An analysis published on Lexology examines whether the European Union's Cybersecurity Act 2.0 sits comfortably within the rules of the World Trade Organization. The short answer offered by the piece: the question is live, and the assessment is not a rubber stamp.

The EU adopted the original Cybersecurity Act in 2019, establishing the EU cybersecurity certification framework and reinforcing the mandate of ENISA, the Union Agency for Cybersecurity. The "2.0" revision under discussion takes that framework further. The Lexology assessment asks whether the strengthened regime can be squared with WTO disciplines, in particular those governing technical barriers to trade.

What is at issue?

Cybersecurity certification schemes, by their nature, set requirements that products must meet before they can be marketed or used in public procurement. Where those requirements apply to imported goods, WTO law takes an interest. The Agreement on Technical Barriers to Trade disciplines how members design and apply technical regulations, standards and conformity-assessment procedures.

The compatibility assessment therefore turns on familiar trade-law terrain:

• whether the certification framework treats domestic and foreign products alike;
• whether the scheme is more trade-restrictive than necessary to achieve a legitimate objective;
• how conformity assessment is organised, and whether foreign suppliers gain access to it.

None of these questions is exotic. All of them have been litigated before in other contexts.

Why does this matter now?

Cybersecurity has moved from a technical appendix to a core regulatory concern for the EU legislator. Each extension of certification requirements widens the surface where trade obligations and security objectives meet. A scheme drafted for security purposes can still trip WTO rules if its design or administration discriminates, or if less restrictive alternatives were available.

The Lexology piece performs the kind of audit that trade lawyers run routinely: measure the instrument against the treaty text, identify the pressure points, and report the residual risk. The exercise is analytical rather than adjudicative. No WTO panel has ruled on the matter.

What should practitioners take from it?

For in-house counsel and trade specialists, the assessment is a prompt to treat cybersecurity certification as a trade issue, not merely a compliance issue. Companies supplying networked products into the EU market should track how certification schemes are structured, which bodies conduct conformity assessment, and whether access terms for non-EU suppliers stay even-handed.

For policymakers and their advisers, the piece is a reminder that security justifications carry weight but do not immunise a measure from scrutiny. The WTO appellate record contains several cases where legitimate objectives failed to save measures judged disproportionate or discriminatory in application.

The takeaway is plain: the EU can regulate cybersecurity aggressively, but it must draft the details with one eye on Geneva.