Ibec is warning that proposed changes to the EU Cybersecurity Act (‘CSA2) could threaten the stability of 18 critical industries, including health, and impose a €730 million cost on the Irish telecommunications sector alone.
In a new position paper, Ibec says the European Commission’s proposal introduces “high-risk supplier” designations based on geopolitical origin rather than technical security flaws, overriding national security competencies. It says this proposed shift risks will force sectors to remove deeply integrated ICT components that have supported business operations for decades. According to the paper, the proposals lack a technical evidence base, as industry was not consulted.
Ibec is calling for the supply chain proposals to be withdrawn pending a comprehensive impact assessment that involves “meaningful consultation with affected sectors, quantifies replacement costs, and evaluates the capacity of remaining suppliers to meet market demand”.
Threat to stability
Áine Clarke, Digital & AI Policy Executive and paper author said: “The importance of cybersecurity for our economy and society is not being questioned. Our position paper highlights that proposing rules driven by geopolitical developments, rather than evidence-based technical criteria, creates an unpredictable business environment and threatens the stability of essential services. Mandatory ‘rip-and-replace’ laws will create unforeseen contractual liabilities and run contrary to the EU’s competitiveness, digitalisation, and environmental ambitions. EU cyber resilience depends on an open, globally focused market and a predictable regulatory and investment environment.”
The group says, to remain operationally viable, certification schemes must be developed in consultation with industry, ensuring they remain voluntary, affordable, and inclusive of businesses looking to scale within the Single Market and globally.
Ibec is urging a “proportionate approach to cybersecurity regulation that is grounded in evidence and promotes EU competitiveness”. The group supports strengthening the capacities of the EU Cybersecurity Agency, ENISA, in its role as a coordinator and provider of non-binding technical guidance to the EU and its Member States
