The reform of the EU cybersecurity framework: Between market integration and digital security

Abstract

The ongoing reform of the European Union's Cybersecurity Act provides an opportunity to reconsider the legal foundations, regulatory evolution and strategic role of the European Union's cybersecurity framework. While the proposed amendments preserve the internal-market rationale underpinning Regulation (EU) 2019/881, they also reflect the growing importance of cybersecurity as an essential component of the Union's digital security architecture. Against this background, the article examines the relationship between Article 114 TFEU, the European cybersecurity certification framework and the broader evolution of Union cybersecurity regulation. It argues that the proposed reform does not establish a new autonomous Union competence but confirms the capacity of internal-market harmonisation to accommodate increasingly complex technological and strategic challenges. At the same time, it shows how European cybersecurity certification has progressively evolved from a market-integration instrument into a broader regulatory mechanism supporting digital security, trusted ICT supply chains and the Union's strategic objectives, while remaining within the limits of the competences conferred by the Treaties.