EU Cyber Solidarity Act
A regulation in force since 2025 that creates a European alert system, an emergency mechanism and a reserve of private providers deployable after a major incident, the first form of European public pooling of cyber risk.
Regulation (EU) 2025/38 on cyber solidarity, in force since February 2025, organizes a common European response to large-scale cyber incidents. It creates three instruments. A European alert system, a network of national and cross-border monitoring centers tasked with detecting and quickly sharing threat information. An emergency mechanism, which funds preparedness testing of critical entities and mutual assistance between member states. And a European cybersecurity reserve, made up of trusted private providers selected in advance, which member states, Union institutions and certain associated countries can call on to respond to a significant or large-scale incident. The regulation also provides a review mechanism for major incidents to draw lessons. For insurance, the text does not create a financial backstop comparable to public catastrophe schemes, but it lays a first operational stone: a pooled response capacity at European level, available precisely in the accumulation scenarios, state attack on shared infrastructure, where the private market excludes or caps its cover.
Textbook case: ransomware simultaneously paralyzes hospitals in several regions of a member state. The state calls on the European reserve: preselected private response teams are deployed within days at the European mechanism's expense, alongside the providers that the institutions' cyber policies, where they exist, pay for.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.