Europe’s national domain registry association, CENTR, has welcomed the European Commission’s proposed Cybersecurity Act 2 (CSA2) but cautioned that parts of the legislation could place disproportionate obligations on operators of critical internet infrastructure, including country-code top-level domain (ccTLD) registries.

Regulatory overlap: The proposal, unveiled in January 2026, would strengthen EU cybersecurity governance and introduce a new “trusted ICT supply chain framework” for entities covered by the NIS 2 Directive. While CENTR supports the renewal of ENISA’s mandate and efforts to improve cyber resilience, it argues that new requirements must not duplicate existing obligations already imposed on essential infrastructure operators.

Supplier risks: A central concern is the framework’s approach to identifying “high-risk” suppliers. CENTR argues that supplier restrictions should be based on clear, evidence-based security risks rather than broad or subjective non-technical criteria. The organisation is also calling for thorough impact assessments, meaningful consultation with affected entities, and the right for organisations to challenge decisions that could disrupt their operations.

The group further urges policymakers to provide adequate transition periods when suppliers are excluded and to consider financial compensation where replacement costs are significant or alternatives are unavailable. It also wants the definition of the ICT supply chain narrowed to direct contractual relationships, warning that broad references to internet protocols such as the Domain Name System (DNS) could unintentionally expand regulatory obligations across the wider internet ecosystem.

Governance autonomy: Finally, CENTR welcomed ENISA’s expanded support role for high-criticality sectors but stressed that ccTLD registries must retain autonomy over their governance policies. Preserving that flexibility, it argued, is essential both for serving local internet communities and for maintaining Europe’s digital infrastructure resilience.