Council Implementing Decision (EU) 2026/1354 of 15 June 2026 authorising the provision of support from the EU Cybersecurity Reserve to Ukraine

Official Journal EN of the European Union L series 2026/1354 16.6.2026 COUNCIL IMPLEMENTING DECISION (EU) 2026/1354 of 15 June 2026 authorising the provision of support from the EU Cybersecurity Reserve to Ukraine THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EU) 2025/38 of the European Parliament and of the Council of 19 December 2024 laying down measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cyber threats and incidents and amending Regulation (EU) 2021/694 (Cyber Solidarity Act)(1), and in particular Article 19(4) thereof, Having regard to the proposal from the European Commission, Whereas: (1) On 23 June 2022, the European Council granted Ukraine the status of candidate country. That decision was based on the fulfilment by Ukraine of the conditions specified in the Commission’s opinion of June 2022 on Ukraine’s membership application. On 14 December 2023, the European Council decided to open accession negotiations with Ukraine following the recommendation issued by the Commission. (2) In its conclusions of 19 December 2024, the European Council reaffirmed its unwavering support for Ukraine’s sovereignty and territorial integrity, emphasising the provision of political, financial, economic, humanitarian, military and diplomatic support for as long as necessary. Those conclusions underscored the Union’s commitment to maintaining European security, thereby demonstrating that support for Ukraine is integral to the Union’s security objectives. (3) Cybersecurity incidents continue to cause economic and societal impact both across the Union and at global level. Cyber threats are evolving particularly rapidly in certain candidate countries, where possible significant cybersecurity incidents or large-scale cybersecurity incidents have the potential to disrupt and damage critical infrastructure, interfere with the proper functioning of the economy and institutions or pose serious public security and safety risks for entities and citizens. In that context, cyberattacks could also cause further geopolitical tension and threaten critical infrastructure, democratic processes and election infrastructure. (4) Russia’s war of aggression against Ukraine has had a detrimental and disruptive impact on Ukrainian network and information systems of essential services, such as the Ukrainian railway or state registries. Constant Russian cyberattacks on Ukraine’s critical infrastructure have accompanied the military aggression, including the targeting of the satellite KA-SAT network, owned by Viasat, on the eve of the full-scale invasion in February 2022. (5) Taking into account the unpredictable nature of cyberattacks, the fact that they are often not confined to a specific geographical area and that they pose a high risk of spill-over, the strengthening of the resilience of neighbouring countries and of their capacity to respond effectively to significant cybersecurity incidents and large-scale cybersecurity incidents contributes to the protection of the Union as a whole, in particular the internal market and industry. Therefore, Regulation (EU) 2025/38 provides that third countries that are party to an association agreement with the Union allowing for their participation in the Digital Europe Programme (the ‘DEP’) (‘DEP-associated third countries’) can be supported by the EU Cybersecurity Reserve (the ‘Reserve’), in all or part of their territories, where this is provided for in the agreement associating the third country to the DEP. (1) OJ L, 2025/38, 15.1.2025, ELI: http://data.europa.eu/eli/reg/2025/38/oj. ELI: http://data.europa.eu/eli/dec_impl/2026/1354/oj 1/3EN OJ L, 16.6.2026 (6) In accordance with Article 19 of Regulation (EU) 2025/38, a DEP-associated third country is able to request support from the Reserve where the agreement through which it is associated to the DEP provides for participation in the Reserve. In addition, such third country is to be eligible for support from the Reserve only where the three criteria set out in Article 19(3), first subparagraph, of Regulation (EU) 2025/38 are fulfilled. Firstly, the third country is to comply with the terms of the agreement through which it is associated to the DEP, insofar as those terms relate to participation in the Reserve. Secondly, given the complementary nature of the Reserve, the third country is to have taken adequate steps to prepare for significant cybersecurity incidents or large-scale-equivalent cybersecurity incidents. Thirdly, the provision of support from the Reserve is to be consistent with the Union’s policy towards and overall relations with that country and with other Union policies in the field of security. (7) Ukraine is a party to an association agreement with the Union on the participation in the DEP. In accordance with that agreement, Ukraine is allowed to participate in the DEP for the purpose of accessing the Reserve. That agreement includes provisions requiring Ukraine to comply with the obligations set out in Article 19(2) and (9) of Regulation (EU) 2025/38. (8) The provision of support to DEP-associated third countries can affect relations with third countries and the Union’s security policy, including in the context of the common foreign and security policy and the common security and defence policy. The Council acts on the basis of a Commission proposal, taking due account of the Commission’s assessment of the three criteria set out in Article 19(3), first subparagraph, of Regulation (EU) 2025/38. (9) The Union has set up a range of mechanisms, funding instruments and facilities to support Ukraine’s security, defence and resilience, including the European Peace Facility, established by Council Decision (CFSP) 2021/509(2), which finances military support and which includes the Ukraine Assistance Fund established in 2024. In 2022, the Council adopted Decision (CFSP) 2022/1968(3) on a European Union Military Assistance Mission in support of Ukraine in order to train Ukraine’s Armed Forces and strengthen the European Union Advisory Mission for Civilian Security Sector Reform Ukraine, which was established by Council Decision 2014/486/CFSP(4)and which operates since 2014. Together, those initiatives form a coordinated and robust response to strengthen Ukraine’s security, defence and resilience. In June 2024, the Union and Ukraine adopted joint security commitments, whereby both parties affirmed, inter alia, their commitment to strengthen cooperation on resilience with a focus on countering hybrid and cyber threats, foreign information manipulation and interference, as well as protecting critical infrastructure. The EU-Ukraine Cyber Dialogue established in 2021 continues to be a central platform to address political and technical cooperation on cyber issues. (10) The Commission has assessed whether Ukraine meets the three criteria set out in Article 19(3), first subparagraph, of Regulation (EU) 2025/38 and considers that those criteria are fulfilled. The Commission has also consulted the High Representative of the Union for Foreign Affairs and Security Policy when conducting that assessment. (11) In accordance with Article 19(6) of Regulation (EU) 2025/38, the Council’s assessment is that Ukraine complies with the relevant terms of the agreement associating that country to the DEP and has taken adequate steps to prepare for significant cybersecurity incidents and large-scale-equivalent cybersecurity incidents. Furthermore, the Council’s assessment is that the provision of support from the Reserve is consistent with the Union’s policy towards and overall relations with Ukraine, and is consistent with other Union policies in the field of security, in particular in light of the factors set out in recital 9. (12) The provision of support from the Reserve to Ukraine should therefore be authorised. (13) In order to enable the provision of immediate support in accordance with the criteria set out in Regulation (EU) 2025/38, this Decision should enter into force as a matter of urgency on the date of its publication in the Official Journal of the European Union. In order to allow for adequate and timely support, it should apply for 1 year, (2) Council Decision (CFSP) 2021/509 of 22 March 2021 establishing a European Peace Facility, and repealing Decision (CFSP) 2015/528 (OJ L 102, 24.3.2021, p. 14, ELI: http://data.europa.eu/eli/dec/2021/509/oj). (3) Council Decision (CFSP) 2022/1968 of 17 October 2022 on a European Union Military Assistance Mission in support of Ukraine (EUMAM Ukraine) (OJ L 270, 18.10.2022, p. 85, ELI: http://data.europa.eu/eli/dec/2022/1968/oj). (4) Council Decision 2014/486/CFSP of 22 July 2014 on the European Union Advisory Mission for Civilian Security Sector Reform Ukraine (EUAM Ukraine) (OJ L 217, 23.7.2014, p. 42, ELI: http://data.europa.eu/eli/dec/2014/486/oj). 2/3 ELI: http://data.europa.eu/eli/dec_impl/2026/1354/ojEN OJ L, 16.6.2026 HAS ADOPTED THIS DECISION: Article 1 The provision of support from the EU Cybersecurity Reserve to Ukraine within the meaning of Article 19 of Regulation (EU) 2025/38 is hereby authorised. Article 2 This Decision shall enter into force on the date of its publication in the Official Journal of the European Union. It shall apply until 17 June 2027. Done at Luxembourg, 15 June 2026. For the Council The President K. KALLAS ELI: http://data.europa.eu/eli/dec_impl/2026/1354/oj 3/3