EU Cyber Reporting Plan Hits Roadblock
The European Union’s push to simplify cyber incident reporting has hit a roadblock. The European Council’s decision to replace the European Commission’s proposed EU-wide single entry point with national entry points in each country threatens to undermine one of the Digital Package’s key goals: reducing the administrative burden on businesses after a cyberattack.
The Commission’s original plan, unveiled last November as part of its Digital Package, aimed to consolidate reporting requirements under five major EU laws—NIS2, GDPR, DORA, CER, and eIDAS—into a single digital portal. Companies would submit incident reports once, rather than having to report through separate channels in each country. The Commission estimated this could cut reporting costs by 50% to 80%, freeing resources for actual recovery efforts.
But the Council, representing EU member states, has rejected this approach. In its latest proposal for the Data Omnibus, a component of the Digital Package, it instead calls for national entry points in each country. While it retains an EU-level information point for coordination, the practical effect remains unclear.
This shift reflects deeper tensions. Member states, including France and Germany, have raised concerns about a centralized platform’s interoperability with existing national systems, as well as data privacy and national security priorities. The Council’s document acknowledges these challenges but offers no concrete mechanism to prevent fragmentation. Without clear rules on how national authorities will share incident data, multinational firms could end up submitting the same breach report dozens of times, defeating the purpose of simplification.
“Alois Thiant, director of government relations in Europe at Marsh, said that multinational and cross-border businesses would expect greater consistency and coordination between national reporting mechanisms, helping to realise the broader ambitions of reporting simplification.”
Marsh sees potential in combining national reporting mechanisms with effective EU-level data sharing, drawing on established approaches in financial services. However, the next stage of negotiations will provide an opportunity to clarify how national mechanisms would operate in practice, including how information could be shared between authorities to support businesses operating across borders.
The European Parliament will now weigh in, potentially aligning with the Commission’s original vision or pushing for its own compromise. If the Council and Parliament adopt conflicting positions, trilogue negotiations with the Commission will decide the outcome. The process is expected to drag into next year, when the Council presidency shifts from Ireland to Lithuania, a country with a strong track record in digital governance.
Ferma, the European risk management association, has urged lawmakers to prioritize a single entry point, arguing that the current fragmentation risks increasing costs and delays for businesses, particularly in sectors like finance and critical infrastructure where cyber incidents are most frequent. Meanwhile, the AI component of the Digital Package, the Digital Omnibus on AI, was finalized in July, showing that progress is possible when political will aligns.
“Lawmakers in Brussels are working diligently to get the Data Omnibus through the finish line, as they did with the Digital Omnibus on AI,” said Thaint.
