The European Union's NIS Cooperation Group has recommended that member states adopt a post-quantum migration strategy by the end of 2026.

Overview Debates Related claims Topics Sources

Europol recommends establishing a European Commission-led working group, including Europol, ENISA, and the EU Anti-Money Laundering Authority, to regularly brief policymakers on quantum threats.

On September 30, 2026, ESMA stated that its MiCA reform proposals would support faster, more consistent supervisory action and reduce opportunities for companies to exploit regulatory differences

In September 2026, reports emerged that European Central Bank President Christine Lagarde had intervened with Greek officials over Binance's failed MiCA license application.

Under MiCA rules, unlicensed crypto companies had to wind down their European Union businesses starting July 1, 2026, serving existing customers only to help them transfer or sell their crypto holdings.

Europe's regulatory environment makes it difficult for companies to innovate

The European Central Bank must make a separate, formal decision to issue a digital euro even after European Union lawmakers adopt a legal framework.

The European Parliament authorized negotiations on the proposed legal framework for the digital euro in July 2026.

Legislation regarding the digital euro legal framework remained under discussion when the European Central Bank opened the merchant application call in September 2026.

The digital euro beta pilot will not constitute the digital euro defined under proposed EU Regulation and will not carry legal-tender status.

The EU Cyber Resilience Act's Article 14 reporting framework requires a detailed technical notification within 72 hours of awareness and a final report within 14 days of a corrective measure becoming available

Commercial cryptocurrency hardware wallets and downloadable wallet software are subject to the EU Cyber Resilience Act's 24-hour reporting mandate if they feature direct or indirect network data connections

The general grandfathering rule that exempts pre-December 2027 products from most EU Cyber Resilience Act requirements does not apply to Article 14's vulnerability and incident reporting obligations

The ENISA Single Reporting Platform serves as the sole legally valid channel for manufacturers to submit vulnerability and incident reports under the EU Cyber Resilience Act

Article 69(3) of the EU Cyber Resilience Act retroactively applies Article 14 reporting obligations to all in-scope products already placed on the EU market before December 11, 2027

Under Article 14 of the EU Cyber Resilience Act, which took effect on September 11, 2026, manufacturers of connected hardware and software must report actively exploited vulnerabilities within 24 hours of becoming aware of them

Failure to comply with the EU Cyber Resilience Act's Article 14 reporting requirements carries administrative fines of up to €15 million or 2.5% of a company's global annual turnover, whichever is higher

The ENISA Single Reporting Platform's fields record when a vulnerability was detected rather than when a manufacturer became aware of it, requiring manufacturers to maintain separate timestamped records of awareness

Under the EU Cyber Resilience Act, open-source software stewards are classified as a separate legal category whose reporting obligations do not begin until December 11, 2027

Article 64(10)(a) of the EU Cyber Resilience Act removes late-reporting fines specifically for microenterprises and small enterprises, though the legal obligation to report still stands

The 2026 CRA Awareness and Readiness Report published by the Linux Foundation and OpenSSF found that 66% of surveyed organizations remain unfamiliar with the EU Cyber Resilience Act