The Ukrainian government can now activate emergency EU cyber support to respond to large-scale cyber-attacks and cyber incidents affecting one of its organizations and businesses.
Despite not being an EU member state yet, Ukraine’s inclusion in the EU Cybersecurity Reserve was approved on June 16 by the Council of the EU, the main decision-making body of the EU, representing the member states’ governments.
The Reserve, managed by the EU Agency for Cybersecurity (ENISA), provides incident response services from 47 trusted private providers to help address significant or large-scale incidents.
These trusted providers have all successfully passed a test called an “ownership control assessment” (OCA) to determine whether they are directly or indirectly controlled by people and entities within EU member states.
The EU Cybersecurity Reserve is part of the Digital Europe Work Programme 2025-2027, which allocates €36m ($41.8m) to enhance response and reporting for cyber threats and incidents across the EU.
The EU Cyber Solidarity Act, which came into force in February 2025, provides the legal basis for the Reserve.
Henna Virkkunen, executive VP for tech sovereignty, security and democracy at the European Commission, said European “unity is its “greatest asset” to face heightened cyber-attacks.
“By welcoming Ukraine into the EU Cybersecurity Reserve, we strengthen our collective defences and reaffirm the principle of solidarity that lies at the heart of Europe’s digital future,” she added.
Ukraine is one of the nine countries officially recognized as candidates for membership of the EU, alongside Albania, Bosnia and Herzegovina, Georgia, Moldova, Montenegro, North Macedonia, Serbia and Turkey.
Moldova, which is not currently an EU member state, was included in the EU Cybersecurity Reserve in 2024.
