Industrial Policy & Trade Monitor· 2663 actions· ✨ 89 recent

On 3 June 2026 the European Commission adopted a legislative proposal for the Cloud and AI Development Act (CADA) — COM(2026) 502 — as part of the European Technological Sovereignty Package. The CADA proposes to triple EU data-centre capacity over five to seven years, introduces a single EU-wide sovereignty assessment framework for cloud and AI services, and establishes common EU-level procurement mechanisms for public administrations prioritising EU-based cloud and AI infrastructure. As a Commission proposal the CADA now enters co-decision (European Parliament + Council) and is not yet law; it is structurally distinct from the co-adopted Chips Act 2.0, addressing cloud infrastructure and AI compute capacity rather than semiconductor supply chains.

The European Investment Bank signed guarantee agreements with Banco Santander totalling EUR 450 million on 29 January 2026, announced by EIB Group President Nadia Calviño during the Group's results presentation in Brussels. The guarantees are expected to unlock around EUR 900 million in new supply-chain financing for European companies: EUR 400 million for security-and-defence manufacturers (cybersecurity, surveillance, resilience and defence-technology suppliers) under the EIB's EUR 3 billion pan-European intermediated financing instrument for the defence industrial base, and EUR 500 million for companies in clean technologies, telecommunications and digital infrastructure via reverse-factoring supply-chain-finance instruments. Santander is reported as the fourth major European bank to sign under the defence-supply-chain programme, and the clean-tech/digital tranche contributes to the EIB Group's TechEU initiative.

On 11 December 2025 the Council of the EU presidency, the European Parliament, and the European Commission reached provisional political (trilogue) agreement on the revision of Regulation (EU) 2019/452 establishing a framework for the screening of foreign direct investments into the Union, concluding interinstitutional negotiations on the Commission's proposal of 24 January 2024. The revised regime upgrades the 2019 cooperation-mechanism-only framework into a hybrid harmonised/mandatory regime: all 27 Member States must establish FDI screening mechanisms (replacing the current patchwork in which some Member States have no mechanism at all); mandatory minimum sectoral scope is set EU-wide and covers dual-use items, military equipment, hyper-critical technologies (general-purpose AI with space/defence relevance, quantum technologies, semiconductors), critical raw materials, critical entities in energy/transport/digital infrastructure, electoral infrastructure, and certain financial-system entities; foreign investments routed through EU subsidiaries fall within the perimeter; a shared database prevents Member-State arbitrage; and an optional single electronic-filing portal becomes available if requested by at least nine Member States. Screening decisions remain the exclusive responsibility of the Member State in which the investment is made. Once the Regulation enters into force (after Council and Parliament formal adoption and OJ publication, both pending as of the political-agreement date), the new rules will apply after an 18-month transition period — implementation expected toward the end of 2027.

ECOFIN on 12 December 2025 adopted a Council Implementing Decision approving the 4th amendment to Poland's National Recovery and Resilience Plan (Krajowy Plan Odbudowy, KPO), following Commission proposal C(2025) 7998 final of 19 November 2025. The amendment modifies 80 measures within the plan while keeping Poland's total financial contribution under the EU Recovery and Resilience Facility (RRF) unchanged at EUR 25,276,853,716 in grants, alongside an estimated EUR 20.6 bn REPowerEU chapter envelope. Adopted in parallel with amendments for Austria, Cyprus, Czechia, France, Greece, Latvia, Malta, Portugal and Slovenia, this amendment continues the structural pivot — first opened by the May 2025 third amendment — that allows Poland to redirect post-COVID recovery funds toward defence-industrial and dual-use spending given the NATO eastern-flank context.

On 24 September 2024 the European Commission issued its first-ever final decision under the Foreign Subsidies Regulation (Regulation (EU) 2022/2560), conditionally approving (Case FS.100011) the acquisition of PPF Telecom Group B.V. by Emirates Telecommunications Group Company PJSC (e&, majority-owned by the Emirates Investment Authority, Abu Dhabi). The Commission found that e& received prohibited foreign subsidies — principally an unlimited state guarantee via the EIA and preferential financing instruments — that risked post-transaction competitive distortion within the EU's five-country PPF footprint (Czechia, Bulgaria, Hungary, Serbia, Slovakia; 10+ million subscribers). Conditions imposed require e& to remove the unlimited state guarantee, prohibit financing PPF's EU operations from EIA or e& group treasury, and mandate notification of future EU acquisitions above the FSR thresholds. The non-confidential version of the decision was published 4 April 2025.

Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities, published OJ L 333, 27 December 2022, entered into force 16 January 2023, with Member State transposition deadline 17 October 2024 (rules applicable from 18 October 2024). The CER Directive repeals Council Directive 2008/114/EC on European Critical Infrastructures, extending the scope from two sectors (energy, transport) to eleven essential-service sectors: energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, public administration, space, and food. Member States must adopt national resilience strategies, conduct risk assessments at least every four years, identify "critical entities" providing essential services whose disruption would have significant cross-border impacts, and ensure those entities implement technical, security, and organisational resilience measures, business-continuity plans, incident-reporting obligations, and personnel-security background checks. The CER Directive is the physical and hybrid resilience twin to the NIS2 Directive (2022/2555) — the two instruments form the binding EU critical-infrastructure-protection architecture replacing the 2008/114/EC regime.

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), published OJ L 333, 27 December 2022, entered into force 16 January 2023. NIS2 repeals and substantially expands the 2016 NIS1 Directive (2016/1148), extending the scope from ~7 sectors to 18 enumerated essential and important sectors, imposing binding cybersecurity risk- management and incident-reporting obligations on covered entities, introducing board-level management accountability, and mandating Member State transposition by 17 October 2024. NIS2 is the structural EU statutory anchor for national cybersecurity frameworks across the bloc, operating alongside DORA (Reg 2022/2554) for financial-sector digital resilience and CRA (Reg 2024/2847) for product cybersecurity.