Digital Omnibus proposal
Article 6
Compare the available Commission, Council and Parliament texts and amendments affecting this article.
Article total: 1 part · 0 Council drafts · 1 Parliament amendment
Removed wording is struck through; added or replacement wording is highlighted.
Institutional text
European Commission proposal
The wording proposed by the Commission at the start of this legislative file.
No standalone Commission wording is mapped to this tracked part. A newly proposed provision may have no earlier text of its own.
Commission source wording and instructions
Article 6 – paragraph 1 – point 1 – introductory part
Commission proposal
1. The following Article 23a is added:
Institutional text
Council Presidency texts
Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.
No Council wording is mapped to these tracked parts.
Competing proposals
European Parliament amendments
These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.
More filters
Alternative wording Amendment 269 · Daniel Buda JURI
This amendment changes an instruction in the amending proposal, not standalone wording of the amended act.
Digital Omnibus proposal · Article 6 – paragraph 1 – point 1 – introductory part
1. The following Article 23a is added:
Interoperable European framework for reporting incidents (1) Member States may establish or maintain national contact points, national reporting interfaces or other national solutions to fulfil obligations to report incidents and related events under this Directive and other Union legal acts which make provision for reporting through an interoperable mechanism.
(2) ENISA shall develop and maintain, for the purpose of technical support, an interoperable European framework for reporting incidents. This framework may include a technical interface at Union level that can be used by entities only where the competent Member State or relevant competent authority has decided that it shall be used or shall be interoperable with the national solution. Without prejudice to Article 16 of Regulation (EU) 2024/2847, ENISA may ensure that this technical interface builds on the single reporting platform established under that Regulation.
(3) The use of this interoperable European framework is without prejudice to the powers of Member States, CSIRT teams and competent authorities under this Directive and other applicable Union legal acts. The framework does not replace existing national solutions and does not require Member States to abandon national reporting interfaces in use on the date when this Regulation enters into force.
(4) ENISA shall take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the interoperable European framework and the information submitted or disseminated via it. Information shall be stored and processed in accordance with applicable Union legal acts and the competent Member State’s decision regarding the reporting channel. Unless explicitly provided for in the applicable Union legal acts, ENISA shall not have access to the content of notifications.
(5) ENISA shall develop the technical, operational and organisational specifications in cooperation with the Commission, the CSIRTs network and the competent authorities under the relevant Union legal acts. Specifications that affect national interfaces shall apply only to technical solutions approved by the Member States concerned. The specifications shall ensure that:
(a) a common reporting template and harmonised data fields exist, to the extent necessary to reduce the administrative burden on entities;
(b) interoperability with national contact points and with the national interfaces designated by Member States is guaranteed;
(c) the rules on the jurisdiction and competence of authorities under this Directive and other applicable Union legal acts are complied with;
(d) entities may report common information only once, and it shall be passed on to the relevant competent authorities, without extending ENISA’s powers;
(e) the unique features of sector-specific incident reporting requirements are taken into account;
(f) entities can retrieve and supplement information that they have previously submitted, insofar as the applicable law and the technical channel used allow.
(6) Within [18] months from the entry into force of this Regulation, ENISA shall pilot the interoperable European framework for each included Union legal act, including testing that takes into account the specificities and requirements for the notifications set out by each Union legal act, and after consulting the Commission, the CSIRT network and the relevant competent authorities. (7) The Commission shall, in cooperation with ENISA and after consulting the CSIRT network and the relevant competent authorities, assess the proper functioning, reliability, integrity, interoperability and confidentiality of the interoperable European framework. The Commission shall publish a notice in the Official Journal of the European Union only after confirming that the use of the framework does not affect the powers of national authorities and does not require Member States to replace existing national solutions.
(8) Where the assessment provided for in paragraph (7) finds deficiencies in terms of proper functioning, reliability, integrity, interoperability or confidentiality, ENISA shall take, in cooperation with the Commission, the CSIRT network and the relevant competent authorities, the necessary corrective measures and inform the Commission and the Member States of the results.
Justification
The amended text retains European standardisation – a single template, common fields, routing to authorities, interoperability – but turns the solution into an interoperable European framework with real flexibility for Member States. The role of the Commission and ENISA becomes one of facilitation and acceleration, not replacement of national systems. From a European perspective, the amendment combines subsidiarity, legal certainty, and effective simplification for private entities.
No amendments match these filters.
Selected texts
Compare wording
Choose a tracked part and a named pair of texts. Comparisons are offered only where both sides cover the same legal unit.
Select a specific tracked part above to compare wording.
No same-scope comparison is available for this tracked part. Its source wording remains available in the article text sections.
Article 6 – paragraph 1 – point 1 – introductory part
Wording reproduced in the amendment → Amendment 269 · JURI amendments 69–296 to the draft opinion
Changes in context
1. The following Article 23a is added:
Interoperable European framework for reporting incidents (1) Member States may establish or maintain national contact points, national reporting interfaces or other national solutions to fulfil obligations to report incidents and related events under this Directive and other Union legal acts which make provision for reporting through an interoperable mechanism.
(2) ENISA shall develop and maintain, for the purpose of technical support, an interoperable European framework for reporting incidents. This framework may include a technical interface at Union level that can be used by entities only where the competent Member State or relevant competent authority has decided that it shall be used or shall be interoperable with the national solution. Without prejudice to Article 16 of Regulation (EU) 2024/2847, ENISA may ensure that this technical interface builds on the single reporting platform established under that Regulation.
(3) The use of this interoperable European framework is without prejudice to the powers of Member States, CSIRT teams and competent authorities under this Directive and other applicable Union legal acts. The framework does not replace existing national solutions and does not require Member States to abandon national reporting interfaces in use on the date when this Regulation enters into force.
(4) ENISA shall take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the interoperable European framework and the information submitted or disseminated via it. Information shall be stored and processed in accordance with applicable Union legal acts and the competent Member State’s decision regarding the reporting channel. Unless explicitly provided for in the applicable Union legal acts, ENISA shall not have access to the content of notifications.
(5) ENISA shall develop the technical, operational and organisational specifications in cooperation with the Commission, the CSIRTs network and the competent authorities under the relevant Union legal acts. Specifications that affect national interfaces shall apply only to technical solutions approved by the Member States concerned. The specifications shall ensure that:
(a) a common reporting template and harmonised data fields exist, to the extent necessary to reduce the administrative burden on entities;
(b) interoperability with national contact points and with the national interfaces designated by Member States is guaranteed;
(c) the rules on the jurisdiction and competence of authorities under this Directive and other applicable Union legal acts are complied with;
(d) entities may report common information only once, and it shall be passed on to the relevant competent authorities, without extending ENISA’s powers;
(e) the unique features of sector-specific incident reporting requirements are taken into account;
(f) entities can retrieve and supplement information that they have previously submitted, insofar as the applicable law and the technical channel used allow.
(6) Within [18] months from the entry into force of this Regulation, ENISA shall pilot the interoperable European framework for each included Union legal act, including testing that takes into account the specificities and requirements for the notifications set out by each Union legal act, and after consulting the Commission, the CSIRT network and the relevant competent authorities. (7) The Commission shall, in cooperation with ENISA and after consulting the CSIRT network and the relevant competent authorities, assess the proper functioning, reliability, integrity, interoperability and confidentiality of the interoperable European framework. The Commission shall publish a notice in the Official Journal of the European Union only after confirming that the use of the framework does not affect the powers of national authorities and does not require Member States to replace existing national solutions.
(8) Where the assessment provided for in paragraph (7) finds deficiencies in terms of proper functioning, reliability, integrity, interoperability or confidentiality, ENISA shall take, in cooperation with the Commission, the CSIRT network and the relevant competent authorities, the necessary corrective measures and inform the Commission and the Member States of the results.
RemovedAdded
Both texts in full
Wording reproduced in the amendment
1. The following Article 23a is added:
Amendment 269 · JURI amendments 69–296 to the draft opinion
1. The following Article 23a is added:
Interoperable European framework for reporting incidents (1) Member States may establish or maintain national contact points, national reporting interfaces or other national solutions to fulfil obligations to report incidents and related events under this Directive and other Union legal acts which make provision for reporting through an interoperable mechanism.
(2) ENISA shall develop and maintain, for the purpose of technical support, an interoperable European framework for reporting incidents. This framework may include a technical interface at Union level that can be used by entities only where the competent Member State or relevant competent authority has decided that it shall be used or shall be interoperable with the national solution. Without prejudice to Article 16 of Regulation (EU) 2024/2847, ENISA may ensure that this technical interface builds on the single reporting platform established under that Regulation.
(3) The use of this interoperable European framework is without prejudice to the powers of Member States, CSIRT teams and competent authorities under this Directive and other applicable Union legal acts. The framework does not replace existing national solutions and does not require Member States to abandon national reporting interfaces in use on the date when this Regulation enters into force.
(4) ENISA shall take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the interoperable European framework and the information submitted or disseminated via it. Information shall be stored and processed in accordance with applicable Union legal acts and the competent Member State’s decision regarding the reporting channel. Unless explicitly provided for in the applicable Union legal acts, ENISA shall not have access to the content of notifications.
(5) ENISA shall develop the technical, operational and organisational specifications in cooperation with the Commission, the CSIRTs network and the competent authorities under the relevant Union legal acts. Specifications that affect national interfaces shall apply only to technical solutions approved by the Member States concerned. The specifications shall ensure that:
(a) a common reporting template and harmonised data fields exist, to the extent necessary to reduce the administrative burden on entities;
(b) interoperability with national contact points and with the national interfaces designated by Member States is guaranteed;
(c) the rules on the jurisdiction and competence of authorities under this Directive and other applicable Union legal acts are complied with;
(d) entities may report common information only once, and it shall be passed on to the relevant competent authorities, without extending ENISA’s powers;
(e) the unique features of sector-specific incident reporting requirements are taken into account;
(f) entities can retrieve and supplement information that they have previously submitted, insofar as the applicable law and the technical channel used allow.
(6) Within [18] months from the entry into force of this Regulation, ENISA shall pilot the interoperable European framework for each included Union legal act, including testing that takes into account the specificities and requirements for the notifications set out by each Union legal act, and after consulting the Commission, the CSIRT network and the relevant competent authorities. (7) The Commission shall, in cooperation with ENISA and after consulting the CSIRT network and the relevant competent authorities, assess the proper functioning, reliability, integrity, interoperability and confidentiality of the interoperable European framework. The Commission shall publish a notice in the Official Journal of the European Union only after confirming that the use of the framework does not affect the powers of national authorities and does not require Member States to replace existing national solutions.
(8) Where the assessment provided for in paragraph (7) finds deficiencies in terms of proper functioning, reliability, integrity, interoperability or confidentiality, ENISA shall take, in cooperation with the Commission, the CSIRT network and the relevant competent authorities, the necessary corrective measures and inform the Commission and the Member States of the results.