Summary

  • The Council of the EU's 21 October Digital Omnibus negotiating mandate replaces the Commission's proposed EU-wide cyber incident intake with a national entry point in each Member State.
  • ENISA's proposed EU information point would identify reporting duties and direct users to the right national entry point. The mandate bars that information point from receiving or retaining incident notifications.

An organisation has a bad morning: one event may trigger reporting duties under more than one EU rule. The European Commission's 2025 answer was a single EU entry point. The Council of the EU's 21 October position redesigns the front desk. ENISA would run a guide to the right door. The door itself would stand in each Member State.

The detail with the biggest consequence sits in proposed Article 23a of the Council mandate. ENISA's information point would help a reporter identify the applicable duty and find the appropriate national entry point. Paragraph 4 then closes the hatch: the EU guide may not submit, transmit, store or process the incident notification, and may not collect information identifying the reporter or the incident. A signpost can be extremely useful. It cannot stamp the receipt.

Proposed Article 23b hands the receiving architecture to Member States. A country could connect existing reporting systems and distribute the information to its competent authorities and computer security incident response teams. The Council asks states to work toward interoperability between national entry points. ENISA would issue non-binding technical and organisational recommendations and develop an open-source option for national use. That is a shared toolbox with locally operated counters, rather than one new EU database.

There is a bill for changing the floor plan. The mandate itself recognises that building or adapting national systems and connecting them across borders can cost money. Proposed Articles 23c and 23d assign further work on harmonising notifications and helping reports cross national boundaries when an incident does. The reporter's immediate test will be less grand: can the EU guide point to the correct receiving desk, and can that desk get the information to every authority that needs it?

This is the Council's negotiating position. Parliament still has to adopt its own position before the two institutions settle the text. Today's live ENISA product-security reporting platform, governed by the Cyber Resilience Act, has a different job and its own filing route.