EU's New Space Threat Response Architecture 2026: What Changes for Operators and Defense

Key data

Space infrastructure operators in Europe face a change in regulatory framework with immediate effect. The Council Decision (CFSP) 2026/2195, adopted on 28 September 2026, establishes the new EU Space Threat Response Architecture (STRA) and repeals Council Decision (CFSP) 2021/698, which until now regulated the protection of the Union's space systems.

The change is significant: the previous regulation had been in force since 2021 and the new text substantially updates the European space security approach, with particular emphasis on coordination between Member States in the event of incidents affecting satellites and critical communication, navigation and observation systems.

What does this regulation establish?

Council Decision (CFSP) 2026/2195 articulates the EU's response to threats directed at its space infrastructures. Its content is structured around three main pillars:

• New STRA architecture: The EU Space Threat Response Architecture is formally created, replacing the previous 2021 framework with updated mechanisms for detecting, assessing and responding to space incidents.
• Strengthened coordination between Member States: The regulation establishes coordination procedures between EU countries to act jointly when threats to critical space infrastructures are detected.
• Expanded scope of application: It expressly covers satellites, communication systems, navigation and Earth observation, recognizing the cascading impact that a space incident can have on essential services on the ground.

The regulation is framed within the Common Foreign and Security Policy (CFSP), which means that its implementation involves both civil bodies and defense structures of the Member States.

Comparison: what changes from the 2021 regulations

Economic and operational impact

The impact of this decision is primarily operational and compliance-related for organizations in the space and defense sectors. No direct fees or economic sanctions are established in the text of the decision, but the practical implications are significant:

• Review of internal protocols: Space infrastructure operators will need to review and update their incident response plans to align with the new STRA architecture.
• Coordination with national authorities: The regulation strengthens the role of national security bodies as key interlocutors, which may involve new reporting and communication obligations.
• Impact on defense and space contracts: Defense industry and satellite technology companies working with the EU or national governments will need to incorporate STRA requirements into their contractual and compliance frameworks.
• Risk of service disruption: The regulation recognizes the potential impact of space threats on telecommunications, navigation and Earth observation, requiring companies dependent on these services to assess their risk exposure.

Who does it affect?

• Space operators: Companies and bodies that manage satellites or space infrastructures within the EU.
• Defense industry: Sector companies that develop or supply space technology with application in security and defense.
• Satellite technology sector: Providers of telecommunications, navigation (GNSS) and Earth observation services based on satellites.
• Security bodies: National and European agencies responsible for critical infrastructure security.
• EU Member States: Directly involved in the coordination and response mechanisms established by the STRA.
• Companies dependent on space services: Any organization whose operations depend on navigation services, satellite communications or Earth observation may be indirectly affected in the event of a space incident.

Practical example

A Spanish telecommunications company operating connectivity services based on geostationary satellites must, as of 28 September 2026, review its business continuity plan in light of the new STRA architecture.

Specifically, it will need to identify what coordination mechanisms the STRA establishes with the competent Spanish authorities in space security, update its incident response protocols for events affecting the satellites on which its service depends, and verify that its contracts with space infrastructure providers contemplate the new obligations arising from Council Decision (CFSP) 2026/2195. If the company also works on defense projects or with public bodies, it will need to incorporate STRA requirements into its procurement and contractual compliance frameworks.

What should companies do now?

1. Identify whether the organization is a critical space infrastructure operator according to the STRA definition: satellites, telecommunications, navigation or Earth observation systems.
2. Review and update incident response plans to align them with the new coordination mechanisms established by Council Decision (CFSP) 2026/2195.
3. Contact the competent national security body to learn how the STRA will be implemented in Spain and what reporting or coordination obligations arise for the company.
4. Review contracts with suppliers and clients in the space and defense sectors to incorporate the requirements of the new STRA architecture where necessary.
5. Assess risk exposure to potential interruptions of telecommunications, navigation or satellite data services, especially if the company's operations depend on these services in a critical manner.
6. Consult the complete regulation in the EU Official Journal to identify specific obligations applicable to each type of operator.

Official source

Consult complete regulation in official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202602195