aware that the issue of ICT supply chain security, particularly in view of strategic dependencies and non-technical risks, constitutes a real challenge which may require a coordinated European approach;

4. Notes, however,

that the proposed solution in Title IV of the draft Regulation constitutes a fundamental shift in the roles between the Union and the Member States and has a significant political and security dimension;

5. Therefore considers it appropriate that Title IV of the draft Regulation be removed from the legally binding part of the Regulation and addressed through a separate non-binding instrument, which would enable coordination at Union level without creating broadly binding obligations, in particular through implementing acts of the Commission, while at the same time leaving room for taking national specificities into account and preserving the key role of the Member States;

II.

1. Expresses further concerns regarding certain measures in the targeted revision of the NIS 2 Directive, in particular those that may lead to the concentration of sensitive data on regulated entities at EU level and to the introduction of specific rules for reporting ransomware incidents, including requirements for information that is not necessary for the technical handling of an incident and may be reputationally sensitive;

2. Welcomes, on the other hand, the requirement for national cybersecurity strategies to include policies for the transition to post-quantum cryptography (PQC), as timely preparation is important for the long-term security and resilience of digital infrastructure;

III.

1. Requests the Government to inform the Senate no later than on 31 August 2026 about the way this Resolution was taken into account and about the further development of negotiations;

2. Authorises

the President of the Senate to forward this Resolution to the European Commission.

Miloš Vystrčil sign manual

President of the Senate

Stanislav Balík sign manual

Senate Verifier