Council Implementing Decision (EU) 2026/1725 of 10 July 2026 authorising the provision of support from the EU Cybersecurity Reserve to the Republic of Moldova (Text with EEA relevance)

Official Journal EN of the European Union L series 2026/1725 13.7.2026 COUNCIL IMPLEMENTING DECISION (EU) 2026/1725 of 10 July 2026 authorising the provision of support from the EU Cybersecurity Reserve to the Republic of Moldova (Text with EEA relevance) THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EU) 2025/38 of the European Parliament and of the Council of 19 December 2024 laying down measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cyber threats and incidents and amending Regulation (EU) 2021/694 (Cyber Solidarity Act)(1), and in particular Article 19(4) thereof, Having regard to the proposal from the European Commission,

Whereas:

(1) On 23 June 2022, the European Council granted the Republic of Moldova (Moldova) the status of candidate country.

That decision was based on the fulfilment by Moldova of the conditions specified in the Commission’s opinion of June 2022 on Moldova’s membership application. On 14 December 2023, the European Council decided to open accession negotiations with Moldova, following the recommendation issued by the Commission.

(2) In its conclusions of 15 December 2022, the European Council affirmed that the Union will continue to provide all relevant support to Moldova as it deals with the multifaceted impact of Russia’s war of aggression against Ukraine.

(3) Cybersecurity incidents continue to cause economic and societal impacts both across the Union and at global level.

Cyber threats are evolving particularly rapidly in certain candidate countries where possible significant cybersecurity incidents or large-scale cybersecurity incidents have the potential to disrupt and damage critical infrastructure, interfere with the proper functioning of the economy and institutions or pose serious public security and safety risks for entities and citizens. This is particularly the case in Moldova where Russia conducts hybrid campaigns and cyberattacks to threaten critical infrastructure, democratic processes and election infrastructure.

(4) Taking into account the unpredictable nature of cyberattacks, the fact that they are often not confined to a specific geographical area and that they pose a high risk of spill-over, the strengthening of the resilience of neighbouring countries and of their capacity to respond effectively to significant cybersecurity incidents and large-scale cybersecurity incidents contributes to the protection of the Union as a whole, in particular the internal market and industry. Therefore, Regulation (EU) 2025/38 provides that third countries that are party to an association agreement with the Union allowing for their participation in the Digital Europe Programme (the ‘DEP’) (‘DEP-associated third countries’) can be supported from the EU Cybersecurity Reserve (the ‘Reserve’), in all or part of their territories, where this is provided for in the agreement associating the third country to the DEP.

(5) In accordance with Article 19 of Regulation (EU) 2025/38, DEP-associated third countries are able to request support from the Reserve when the entities targeted and for which they request such support are entities operating in sectors of high criticality or other critical sectors and when the incidents detected lead to significant operational disruptions or might have spillover effects in the Union. A third country is only eligible for such support where that is specifically provided for in the agreement associating that country to the DEP. In addition, such third country is to be eligible for support from the Reserve only where the three criteria set out in Article 19(3), first subparagraph, of Regulation (EU) 2025/38 are fulfilled. Firstly, the third country is to comply with the terms of the agreement through which it is associated to the DEP, insofar as those terms relate to participation in the Reserve. Secondly, given the complementary nature of the Reserve, the third country is to have taken adequate steps to prepare for significant cybersecurity incidents or large-scale-equivalent cybersecurity incidents. Thirdly, the provision of support from the Reserve is to be consistent with the Union’s policy towards and overall relations with that country and with other Union policies in the field of security.

(1) OJ L, 2025/38, 15.1.2025, ELI: http://data.europa.eu/eli/reg/2025/38/oj.

ELI: http://data.europa.eu/eli/dec_impl/2026/1725/oj 1/3EN OJ L, 13.7.2026

(6) The provision of support to DEP-associated third countries can affect relations with third countries and the Union’s security policy, including in the context of the common foreign and security policy and the common security and defence policy. The Council acts on the basis of a Commission proposal, taking due account of the Commission’s assessment of the three criteria set out in Article 19(3), first subparagraph, of Regulation (EU) 2025/38.

(7) Moldova has been heavily impacted by Russia’s war of aggression against Ukraine, while being directly targeted by Russia’s hybrid activities seeking to destabilise the country and undermine its path to Union accession. Against this backdrop, the Union has provided comprehensive support to Moldova in addressing the challenges it faces as a consequence of Russia’s war of aggression against Ukraine, and to strengthen the country’s resilience, security and stability in the face of direct destabilising activities by Russia.

(8) On 24 April 2023, the Council adopted Decision (CFSP) 2023/855(2), establishing a civilian European Union Partnership Mission in Moldova under the common security and defence policy in order to provide strategic advice and operational support in the areas of crisis management and hybrid threats. Since 2021, the Union has also

provided consistent support through the European Peace Facility, established by Council Decision

(CFSP) 2021/509(3), to strengthen Moldova’s capacities in the military and defence area. The signing of the EU-Moldova Security and Defence Partnership on 21 May 2024 streamlined the structure of the Union’s cooperation with Moldova in key areas of peace, security, and defence. Furthermore, the Moldova Growth Plan, adopted by the Commission on 10 October 2024, aims to support Moldova’s socioeconomic reforms and enhance its access to the internal market, with specific reforms expected in the area of cybersecurity governance.

(9) As Moldova fulfilled the three criteria set out in Article 19(3), first subparagraph, of Regulation (EU) 2025/38, the provision of support from the Reserve to Moldova was authorised by Council Implementing Decision (EU) 2025/1458(4)from 14 July 2025. Since then, Moldova has been eligible for support from the Reserve in responding to cybersecurity incidents. That Decision expires on 14 July 2026 and can, in accordance with Article 19(4) of Regulation (EU) 2025/38, be renewed.

(10) The Commission has assessed whether Moldova continues to fulfil the three criteria set out in Article 19(3), first subparagraph, of Regulation (EU) 2025/38 and considers those criteria to be fulfilled. It has also consulted the High Representative of the Union for Foreign Affairs and Security Policy when conducting that assessment.

(11) In accordance with Article 19(6) of Regulation (EU) 2025/38, the Council’s assessment is that Moldova complies with the relevant terms of the agreement associating that country to the DEP and has taken adequate steps to prepare for significant cybersecurity incidents and large-scale-equivalent cybersecurity incidents. Furthermore, the Council’s assessment is that the provision of support from the Reserve is consistent with the Union’s policy towards and overall relations with Moldova, and is consistent with other Union policies in the field of security, in particular in light of the factors set out in recital 8.

(12) As the agreement associating Moldova to the DEP provides for participation in the Reserve and as that country fulfils the criteria set out in Article 19(3), first subparagraph, of Regulation (EU) 2025/38, the authorisation of the provision of support from the Reserve to Moldova should be renewed. Therefore, a new Implementing Decision should be adopted.

(13) In order to enable the continuous provision of support in accordance with the criteria set out in Regulation (EU) 2025/38, this Decision should enter into force as a matter of urgency on 15 July 2026. In order to allow for adequate and timely support, it should apply for 1 year,

(2) Council Decision (CFSP) 2023/855 of 24 April 2023 on a European Union Partnership Mission in Moldova (EUPM Moldova) (OJ L 110, 25.4.2023, p. 30, ELI: http://data.europa.eu/eli/dec/2023/855/oj).

(3) Council Decision (CFSP) 2021/509 of 22 March 2021 establishing a European Peace Facility, and repealing Decision (CFSP) 2015/528 (OJ L 102, 24.3.2021, p. 14, ELI: http://data.europa.eu/eli/dec/2021/509/oj).

(4) Council Implementing Decision (EU) 2025/1458 of 14 July 2025 authorising support from the EU Cybersecurity Reserve for Moldova (OJ L, 2025/1458, 18.7.2025, ELI: http://data.europa.eu/eli/dec_impl/2025/1458/oj).

2/3 ELI: http://data.europa.eu/eli/dec_impl/2026/1725/ojEN OJ L, 13.7.2026

HAS ADOPTED THIS DECISION:

Article 1 The provision of support from the EU Cybersecurity Reserve to the Republic of Moldova within the meaning of Article 19 of Regulation (EU) 2025/38 is hereby authorised.

Article 2 This Decision shall enter into force on 15 July 2026.

It shall apply for 1 year.

Done at Brussels, 10 July 2026.

For the Council The President S. HARRIS

ELI: http://data.europa.eu/eli/dec_impl/2026/1725/oj 3/3