Digital Omnibus proposal· Article 6

Parliament amendments 1

1 proposes alternative wording.

1. 269 ~Alternative Daniel BudaEPP · JURI “Interoperable European framework for reporting incidents (1) Member States may establish or maintain national contact points, national reporting…”

   Tracker noteThis amendment changes the Commission’s amending instruction, not the wording of the act itself.

   1. The following Article 23a is added: Interoperable European framework for reporting incidents (1) Member States may establish or maintain national contact points, national reporting interfaces or other national solutions to fulfil obligations to report incidents and related events under this Directive and other Union legal acts which make provision for reporting through an interoperable mechanism. (2) ENISA shall develop and maintain, for the purpose of technical support, an interoperable European framework for reporting incidents. This framework may include a technical interface at Union level that can be used by entities only where the competent Member State or relevant competent authority has decided that it shall be used or shall be interoperable with the national solution. Without prejudice to Article 16 of Regulation (EU) 2024/2847, ENISA may ensure that this technical interface builds on the single reporting platform established under that Regulation. (3) The use of this interoperable European framework is without prejudice to the powers of Member States, CSIRT teams and competent authorities under this Directive and other applicable Union legal acts. The framework does not replace existing national solutions and does not require Member States to abandon national reporting interfaces in use on the date when this Regulation enters into force. (4) ENISA shall take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the interoperable European framework and the information submitted or disseminated via it. Information shall be stored and processed in accordance with applicable Union legal acts and the competent Member State’s decision regarding the reporting channel. Unless explicitly provided for in the applicable Union legal acts, ENISA shall not have access to the content of notifications. (5) ENISA shall develop the technical, operational and organisational specifications in cooperation with the Commission, the CSIRTs network and the competent authorities under the relevant Union legal acts. Specifications that affect national interfaces shall apply only to technical solutions approved by the Member States concerned. The specifications shall ensure that: (a) a common reporting template and harmonised data fields exist, to the extent necessary to reduce the administrative burden on entities; (b) interoperability with national contact points and with the national interfaces designated by Member States is guaranteed; (c) the rules on the jurisdiction and competence of authorities under this Directive and other applicable Union legal acts are complied with; (d) entities may report common information only once, and it shall be passed on to the relevant competent authorities, without extending ENISA’s powers; (e) the unique features of sector-specific incident reporting requirements are taken into account; (f) entities can retrieve and supplement information that they have previously submitted, insofar as the applicable law and the technical channel used allow. (6) Within [18] months from the entry into force of this Regulation, ENISA shall pilot the interoperable European framework for each included Union legal act, including testing that takes into account the specificities and requirements for the notifications set out by each Union legal act, and after consulting the Commission, the CSIRT network and the relevant competent authorities. (7) The Commission shall, in cooperation with ENISA and after consulting the CSIRT network and the relevant competent authorities, assess the proper functioning, reliability, integrity, interoperability and confidentiality of the interoperable European framework. The Commission shall publish a notice in the Official Journal of the European Union only after confirming that the use of the framework does not affect the powers of national authorities and does not require Member States to replace existing national solutions. (8) Where the assessment provided for in paragraph (7) finds deficiencies in terms of proper functioning, reliability, integrity, interoperability or confidentiality, ENISA shall take, in cooperation with the Commission, the CSIRT network and the relevant competent authorities, the necessary corrective measures and inform the Commission and the Member States of the results.

   Justification

   The amended text retains European standardisation – a single template, common fields, routing to authorities, interoperability – but turns the solution into an interoperable European framework with real flexibility for Member States. The role of the Commission and ENISA becomes one of facilitation and acceleration, not replacement of national systems. From a European perspective, the amendment combines subsidiarity, legal certainty, and effective simplification for private entities.

   Tabled by

   Daniel Buda

   Group

   EPP

   Targets

   Digital Omnibus proposal Article 6 – paragraph 1 – point 1 – introductory part

   Document

   JURI amendments 69–296 to the draft opinion

   Source

   Official text, pages 155–158

   Printed header

   Article 6 – paragraph 1 – point 1 – introductory part / Directive (EU) 2022/2555 / Article 6 – point 1

   Links

   Link to this amendment
   Cite this amendment