Industrial Policy & Trade Monitor· 2673 actions· ✨ 90 recent

On 11 December 2025 the Council of the EU presidency, the European Parliament, and the European Commission reached provisional political (trilogue) agreement on the revision of Regulation (EU) 2019/452 establishing a framework for the screening of foreign direct investments into the Union, concluding interinstitutional negotiations on the Commission's proposal of 24 January 2024. The revised regime upgrades the 2019 cooperation-mechanism-only framework into a hybrid harmonised/mandatory regime: all 27 Member States must establish FDI screening mechanisms (replacing the current patchwork in which some Member States have no mechanism at all); mandatory minimum sectoral scope is set EU-wide and covers dual-use items, military equipment, hyper-critical technologies (general-purpose AI with space/defence relevance, quantum technologies, semiconductors), critical raw materials, critical entities in energy/transport/digital infrastructure, electoral infrastructure, and certain financial-system entities; foreign investments routed through EU subsidiaries fall within the perimeter; a shared database prevents Member-State arbitrage; and an optional single electronic-filing portal becomes available if requested by at least nine Member States. Screening decisions remain the exclusive responsibility of the Member State in which the investment is made. Once the Regulation enters into force (after Council and Parliament formal adoption and OJ publication, both pending as of the political-agreement date), the new rules will apply after an 18-month transition period — implementation expected toward the end of 2027.

ECOFIN on 12 December 2025 adopted a Council Implementing Decision approving the 4th amendment to Poland's National Recovery and Resilience Plan (Krajowy Plan Odbudowy, KPO), following Commission proposal C(2025) 7998 final of 19 November 2025. The amendment modifies 80 measures within the plan while keeping Poland's total financial contribution under the EU Recovery and Resilience Facility (RRF) unchanged at EUR 25,276,853,716 in grants, alongside an estimated EUR 20.6 bn REPowerEU chapter envelope. Adopted in parallel with amendments for Austria, Cyprus, Czechia, France, Greece, Latvia, Malta, Portugal and Slovenia, this amendment continues the structural pivot — first opened by the May 2025 third amendment — that allows Poland to redirect post-COVID recovery funds toward defence-industrial and dual-use spending given the NATO eastern-flank context.

Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities, published OJ L 333, 27 December 2022, entered into force 16 January 2023, with Member State transposition deadline 17 October 2024 (rules applicable from 18 October 2024). The CER Directive repeals Council Directive 2008/114/EC on European Critical Infrastructures, extending the scope from two sectors (energy, transport) to eleven essential-service sectors: energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, public administration, space, and food. Member States must adopt national resilience strategies, conduct risk assessments at least every four years, identify "critical entities" providing essential services whose disruption would have significant cross-border impacts, and ensure those entities implement technical, security, and organisational resilience measures, business-continuity plans, incident-reporting obligations, and personnel-security background checks. The CER Directive is the physical and hybrid resilience twin to the NIS2 Directive (2022/2555) — the two instruments form the binding EU critical-infrastructure-protection architecture replacing the 2008/114/EC regime.

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), published OJ L 333, 27 December 2022, entered into force 16 January 2023. NIS2 repeals and substantially expands the 2016 NIS1 Directive (2016/1148), extending the scope from ~7 sectors to 18 enumerated essential and important sectors, imposing binding cybersecurity risk- management and incident-reporting obligations on covered entities, introducing board-level management accountability, and mandating Member State transposition by 17 October 2024. NIS2 is the structural EU statutory anchor for national cybersecurity frameworks across the bloc, operating alongside DORA (Reg 2022/2554) for financial-sector digital resilience and CRA (Reg 2024/2847) for product cybersecurity.