Over the course of just a few weeks, a series of cyberattacks targeting refrigeration systems has provided a particularly tangible example of how the compromise of connected technologies can have immediate consequences in the physical world. Following incidents in October affecting hundreds of French supermarkets, anomalies and tampering involving refrigeration systems were reported in early November across at least nine European countries, including Italy, forcing several operators to dispose of spoiled food products. A few days later, an attack also affected three sites of the Établissement Français du Sang, where the remote alteration of cold-storage parameters put samples and plasma bags at risk, although the material was ultimately preserved thanks to the intervention of alarm systems.
Incidents of this kind show that cybersecurity is no longer limited to protecting the IT systems directly managed by a company, but increasingly extends to the technologies, infrastructure and suppliers on which business continuity depends. Against this background, on 20 January 2026, the European Commission presented its proposal for the so-called Cybersecurity Act 2 (CSA2), which, if adopted, would repeal and replace Regulation (EU) 2019/881. The proposal aims to strengthen the role of the European Union Agency for Cybersecurity (ENISA), revise the European cybersecurity certification framework and, above all, introduce a new framework for assessing risks connected with technology supply chains.
A More Operational European Framework
The 2019 Cybersecurity Act built the European framework primarily around ENISA and a common certification framework for Information and Communication Technology (ICT) products, services and processes. Since then, however, the increasing sophistication of cyberattacks and growing tensions affecting technology supply chains have significantly changed the context in which that framework operates.
CSA2 therefore seeks to strengthen ENISA’s coordination and support functions and make the European certification system more effective. Of particular interest to businesses is the potential link between certification and regulatory compliance, since, where the conditions laid down by the applicable legislation are met, a European certification could help demonstrate compliance with certain cybersecurity obligations.
Supply Chains Become Part of the Risk Assessment
The most significant development, however, concerns the security of ICT supply chains. Even a company with adequate internal safeguards may remain vulnerable through software, cloud services, network infrastructure or other technologies supplied by external providers.
The proposal therefore provides for coordinated assessments at EU level taking into account not only technical vulnerabilities but also non-technical risks, including the possibility that a supplier may be subject to the influence of a third country in circumstances capable of affecting service continuity, data security or the integrity of the technology concerned. The assessment would therefore no longer focus solely on how secure a product or service is, but also on who supplies it, who controls the supplier and the degree of dependency that has developed on that provider.
Where the conditions set out in the proposal are met, measures could include diversification of the supply chain, independent technical assessments, restrictions on the processing or transfer of data and limitations on the outsourcing of certain activities. For specific categories of entities falling within the scope of NIS2, the use of ICT components supplied by providers classified as high-risk could also be restricted.
The international dimension of the new framework is particularly relevant for companies operating through global supply chains. Although CSA2 is European legislation, its effects could also extend to ICT suppliers established outside the EU that provide technologies, services or infrastructure to European operators, particularly where ownership structures, control or links with third countries become relevant to the risk assessment.
What Could Change for Businesses
If the approach set out in CSA2 is confirmed, the selection of an ICT supplier would increasingly require companies to consider, alongside price, quality and technical features, factors such as the supplier’s ownership structure, the use of sub-suppliers, the degree of dependency on the technology concerned and whether it could be replaced without materially affecting business continuity.
These issues would inevitably have contractual implications, particularly in long-term relationships and supply chains spanning multiple jurisdictions. Companies may need to regulate more carefully the effects of regulatory changes, changes in the ownership or control of the supplier, including through specific change-of-control provisions, the use of sub-suppliers and information and cooperation obligations, while also providing mechanisms to manage the replacement of technology or, where necessary, an early exit from the contractual relationship.
For multinational groups, this may also require greater coordination among group companies, especially where the same suppliers or technological solutions are used across several jurisdictions.
Similar considerations may become relevant in M&A transactions. Where a target is significantly dependent on suppliers or technologies that are difficult to replace, a potential migration may affect integration costs, business continuity and, in more significant cases, the overall valuation of the transaction. Due diligence should therefore also consider the company’s degree of technological dependency and the flexibility of the relevant contractual arrangements.
The telecommunications sector provides one of the clearest examples of the potential economic impact of this approach: for certain essential network components, the proposal contemplates the possibility of restricting the use of technologies supplied by high-risk providers and, in certain circumstances, requiring their gradual replacement.
How Companies Can Prepare
CSA2 remains a legislative proposal and its text may still change during the EU legislative process. Nevertheless, companies can already use this phase to assess whether their current contractual and organisational framework is sufficiently flexible to address potential future restrictions affecting ICT suppliers or technology supply chains.
A first step may consist in identifying strategic suppliers and technologies that would be difficult to replace, together with a review of existing contracts to verify whether they adequately address regulatory changes, change of control, subcontracting, audit rights, information and cooperation obligations, technology replacement and early termination. Any gaps can be addressed when contracts are renewed or renegotiated, while international groups may also consider developing common criteria and contractual provisions to be applied across different jurisdictions.
These measures retain their value regardless of the final content of CSA2, as they allow companies to identify potential issues before they result in mandatory replacement, urgent renegotiations or disruption to business continuity. From this perspective, preparing for the new European framework requires not only an understanding of technological dependencies, but also the ability to translate them into appropriate contractual tools, internal procedures and governance measures.
