BRUSSELS, 22nd September, 2026 (WAM) – The European Court of Auditors (ECA) has identified shortcomings in the European Union's framework for detecting and responding to significant and large-scale cybersecurity incidents, noting that the European Cybersecurity Alert System is not yet operational despite €1.4 billion being allocated to cybersecurity under the Digital Europe Programme for 2021-2027.
The auditors said the two cross-border hubs examined, ATHENA and ENSOC, had not started operations because of procurement delays, while cooperation agreements, a common classification system and technical standards needed for the alert system were still lacking.
The audit also highlighted limited information-sharing and coordination as key weaknesses in the EU's response mechanisms, including shortcomings in cooperation between the CSIRTs Network, which brings together national computer security incident response teams, and the European Cyber Crisis Liaison Organisation Network (EU-CyCLONe).
It also identified weaknesses in security checks on some recipients of EU cybersecurity funding, noting that the European Cybersecurity Competence Centre does not verify beneficiaries' assessments of the ownership and control of third parties receiving financial support.
The auditors further pointed to overlaps between some EU bodies responsible for monitoring cybersecurity threats, particularly the European Commission's Cyber Situation Centre and the European Union Agency for Cybersecurity (ENISA).
The ECA recommended improving information-sharing, strengthening coordination among the relevant bodies, making the European Cybersecurity Alert System operational and reinforcing security checks on recipients of EU funding.