European Commission’s Proposal on the Cyber Security Act 2.0

The Association of Finnish Cities and Municipalities (AFCM) represents all 308 Finnish municipalities and cities. They have extensive responsibilities of providing public services such as primary and secondary education, employment services, economic development services, land and environmental permitting and oversight, and technical infrastructure.

AFCM welcomes the Commission’s proposal for Cyber Security Act 2.0. European cyber security legislation has expanded in recent years. NIS2 Directive, Cyber Resilience Act (CRA) and Cyber Security Act (CSA) form its backbone. The regulative framework is comprehensive. If implemented successfully, it will significantly improve the security of our digital environments. AFCM proposes changes to include local and regional governments (LRGs) more broadly into planning and implementation activities and to improve harmonization and certification practices.

ENISA should support LRGs in implementing European cyber security requirements in procurement of digital solutions and services

In support of the implementation of EU cyber security legislation, ENISA should recognize LRGs as key purchasers of digital services and cyber security solutions. AFCM therefore recommends that ENISA provide guidance and practical support for drafting cyber and information security requirements in public procurement processes. This could include for example model contract clauses for products and services covered by the Cyber Resilience Act (CRA) and the transition to post-quantum cryptography (PQC). Such support would promote more consistent and harmonized implementation of EU cyber security legislation across Member States.

As technology evolves rapidly, procurement practices must remain flexible and resilient. Therefore, any ENISA guidance or model clauses should be voluntary, allowing organisations to adapt them to changing technological and/or national and local needs.

ENISA should also avoid duplicating effective national solutions with its own services. Instead, it should identify, promote and scale existing good practices across the EU.

Certifications should be credible, technical and voluntary

AFCM supports EU-wide cyber security certification schemes. Widely adopted certifications would reduce administrative burdens for suppliers, including SMEs, as well as for public-sector procurers such as LRGs. At the same time, they would raise the overall level of cyber security across Europe.

To accelerate the development of certification schemes and increase their impact, ENISA should focus on technical certification requirements. Political considerations, such as origin-related requirements, should be addressed separately through policy instruments such as guidelines.

Certification schemes should primarily remain voluntary. Their uptake will hence depend on their quality, relevance and credibility. Effective schemes should include up-to-date requirements, multiple assurance levels, reliable auditing mechanisms, effective oversight and appropriate sanctions for non-compliance. To enhance credibility, key results and “numbers” of oversight activities and sanctions should be published yearly. ENISA should also ensure sustained, long-term promotion, maintenance and development of certification frameworks.

When developing guidance, tools or other support services, ENISA should actively involve LRGs from the outset, and ensure that their needs are reflected alongside those of national authorities, businesses and civil society organisations.

Technical considerations should guide supply chain security decisions

AFCM believes that decisions to restrict or exclude digital products and services from European ICT supply chains should be based primarily on technical risk assessments rather than political considerations alone.

Where products or services from specific geographic regions are under review, key stakeholders, including LRGs, should be consulted before decisions are made. This will also help analyse the impacts of proposed restrictions.

If the European Commission decides to exclude certain products or services from ICT supply chains, organisations should be granted sufficient transition periods unless immediate security risks require urgent action. For lower-risk organisations, including many smaller LRGs, transition periods should be long enough to allow existing investments to reach the end of their lifecycle.

Digital Omnibus - single-entry-point mechanism should not distort national working practices and systems

When implementing single-entry-point reporting mechanisms, the European Commission should avoid disrupting well-functioning national reporting systems. New European systems should be fully interoperable with existing national solutions to enable efficient information sharing and avoid duplicate reporting structures.

In addition, the collection of unnecessary data in centralised EU repositories should be avoided wherever possible to minimise cyber security risks and unnecessary costs.

European Commission’s Proposal on Cyber Security Act 2.0 - AFCM 
Amendmentss

Recital 21

Text proposed by the commission 

As AI agents have become increasingly capable and AI applications have become more deeply embedded in real-world business scenarios, industry is rapidly evolving towards a new paradigm that equips such systems with autonomous execution capabilities. This transition to a new paradigm requires a robust technical framework to ensure the safety, accuracy and legal compliance of those systems, given the stringent engineering requirements pertaining on AI platforms. Accordingly, the Cloud and AI Leadership Initiatives should aim to establish sovereign and secure AI platforms dedicated to the large-scale deployment and orchestration of advanced AI agents. Those platforms should be supported by innovative orchestration frameworks that ensure transparency and accountability in multi-agent interactions. It is also necessary to facilitate the development of rigorous testing and experimentation methodologies of AI agents and orchestration to minimise unintended autonomous behaviour.

Amendment 

As AI agents have become increasingly capable and AI applications have become more deeply embedded in real-world business scenarios, industry is rapidly evolving towards a new paradigm that equips such systems with autonomous execution capabilities. This transition to a new paradigm requires a robust technical framework to ensure the safety, accuracy and legal compliance of those systems, given the stringent engineering requirements pertaining on AI platforms. Accordingly, the Cloud and AI Leadership Initiatives should aim to establish sovereign and secure AI platforms dedicated to the large-scale deployment and orchestration of advanced AI agents. Those platforms should be supported by innovative orchestration frameworks that ensure transparency and accountability in multi-agent interactions. It is also necessary to facilitate the development of rigorous testing and experimentation methodologies of AI agents and orchestration to minimise unintended autonomous behaviour. Such platforms shall be developed with due regard to the needs of private and public sector users, including local authorities.

Justification

The proposed addition clarifies that the development of sovereign and secure AI platforms should take into account the needs of both private and public sector users, including local authorities. This is necessary to ensure that such platforms are fit for practical deployment across different sectors and levels of administration.

Recital 92 (new)

Text proposed by the commission 

Amendment 

(x) This Regulation does not interfere with Member States’ competence for town and country planning, including any terrestrial or land spatial planning system used to plan how land and coastal zone should be used.

Justification

A new recital should be added to the preamble to the legislation expressly safeguarding the Member States’ decision-making powers in matters of spatial planning.  The proposed amendment promotes the interests of European Union citizens by strengthening democratic participation and local self-government and ensuring that the Union’s competences are exercised in accordance with the principles of subsidiarity and proportionality laid down in the Treaties.

Article 7 (2)(c)

Text proposed by the commission

1. Where data centre capacity is being deployed within the territory of a Member State, that Member State shall designate at least one data centre acceleration zone (‘acceleration zone’) within its territory by [P.O. insert the date of entry into force of this Regulation plus 6 months]. Member States shall consider the following aspects when designating acceleration zones.

Amendment

1. Where data centre capacity is being deployed located on the territory of a Member State, that Member State shall may designate at least one data centre acceleration zone (the "Acceleration Zone") within its territory by [P.O. insert the date of entry into force of this Regulation plus 6 months]. Member States shall consider the following aspects when designating the acceleration zones.

Justification

The proposed article would interfere with local authorities’ planning powers by requiring the designation of at least one specific area and, under Article 13, approval of a baseline permit for activities within it. Compliance would in practice also require a land-use planning procedure. The limits of competence must not be circumvented. The Regulation would be acceptable only if designation of an acceleration area under Article 10(1) and (2) were voluntary for Member States rather than mandatory.

Article 10(3)

Text proposed by the commission 

3. National, regional and local authorities responsible for preparing spatial and development plans shall consider including, in those plans, provisions for the development of data centre projects deployed in acceleration zones, and of the necessary infrastructure. Member States shall ensure that all relevant spatial planning data are available to data centre operators. Where those plans are subject to an assessment pursuant to Directive 2001/42/EC of the European Parliament and of the Council and Article 6 of Directive 92/43/EEC, those assessments shall be combined. Where applicable, the combined assessment shall also address the impact on potentially affected water bodies referred to in Directive 2000/60/EC of the European Parliament and of the Council.

Amendment 

(To be removed: 3. National, regional and local authorities responsible for preparing spatial and development plans shall consider including, in those plans, provisions for the development of data centre projects deployed in acceleration zones, and of the necessary infrastructure.) 

Member States shall ensure that all relevant spatial planning data are available to data centre operators. Where those plans are subject to an assessment pursuant to Directive 2001/42/EC of the European Parliament and of the Council and Article 6 of Directive 92/43/EEC, those assessments shall be combined. Where applicable, the combined assessment shall also address the impact on potentially affected water bodies referred to in Directive 2000/60/EC of the European Parliament and of the Council.

Justification 

This provision would require national spatial-planning authorities to consider rules for data centres and related infrastructure in their plans. By imposing substantive requirements for spatial and development planning, the Regulation would intrude on Member States’ planning powers and, in particular, local authorities’ competence. It must therefore be deleted. The Regulation must respect national autonomy in spatial planning and local powers over land use, land policy and land-use arrangements.

Article 12(2)(a)

Text proposed by the commission 

2. The role of a single information point may include, among other things, coordinating, facilitating, monitoring and sharing information on the procedure relating to:
(a)    spatial planning and building permits;

Amendment 

2. The role of a single information point may include, among other things, coordinating, facilitating, monitoring and sharing information on the procedure relating to:
(a)    (To be removed: spatial planning and) building permits;

Justification 

The words “spatial planning” is deleted from Article 12(2)(a) for reasons of consistency. Member States could nevertheless always include such general guidance among the tasks of the single contact point authority.

Article 13(1)

Text proposed by the commission 

1. Data centre projects deployed in acceleration zones shall be considered as strategic projects within the meaning of Article 14 of Regulation (EU) 2026/XXX [on speeding-up environmental assessments] and shall benefit from the toolbox set out in the Annex to that Regulation. 

Amendment 

Deleted.

Justification 

The toolbox regulation (proposed in the Regulation on Speeding Up Environmental Assessments) would apply procedural rules to sector-specific legislation through cross-references. This may undermine the clarity of the legal framework, especially where referenced rules have not been adopted or may later be amended. A transparent legislative technique should be used. Tacit consent should be approached with caution, as it is ill-suited to complex permitting procedures involving applicants, third-party rights and the public interest. They require an express decision that is based on an actual substantive assessment by the competent authority.

Article 13(2-5)

Text proposed by the commission 

2. For each designated acceleration zone, Member States shall prepare and issue an aggregated baseline permit authorising the deployment of data centres in that acceleration zone.  This aggregated baseline permit shall cover the permits and administrative authorisations required for the data centre projects located within the acceleration zone, excluding installation-specific permits.
3. Before issuing the aggregated baseline permit referred to in paragraph 2, Member States shall carry out all necessary procedures and assessments, including any relevant environmental assessments, planning procedures and evaluations applicable at the level of the acceleration zone. 
4. Data centres deployed in acceleration zones shall be required to obtain additional permits only for activities falling outside the aggregated baseline permit referred to in paragraph 2. 
5. Member States shall ensure that administrative applications related to the planning, construction and the operation of data centre deployed in acceleration zones are processed in an efficient, transparent and timely manner. The permit-granting procedure for data centre projects deployed in data centre acceleration zones shall not exceed 12 months, from the moment a comprehensive application has been submitted.  The time limit shall be without prejudice to any shorter time limits set by Member States. Where such a status exists in national law, data centre projects shall be allocated the status of highest national significance possible and be treated as such in permit-granting processes. This paragraph shall apply only where such status exists in national law and shall not create an obligation for Member States to introduce such status.

Amendment 

Deleted.

Justification 

As a rule, environmental permits cannot properly be granted without a concrete project. Environmental, water management, construction and other permit requirements presuppose information on the precise location of the project, its energy use, water requirements, waste heat, noise, traffic and other relevant factors. A baseline permit granted without an identified project would shift responsibility, including the costs of investigations and assessments, to the authorities and would weaken their ability to assess the actual impacts. Operators should bear the costs of environmental assessments, regulatory supervision and official approvals, including administrative permits, required for their activities.

When read in conjunction with the proposed provisions on the designation of areas, Article 13 would interfere with the competence of Member States and the spatial-planning powers of their local authorities, as compliance with the requirements would require the exercise of land-use or other spatial-planning discretion.

Article 13(a) (new) 

Text proposed by the commission 

Amendment

Nothing in this regulation shall affect the competence of the Member States with regard to spatial planning.

Justification

An express safeguard clause should be added to the legislation to protect the Member States’ decision-making powers in matters of spatial planning (cf., for example, Article 12 of Directive (EU) 2025/2360 on soil monitoring and resilience).

Article 32(1)

Text proposed by the commission

1.    In public procurement procedures for innovative cloud computing services and AI systems, contracting authorities shall include, as part of the quality evaluation of the tender, non-price award criteria that allow them to evaluate the tenderer’s contribution to the development of a European cloud and AI ecosystem.
2.    When applying non-price award criteria under paragraph 1, contracting authorities shall ensure that non-price award criteria are: (a) linked to the subject matter of the contract; (b) not conferring unrestricted freedom of choice on the contracting authority; (c) expressly set out in the procurement documents or in the contract notice; (d) ancillary and not decisive in the award of the contract. Without affecting contracting authorities’ discretion to apply additional criteria, the non-price award criteria referred to in paragraph 1 shall enable contracting authorities to evaluate the extent to which: (a) (b) (c) (d) the tenderer contributes to strengthening the digital technology supply chain in the Union, including the use of software or hardware designed or manufactured in the Union; the tenderer has integrated technologies developed in the Union, including research and development results stemming from Union funded research and development programmes and makes use of tools, such as standards, specification, software, models or other technology developed in the Union; the innovation required to deliver the service contributes to strengthening the security of supply and the development of a European cloud and AI ecosystem; the service is delivered, to the greatest extent feasible with regard to market availability and technical requirements, through critical computing, storage and networking hardware components designed and/or manufactured in the Union, or, where this is not feasible, through hardware components from a third country that contributes to strengthening the security of supply and the development of a European cloud and AI ecosystem.

Amendment

Replaced with a reference to the European preference requirements of the upcoming Public Procurement Act.

Justification

Definitions such as ‘innovative cloud and AI procurements´ or the proposed price-quality comparison mechanism need to be specified or removed to avoid local-level interpretation challenges. ´Innovation´ or ´participation in the ecosystem´ is policy language and has no connection with practical procurement activities. The obligation to assess the provider's involvement in the development of the European cloud and AI ecosystem, as proposed in this Article, is a very challenging task for an individual procurement expert. The established principle of public procurement is that the characteristics of the provider company are assessed based on suitability requirements, and the tenders of suitable companies are compared on the basis of the characteristics and price of the product offered. The proposed mechanism of scoring the company's overall participation by the quality score of the product offered is not in line with the logic of procurement law and is not related to the subject matter of the procurement. The Commission is in the process of reforming the procurement directives. In the CADA, the creation of new procurement mechanisms should be avoided. Instead, public cloud and AI procurements should also follow the mechanisms of the new Public Procurement Act. The mechanism must be related to the product being procured, not to the provider company.

Article 41

Text proposed by the commission

The Union and Member States shall take the necessary measures to encourage Union entities and public sector bodies to use and facilitate the reuse of open standards and components released under an open source licence when building their cloud and AI ecosystem or stack, taking into account functionalities, including security, total cost, and other relevant, duly justified objective criteria.

Amendment

The Union and Member States shall take the necessary measures to encourage Union entities, whether a natural person, legal person or another type of entity, who resides or which is established in the Union, whether private or public sector bodies to use and facilitate, based primarily as default on market mechanisms, the reuse of open standards and components released under an open source licence when building their cloud and AI ecosystem or stack, taking into account functionalities, including security, total cost, and other relevant, duly justified objective criteria.

Justification

Open source should be an optional and voluntary alternative, not the primary option.

Article 42

Text proposed by the commission

When making software to which they hold intellectual property rights available for reuse under an open source licence, a Union entity or public sector body shall do so using a catalogue or repository that is connected to, and made accessible through, the EU OSS Catalogue referred to in Article 43.

Amendment

When making software to which they hold intellectual property rights available for reuse under an open source licence, a Union entity or public sector body shall do so using a catalogue or repository that is connected to, and made accessible through, the EU OSS Catalogue referred to in Article 43. The requirement for public entities to make the Software available for reuse, the technical and administrational procedures shall be made as lean and cost efficient as possible to minimize the administrative expense for the parties making their Software available.

Justification

The administrative costs of public administration must not become excessive.