Overview
- The European Court of Auditors published a report on September 21, 2026, saying the EU’s cooperation framework only partly helps detect and respond to major cyber incidents because member states do not share timely, usable information.
- The audit cites a September 2025 ransomware attack that disrupted passenger-handling systems at major airports in Brussels and London as an example of an incident that was not reported as cross-border and therefore did not trigger EU coordination.
- Auditors found ENISA often receives reports too late or with too little detail, sometimes only after weeks or months, which prevents rapid EU-level situational awareness and action.
- The ERK recommends integrating the European warning system into existing bodies, reducing overlap between the Commission’s cyber situation centre and ENISA, tightening oversight of Digital Europe projects, and imposing stricter controls on ownership and governance of funded organisations.
- The report notes €8.1 billion is allocated to the Digital Europe programme through 2027 with €1.4 billion for cybersecurity and warns that better monitoring and trust-building among member states are needed because NIS2 cannot force disclosure of information linked to national security.