In January 2026, the European Commission presented its proposals for the Digital Networks Act (DNA) and the revised EU Cybersecurity Act (CSA2), marking a major shift in the EU's approach to telecoms, connectivity and cybersecurity.

The DNA is not a simple update of the existing framework. It introduces a more integrated and streamlined regulatory model aimed at accelerating investment in fibre, 5G and future networks, while enabling greater scale and cross-border service provision. As a regulation, it will replace an consolidate key elements of the current framework, including the European Electronic Communications Code (EECC), the Open Internet Regulation and parts of the existing spectrum and telecoms rules.

At the same time, the CSA2 strengthens the EU's cybersecurity framework by introducing a horizontal approach to ICT risk, including non-technical risks linked to supply chains and dependencies on high-risk supplies. For ICT supply chains in mobile, fixed and satellite electronic communications networks, the Commission proposes a set of measures to exclude high-risk vendor components in key ICT assets, which will become one of the fully harmonised mandatory general authorisation conditions envisaged under the DNA.