Towards EU cybersecurity law: Regulating a new policy field

EU cybersecurity forms a prime example of an area in which both internal and external (global as well as bilateral) policies are connected and in which the different legal competences of the Union need to be combined. Over the past decade the European Union started to take its first careful steps in formulating and regulating this new policy area, starting mainly from an ‘outside-in’ perspective in which global security threats triggered internal policies. With the adoption of the 2013 Strategy it aims to bring the different earlier initiatives together in a comprehensive fashion while pointing to new legislative plans, which also reflect a wish to act as a global player and a participant in the formulation of new global rules. European cybersecurity policy is formulated and implemented in a multi-level and multi-stakeholder structure, in which legislation is connected to both international developments and domestic implementation in the EU Member States and where both public and private actors play a role. In an exploratory fashion, this chapter assesses both the existing and emerging internal rules related to cybersecurity as well as the EU’s contribution to the development of a global regulatory framework.