In November 2025, the European Commission published a proposal for a Regulation as regards the simplification of the digital legislative framework (the “Digital Omnibus”). 

The proposal amends NIS2, DORA, eIDAS and the CER Directive to introduce a mandatory single-entry point (SEP) for incident and cyber-threat reporting in the EU. The SEP is developed, operated and secured by ENISA, which must establish technical, operational and organisational specifications ensuring interoperability with existing national and EU reporting systems, support for machine-readable formats and APIs, and the ability for entities to retrieve or supplement previous submissions. A single notification may be used to fulfil multiple reporting obligations across the amended legal acts.

ENISA must pilot the SEP for each legal act, after which the Commission must confirm its proper functioning before it can be used. If deficiencies are identified, ENISA must apply corrective measures.

Use of the SEP becomes mandatory across several frameworks, including:
– NIS2 (significant-incident reporting and alignment with CRA notifications),
– eIDAS (qualified trust service incident reporting),
– DORA (major ICT incidents and voluntary cyber-threat notifications), and
– CER Directive (incident notifications by critical entities).