Connect Europe has called on EU lawmakers to amend the European Commission’s proposed revision of the Cybersecurity Act (CSA), warning that the current draft risks undermining investment and digital competitiveness. The group said that as Europe becomes increasingly dependent on digital connectivity, the security of telecom networks and services is a key pillar of the continent’s resilience. Connect Europe stressed that its members are fully committed to implementing the NIS2 Directive and complying with national and EU security requirements.

However, the organisation cautioned that the proposed changes to the CSA could place excessive regulatory and financial burdens on telecom operators, who are already investing heavily in 5G and fibre roll-out. According to Connect Europe, the draft law could impose multi-billion-euro additional costs that are likely to be underestimated.

While the proposal aims to strengthen the EU cybersecurity certification framework, Connect Europe warned that new ICT supply chain obligations could create significant constraints for operators unless they are based on robust risk assessments and accompanied by mitigating measures such as cost reimbursement. Without such safeguards, the measures could negatively affect network deployment, operational continuity and long-term investment planning.

Connect Europe said that any reforms should be risk-based, proportionate and workable. It called for real regulatory simplification to reduce overlap between the CSA and other frameworks such as NIS2, DORA and the Cyber Resilience Act, allowing companies to focus more on security operations rather than compliance.

The group also urged lawmakers to ensure that cybersecurity certification schemes are market-relevant and proportionate, and that supply chain security measures respect Member States’ competence in national security while providing predictability for long-term infrastructure investment.

Connect Europe concluded by calling on EU legislators to revise the proposal during the legislative process to achieve effective security outcomes without compromising Europe’s digital competitiveness.