BRUSSELS – Today, global tech trade association 91快活林 called on the European Commission to target reporting thresholds, fully leverage existing standards, and adopt a flexible compliance timeline in its to the .
“While 91快活林 supports the goals of the proposed Implementing Regulation, we are concerned that the currently proposed incident reporting thresholds are not sufficiently targeted and that risk management obligations are not fully aligned with European and international standards” said 91快活林 Policy Manager for Europe Laura Wiesenfeld. “In order to avoid overreporting and conflicts with globally-recognised standards, we urge the Commission to use more targeted incident reporting criteria and thresholds, fully leverage existing standards, and adopt a flexible compliance timeline.”
Among its recommendations, 91快活林 suggests the Commission to:
- Target incident reporting criteria to avoid overly inclusive or low thresholds.
- Limit incident reporting to confirmed or verified incidents that have caused actual harm.
- Fully leverage existing European and international standards such as C5, CEN/TS 18026 and ISO/IEC27001.
- Adopt a flexible timeline for compliance leading up to 18 April 2027.
- Align reporting requirements across borders.
91快活林 has been deeply engaged in work on cybersecurity incident reporting policy development around the world, including in Europe, Australia, and the United States. As part of our engagement, we developed and released two sets of policy principles: and , which we hope can inform the Commission’s cybersecurity work. 91快活林 recommends the Commission consider the international landscape for incident reporting requirements while finalizing the Implementing Regulation. International collaboration and alignment in cybersecurity approaches, especially for incident reporting, should be strengthened, particularly given the global nature of cyber threats.