EU Sanctions for Cyberattacks 2026: What Changes and How It Affects Critical Sector Companies

Key data

Companies operating in critical infrastructure sectors in Europe have a new reason to review their cybersecurity and regulatory compliance systems. The Decision (CFSP) 2026/1713, published and in force since 13 July 2026, updates the European sanctioning framework against cyberattacks of significant relevance, expanding the EU's capacity to act in a coordinated manner against those responsible.

This regulation amends the Decision (CFSP) 2019/797, the original framework established seven years ago. The update is not minor: it adapts the list of sanctionable subjects and the designation criteria, meaning that more actors—and potentially more entities linked to them—can fall under the radar of European authorities.

What does this regulation establish?

Decision (CFSP) 2026/1713 amends the EU's sanctioning regime on cyberattacks, originally created in 2019. The key elements it introduces or updates are as follows:

In practical terms, the regulation allows Member States—in a coordinated manner—to block assets of designated persons or entities and deny them physical access to EU territory. This applies to both external actors and any legal person that may be linked to cyberattack operations against European infrastructure.

Economic and operational impact

The direct impact of this regulation does not fall on companies that are "victims" of cyberattacks, but on those designated as responsible or complicit. However, the indirect effect on the broader European business ecosystem is significant:

• Reputational and compliance risk: Any company that maintains business relationships with entities later designated as sanctioned may be exposed to legal and reputational consequences.
• Growing regulatory pressure on critical sectors: The tightening of the sanctioning framework is accompanied by greater surveillance of critical infrastructure operators, who must demonstrate robustness in their cybersecurity systems.
• Asset freezing as a real tool: Asset freezing is a measure with immediate effect that can paralyze operations of any designated entity, including subsidiaries or business partners.
• Coordination among the 27 Member States: The regulation requires coordinated application, reducing the possibility of regulatory arbitrage between EU countries.

For companies operating in critical sectors—energy, telecommunications, transport, finance, healthcare—the message is clear: the cybersecurity regulatory environment is tightening and regulatory tolerance is decreasing.

Who does it affect?

• Critical infrastructure operators: Energy, water, transport, telecommunications, healthcare and financial services are the sectors with the highest regulatory exposure.
• Companies with suppliers or partners in third countries: Relationships with entities that may be designated as sanctioned generate compliance risk.
• Financial entities: Must verify that they do not manage assets of persons or entities included in updated sanctions lists.
• Compliance and legal departments: Required to update due diligence processes and international sanctions compliance programs.
• EU Member States: Must transpose and apply the measures in their national jurisdictions in a coordinated manner with other European partners.
• Cybersecurity and technology companies: The tightening of the regulatory framework generates both obligations and business opportunities in consulting and protection solutions.

Practical example

Imagine a Spanish energy sector company that works with an industrial management software provider based outside the EU. Following the entry into force of Decision (CFSP) 2026/1713, European authorities designate that provider as an entity involved in a cyberattack of significant relevance against infrastructure of a Member State.

At that moment, the Spanish company faces a concrete situation:

1. The provider's assets are frozen immediately throughout the EU, which may interrupt technical support and software updates.
2. The provider cannot physically access European territory to provide on-site services.
3. The Spanish company must urgently review whether maintaining the contractual relationship exposes it to compliance risks under the sanctions regime.
4. The legal department must verify that no payments are being made to a sanctioned entity, which could constitute a violation of the sanctions regime.

This scenario, which previously might have seemed remote, is exactly the type of situation that Decision (CFSP) 2026/1713 is designed to manage and that companies in critical sectors must have contemplated in their contingency plans.

What should companies do now?

1. Review the supply chain and partners: Identify whether any entity with which business relationships are maintained could be in the spotlight of the updated sanctions regime. Particularly relevant for companies with suppliers outside the EU.
2. Update sanctions compliance programs: Compliance departments must incorporate the new designation criteria from Decision (CFSP) 2026/1713 into their due diligence processes and counterparty review.
3. Strengthen cybersecurity protocols: The tightening of the sanctioning framework is a clear signal that the EU considers cyberattacks a first-order threat. Companies in critical sectors must align their protection measures with current European standards.
4. Coordinate with the legal department: Verify that contracts with suppliers include termination clauses in case a counterparty is designated as a sanctioned entity.
5. Monitor updated sanctions lists: Establish a process for periodic review of official lists of sanctioned entities published by the EU Council, as they may be updated at any time.
6. Train responsible teams: Ensure that procurement, legal and compliance teams understand the practical implications of operating with potentially sanctioned entities.

Official source

Consult complete regulation on official source — EUR-Lex CELEX:32026D1713

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=CELEX:32026D1713