EU tech sovereignty package extends cyber and supply chain resilience rules to critical infrastructure entities under NIS2-adjacent framework

The European Commission published a package of legislative and policy measures on 3 June 2026 under the banner of a tech sovereignty initiative, with detailed analysis of the package's scope emerging this week. The package addresses two broad categories: laws promoting cyber resilience to protect against malicious actors disrupting services and critical infrastructure, and laws aimed at building supply chain resilience by reducing dependencies on external actors and developing European industrial capacity in key technology sectors. The resilience obligations under the package apply to entities in sectors already covered by NIS2 (the EU's Network and Information Security Directive 2), provided they are also expressly designated by their Member State as critical entities. Those designated entities must implement measures ensuring resilience against a broad range of incident types, including cyber attacks, natural hazards such as extreme weather, physical threats such as vandalism or insider threats, and technical and operational failures. This goes beyond the purely cyber-focused obligations of NIS2 itself. A related legislative component is the Cloud and AI Development Act, one of the specific instruments within the broader package. The package reflects the Commission's drive to reduce European exposure to concentrated dependencies in cloud computing and semiconductor supply chains, with direct implications for technology procurement, data hosting arrangements, and supply chain due diligence obligations across the EU's critical sectors. UK-based operators with EU market exposure will need to assess whether their designated-entity status triggers compliance obligations under the new framework.