Security1 publisher2 min readPublished
Von der Leyen wants a cyberattack in one EU state to convene all 27 governments
The proposed Emergency Security Protocol copies NATO's Article 4, so a single government could put a cyber incident in front of the other 26. What those 26 could then agree runs into the EU's unanimity rules.
The Watch · Security desk
What happened
- Ursula von der Leyen proposed on Wednesday an emergency mechanism letting any EU country summon the bloc's governments over security threats including sabotage, cyberattacks and drone incursions.
- A single member state could trigger it, after which all 27 governments would convene to coordinate a European response, deter further escalation and limit the consequences of the incident.
- The bloc already has a mutual-assistance provision in Article 42(7), which France invoked after the November 2015 Paris attacks, and a separate solidarity clause in Article 222.
- The Commission will also set out plans for a European Security Council that brings EU leaders together with partners including Britain, Canada, Norway and Ukraine.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure An intrusion at one multinational could become the item that puts 27 governments in a room, and the convening state would set the framing and the timing of that escalation.
- constraint The trigger produces a consultation and nothing more, so the gap between a member state calling the protocol and any joint measure that still needs every capital to agree stays where it is.
- decision Member governments have to choose between writing pre-agreed responses into the security strategy and keeping a consultation forum that leaves each national veto intact.
- precedent A third convening route alongside Articles 42(7) and 222, with a lower threshold than either, makes it normal for a cyber incident in one country to be handled as bloc business.
Article 4 produces a meeting. NATO members invoke it to consult when a member's territorial integrity, political independence or security is threatened, and it sits apart from Article 5, the collective-defence clause [7]. The Commission and the EU's foreign policy chief, Kaja Kallas, are to propose the new protocol as part of a European security strategy [5].
Von der Leyen did not say what happens once the 27 are in the room, whether the protocol would fix responses in advance, or whether it would touch the EU's decision-making rules [9][11]. Those rules bind anything past a communique. Many common foreign and security policy decisions require unanimity, and sanctions are adopted unanimously, so one government can block measures the other 26 support [10]. Any state that can call the meeting can also veto what comes out of it [19].
EU ambassadors ran into that this week. They failed to approve the routine six-month renewal of sanctions on Russia after France and Slovakia pressed for the Russian-Uzbek billionaire Alisher Usmanov to be removed from the list, and governments extended the existing measures for seven days while negotiations continued [12], seven days in place of a renewal meant to last six months [18].
Von der Leyen aimed her criticism at the institutions. "Our systems were made for a different world," she said. "They are driven by well-intentioned attempts at consensus and compromise. But we need to consider whether they are still fit for purpose." [4] She pointed to recent incidents in Denmark, Lithuania and Poland and an attempted drone attack in Leipzig, and said threats were "mounting on our soil" [2].
She said Europe urgently needed agreement on how to respond to hostile acts that fall below the threshold of armed aggression but still threaten national security, and called the line between conventional and hybrid threats increasingly blurred [13]. The threats facing Europe, she said, were becoming "less and less hybrid and less and less threats" [14].
The trigger belongs to governments, so for a company running networks in several member states the change would sit one step downstream of its own incident response: a national ministry that reads an intrusion at one operator as part of a hybrid campaign would be able to put that incident in front of 26 other governments [20]. The wider package also includes a European Instrument for Strategic Enablers covering air and missile defence, strategic transport, air-to-air refuelling, space systems and cyber capabilities, aligned with NATO [16]. Details are due in the Commission's European security strategy, previously scheduled for the third quarter of 2026 [17].
What to watch
- Whether the Commission's security strategy defines a triggering threshold for a cyber incident, or leaves the judgement entirely to the convening state.
- Whether the Russia sanctions renewal clears once the seven-day extension lapses, and whether Usmanov's listing survives it.
- Whether the strategy text sets responses in advance or preserves unanimity for anything beyond consultation.