On 20 January 2026, the European Commission published a proposal for a regulation revising the Cybersecurity Act of 2019. This text, known as CSA2, is not merely a technical update to the European certification framework. It introduces a concept absent from the original regulation: cyber posture certification. For organisations subject to NIS2, the mechanics of proving compliance change profoundly.
What CSA2 changes in the regulatory landscape
The Cybersecurity Act of 2019 established the European cybersecurity certification framework: EUCS for cloud services, EUCC for ICT products. These schemes make it possible to certify that a product or service meets a defined security level. Their limit is structural: they cover products or services, not the overall posture of an organisation.
CSA2 extends the scope of the ECCF (European Cybersecurity Certification Framework) to include certification schemes that apply to the entities themselves. This is the central conceptual leap of this revision.
Cyber posture certification: what it covers
A cyber posture certificate attests that an organisation complies with the cyber risk management requirements defined by a given reference framework. In the NIS2 context, this corresponds to the ten measures of Article 21: risk management, security policy, incident handling, business continuity, supply chain security, encryption, access control, testing and audits, training, and the use of appropriate technologies.
The mechanism is simple in theory. The organisation undergoes an audit carried out by a body accredited at European level, which issues a certificate. This certificate serves as proof of compliance before the competent national authorities. In France, the competent authority for NIS2 is ANSSI. No parallel national re-certification would be required.
The logic is close to that of ISO 27001. The difference is that cyber posture certification would be recognised directly as proof of NIS2 compliance in all Member States, without each national authority imposing its own audit procedure. For an organisation operating in several EU countries, this is a substantial simplification.
The figures that illustrate market expectations
A survey by ISC2, published in June 2026 among 430 European security managers, found that 36 % of organisations would use cyber posture certification to demonstrate their NIS2 compliance if it were available today, and 49 % answered "probably". This is not lukewarm enthusiasm: 85 % of the panel expresses serious interest in a tool whose text is still under negotiation.
This signal confirms a real problem. Organisations subject to NIS2 in several Member States face a proliferation of evidence requirements that diverge from country to country. Germany, France and the Netherlands each have their own interpretation of the Article 21 measures, their own documentary requirements and their own inspection schedules. A single European certificate would replace part of this patchwork.
A concrete example: the cross-border SaaS publisher
Consider a mid-sized SaaS publisher selling its platform to customers in France, Germany and Belgium. Under NIS2 in its current form, this operator must demonstrate its compliance to three national competent authorities. The documentary and reporting requirements are not identical from one country to the next, even though they derive from the same European text.
With the cyber posture certification under CSA2, a single audit issued by a body accredited at European level would suffice. The publisher presents its certificate to the three authorities. None can impose an additional audit if the certification scheme covers the NIS2 requirements. The gain in administrative workload is immediate and measurable.
What CSA2 does not yet resolve
The proposal is in trilogue between the Commission, Parliament and the Council. Negotiations are expected throughout 2026: the final text will not be adopted before 2027 at the earliest. Cyber posture certification is therefore not yet available.
Moreover, CSA2 does not make this certification mandatory. Organisations that prefer to continue demonstrating their NIS2 compliance by other means, in particular contractual audits or existing sector certifications, will be able to do so. Cyber posture certification is an additional tool, not a replacement.
Another point of attention: the certification schemes will be developed by ENISA through a technical process that can take several years. The EUCS cloud scheme needed more than three years to reach its first formal version. The timeline between the adoption of CSA2 and the availability of the first cyber posture certificates will be measured in years, not months.
What organisations can do now
Cyber posture certification does not change the NIS2 obligations in force. Article 21 applies. The 24-hour incident notification applies. What CSA2 foreshadows is a future change in how compliance evidence can be produced.
For security managers, two actions are useful today.
The first is to document NIS2 compliance in a structured and auditable way. If a cyber posture certification scheme becomes available in two or three years, organisations that have documented their measures against a clear framework will have less ground to cover to get certified. The investment is not lost: it meets current requirements and prepares for future ones.
The second is to follow ENISA's work on certification schemes. ENISA regularly publishes working documents and public consultations. Responding to these consultations makes it possible to influence the scope of future schemes and to anticipate their requirements before they are written into the texts.
The same logic applies to overall regulatory convergence: the article on mapping the requirements of NIS2, DORA and the EU AI Act illustrates why anticipating overlaps costs less than complying in a hurry.
What this reveals about Europe's direction
CSA2 fits into a clear trend: the European Union is gradually building a single market for cyber certification. NIS2 set the security obligations. DORA set those of the financial sector. The Cyber Resilience Act addresses digital products. CSA2 aims to create the common evidence infrastructure for all of these regulations.
The aim is not to lower security requirements: they remain unchanged. It is to unify the way organisations demonstrate that they meet them, in order to reduce cross-border compliance costs and improve the readability of the European market for investors and buyers.
This is a slow structural transformation, which will produce its effects over a decade. Organisations that begin aligning their documentation with future certification schemes will be in an advantageous position when those schemes become available.