Summary

  • At the EU–Ukraine Cyber Dialogue in Brussels on 9 October, representatives of CERT-EU and Ukraine’s State Service of Special Communications and Information Protection (SSSCIP) signed an administrative arrangement intended to initiate exchanges between CERT-EU and CERT-UA.
  • The Commission’s 13 October readout records discussion of NIS2, the Cyber Resilience Act and Ukraine’s 5G Cybersecurity Toolbox, but it does not report that the new exchange is operating or name a delivery milestone for the 5G work.

A signature is not yet an operational exchange

The European Union and Ukraine have added a new institutional link to their cybersecurity relationship. At the fifth Cyber Dialogue, held in Brussels on 9 October, representatives of CERT-EU and Ukraine’s SSSCIP signed an administrative arrangement. The European Commission says its aim is to initiate exchanges between CERT-EU and CERT-UA so that both sides can strengthen their ability to prevent, detect and mitigate cyber incidents within their respective constituencies.

That is a concrete step, but the public wording describes an intended channel, not a reported operating result. The Commission’s readout does not say when exchanges will start, what information they will cover, how requests or onward sharing will be handled, or how the arrangement will be reviewed. Those details may exist outside the readout; their absence from this account is not evidence that safeguards or procedures are missing. It does mean the public record cannot yet show what the channel will change in practice.

The distinction matters because the two teams serve different institutional groups. CERT-EU describes itself as an inter-institutional provider, administratively hosted within the European Commission and governed by the Interinstitutional Cybersecurity Board. Its role is to help secure the information and communications infrastructure of EU institutions, bodies, offices and agencies, including by coordinating incident response and information exchange. CERT-UA describes itself as Ukraine’s national team for cyber incidents, attacks and threats, operating within SSSCIP.

The new arrangement connects these teams through their parent services; it does not, on the evidence published, create a joint team or merge their authority.

A new pairing within an older cooperation framework

The 2026 arrangement is not the beginning of all EU–Ukraine incident-response cooperation. The European Commission’s 2024 Ukraine Report says a working arrangement among ENISA, Ukraine’s National Cybersecurity Coordination Centre and SSSCIP was signed on 9 November 2023 and was being implemented. That earlier arrangement involved a different institutional pairing. The 2026 announcement adds a CERT-EU–SSSCIP route whose stated operational counterpart is CERT-UA. The public material does not say that the earlier channel has been replaced or that the two arrangements have identical scope.

The dialogue covered a wider agenda than the signed arrangement. The EU and Ukraine discussed Ukraine’s alignment with the NIS2 Directive and the Cyber Resilience Act, the implementation of the 5G Cybersecurity Toolbox, cyber-crisis management, cyber defence and cybercrime cooperation. The Commission called 5G network security a priority, but its readout gives no new assessment, deadline or completed step. Discussion is evidence that the issue was on the agenda; it is not proof of implementation.

The meeting brought together officials from both sides’ foreign affairs, digital, defence and security institutions, with EU member states attending as observers. That breadth can support coordination, but the public statement attributes the specific administrative arrangement only to CERT-EU and SSSCIP representatives. The other participants should not be described as signatories or as sharing operational control of the proposed exchange.

What would make the channel auditable

The next evidence will be more specific than another statement of intent: a published arrangement or implementation note could identify the exchange’s scope, responsible teams, escalation path and review process. Operational reporting could show when the channel begins, how each side’s constituency is defined, and whether the arrangement produces a measurable response. For the 5G track, a separate implementation record would be needed to establish progress.

Until that evidence appears, the sound conclusion is limited. A signed administrative arrangement creates a route toward information exchange between two distinct incident-response services. The Commission has not yet publicly described that route in enough detail to assess its operating boundaries or its results.

Sources

  1. European Commission, fifth EU–Ukraine Cyber Dialogue readout, 13 October 2026
  2. Ukraine Ministry of Foreign Affairs, fifth EU–Ukraine Cyber Dialogue, 12 October 2026
  3. CERT-EU, About us
  4. CERT-UA, About us
  5. European Commission, Ukraine Report 2024
  6. Regulation (EU, Euratom) 2023/2841