European Digital Sovereignty and Telecommunications: From Regulator to Builder of Strategic Autonomy

From recommendations (soft law) to obligations (hard law)

In the context of European digital sovereignty, a fundamental structural change has taken place: the European Union has abandoned the “soft law” approach (recommendations and directives with a wide margin of national discretion) to adopt a “hard law” framework (Directly applicable Regulations and Directives of maximum harmonisation).

The main regulations that have transformed recommendations or voluntary approaches into strict legal obligations are:

1. From discretion to obligation in Cybersecurity (NIS1 → NIS2)

The most obvious transformation is in the security of networks and information systems.

• Previously (NIS1 Directive): Member States had discretion to identify which companies were “operators of essential services.” This led to fragmentation, as a company could be considered essential in one country but not in another.
• Now (NIS2 Directive): State discretion is eliminated. The “size-cap rule” is introduced, which automatically designates all medium and large companies in critical sectors (energy, transport, banking, digital infrastructure, etc.) as regulated entities (essential or important), obligating them to comply with risk management and incident reporting requirements. Furthermore, senior management responsibility shifts from a recommendation of best practices to a legal obligation with personal penalties.

2. From voluntary security to “Safety by Design” (SBD)

• Previously: There was no horizontal EU framework. The cybersecurity of hardware and software products depended on the manufacturer’s discretion or on fragmented national regulations.
• Now (Cyber ​​Resilience Directive – CRA) : It is now mandatory for all products with digital components (from smart toys to industrial firewalls) to meet essential cybersecurity requirements in order to obtain CE marking. Without this mandatory compliance, the product cannot enter the European market. It is also mandatory to guarantee security updates throughout the product’s lifespan.

3. From voluntary notification to the Mandatory Identity Wallet (eIDAS → eIDAS 2)

• Previously (eIDAS 1): Member States could voluntarily notify their electronic identification systems for cross-border recognition, but were not obliged to issue a digital identity to their citizens.
• Now (eIDAS Regulation 2) : All Member States are obliged to provide a European Digital Identity Wallet (EUDI Wallet) to their citizens by 2026. In addition, major platforms and essential services are obliged to accept this wallet as a method of authentication.

4. From supervisory guidelines to Direct Financial Regulation (DORA)

• Previously : ICT risk management in the financial sector was based on guidelines from European Supervisory Authorities and disparate national regulations.
• Now (DORA Regulation) : These rules are consolidated into a directly applicable regulation that obliges financial institutions to manage third-party risk (ICT providers). DORA empowers regulators to directly monitor critical technology providers (such as large cloud providers), something that was previously outside their direct jurisdiction.

5. From the “Toolbox” to the exclusion of suppliers (5G Toolbox)

• Previously: The “5G Cybersecurity Toolbox” was a set of recommendations to mitigate risks in networks, suggesting restrictions on high-risk providers.
• Now (Economic Security Strategy and DNA): Implementation is becoming more stringent and mandatory. New legislative proposals and revisions (such as the revised Cybersecurity Act) seek to impose strict deadlines (e.g., 36 months) for the mandatory removal of equipment from “high-risk” vendors (such as Huawei or ZTE) from critical parts of telecommunications networks, shifting from a security recommendation to a national security and sovereignty imperative.

6. From voluntary to mandatory certification (Cybersecurity Act)

The Cybersecurity Act (CSA) stipulates that European certification schemes are voluntary, unless otherwise specified by Union or Member State law. However, recent legislation has created avenues for making them mandatory.

• Previously : The EU cybersecurity certification framework was, by default, voluntary for manufacturers who wanted to demonstrate the security of their products.
• Now : Through the amendments introduced by the CRA and the revision of the Cybersecurity Act (CSA), the Commission now has the power to adopt delegated acts to make European certification mandatory for product categories considered “critical” or “high risk”.