EU Cyber Solidarity Act, explained

The EU Cyber Solidarity Act is a European Union regulation aimed, in the European Commission's own words, at "strengthen[ing] capacities in the EU to detect, prepare for and respond to significant and large-scale cybersecurity threats and attacks." The Commission adopted its original legislative proposal on 18 April 2023 — the same day it described the package as a step toward "a European cyber shield," in Commissioner Thierry Breton's words from the Commission's press release. The Act, formally Regulation (EU) 2025/38, entered into force on 4 February 2025.

Unlike NIS2 or the Cyber Resilience Act, the Cyber Solidarity Act does not impose security obligations on individual manufacturers, operators, or products. It instead funds and coordinates EU-level and cross-border detection, preparedness, and incident-response capacity — infrastructure and reserves that sit above what any single Member State or company is required to build on its own.

Two main components

The Commission's policy page describes the Act as built around two primary mechanisms:

European Cybersecurity Alert System — a network of National and Cross-Border Cyber Hubs across the EU that, per the Commission, "use advanced technology such as Artificial Intelligence (AI) and data analytics to detect and share warnings on threats with authorities across borders." This infrastructure didn't start from zero: a first phase, launched in November 2022 under the Digital Europe Programme, had already selected "two consortia of cross-border Security Operations Centres (now Cyber Hubs)" before the Regulation formally entered into force.

Cybersecurity Emergency Mechanism — improves EU preparedness and response across three areas, per the Commission:

Area	What it does
Preparedness testing	Tests entities in "crucial sectors such as finance, energy and healthcare" for weaknesses, with sector selection informed by EU-level risk assessment
EU Cybersecurity Reserve	Incident-response services from vetted private "trusted providers," deployable at the request of Member States, EU institutions/bodies, or DEP-associated third countries during a significant or large-scale incident
Mutual assistance	Supports one Member State offering assistance to another affected by a cybersecurity incident

Incident review: a job for ENISA

The Act also creates a European Cybersecurity Incident Review Mechanism. At the request of the Commission or of national authorities acting through the EU-CyCLONe network, the EU Cybersecurity Agency (ENISA) reviews a specific significant or large-scale incident and, per the Commission, "should deliver a report that includes lessons learned, and where appropriate, recommendations to improve Union's cyber response." This is a retrospective, lessons-learned function rather than a real-time response role — it runs alongside, not instead of, the Emergency Mechanism's active-response tools.

Funding

The Commission states the Alert System and Emergency Mechanism are financed under the Digital Europe Programme's "Cybersecurity and Trust" specific objective. The Regulation re-allocates an additional €100 million from other Digital Europe Programme objectives, which the Commission says brings the new DIGITAL cybersecurity total to €842.8 million. Part of that increase reinforces the budget the European Cybersecurity Competence Centre (ECCC) manages for Cyber Hubs and preparedness work; the rest supports standing up the EU Cybersecurity Reserve. Combined with funding already planned for 2023–2027 (which the Commission says "could bring the total to €551 million") and €115 million already spent on 2021–2022 pilot activity, the Commission states the overall budget — including Member State contributions — "could amount up to €1.109 billion."

Why this matters beyond EU institutions

The Cyber Solidarity Act's reserve and alert infrastructure is aimed at Member States, critical-sector operators, and EU bodies — not directly at individual device or software vendors. But it changes the environment those vendors operate in: a large-scale incident involving a vulnerable product category is more likely to trigger a coordinated, EU-level response and an ENISA-led review than before the Act existed, which raises the reputational and regulatory stakes of a widely-exploited flaw. Device makers already tracking obligations under the Cyber Resilience Act or NIS2 should treat the Solidarity Act's reserve and alert system as the EU-level backstop that activates when a vulnerability in their product class becomes a cross-border incident, not as a separate compliance duty of its own.

SoftWSP's device and firmware security work helps manufacturers close the vulnerabilities that this kind of EU-level response exists to catch after the fact: see device & firmware security services.

This guide summarises a public European Commission publication; it does not constitute legal or compliance advice.