Introduction

On 25 June 2025, the European Commission published a proposal for the EU Space Act, a comprehensive Regulation designed to establish a harmonized framework for space activities across the EU. It seeks to harmonize licensing, bolster safety, improve cybersecurity and resilience, and promote environmental sustainability, all within a single market for the space sector. 

đź’ˇ
What does it mean for Cybersecurity, Resilience, and Critical Infrastructures? - The proposed EU Space Act would generally replace the currently existing cybersecurity framework in the EU (NIS 2 Directive) as far as risk management is concerned. In practice, this would mean that space operators and space systems would predominantly be regulated by the EU Space Act and would not need to additionally comply with the rules on risk management in the NIS 2 Directive and their local implementation laws in the 27 member states of the EU. A slightly different approach has been proposed by the EU Space Act in terms of critical entities: If a space operator constitutes a critical entity under the CER Directive, the EU Space Act shall complement, not replace, the CER Directive. Future blog posts will dive into details and cover the risk management and notification requirements under the proposed EU Space Act.

Together with the main proposal of the EU Space Act, the Commission has published several documents via a dedicated website on the EU Space Act to help better understand this draft act.

In addition, the Remarks by Commissioner Kubilius on the proposed EU Space Act are worth reading to understand the rationale and motive behind the draft act.

Core Objectives

1 | Establishing a Single Market for Space Services in the EU

One core objective of the proposed EU Space Act is to support the development and functioning of the internal market for the space sector. Specifically, it aims to establish a legal framework in the EU, enhance safety by ensuring trackability and reducing space debris, create a tailored cybersecurity risk assessment framework, and introduce a common method for calculating the environmental impact of space activities. This has been seen as a strategic key goal for the EU. The legal basis for this proposal is Article 114 of the Treaty on the Functioning of the European Union (TFEU), focusing on the establishment and functioning of the internal market, known as the single market in the EU.

2 | Introducing a one-stop Authorization Regime

The proposed EU Space Act mandates a one‑stop, mutualized licensing system: A single authorization issued by one member state would be valid across all member states.
Licenses would be tiered by activity risk, allowing for proportional requirements, light regimes for constellations and heavier oversight for high-risk missions.
Non‑EU operators servicing the EU market (including UK entities post‑Brexit and US-based companies) would also require approval, ensuring consistent treatment across the EU.

3 | Safety: Debris Mitigation and Space Traffic Management

Safety was one of the three pillars that the Commission had announced to include in the proposal for the EU Space Act.

Under the proposed EU Space Act, there is a clear objective to prevent cascading collisions and maintain long‑term orbital safety.

The draft EU Space Act proposes a unified Union Register of Space Objects (URSO) to be established under the EU Agency for the Space Programme (EUSPA) to catalogue all launches and operations. That seems to be a novel, but convincing element, and would expand the role of the EUSPA.

In terms of safety measures, operators would need to submit collision‑avoidance plans, active tracking data, and a defined end‑of‑life disposal strategy, including the option for in‑orbit servicing and debris removal measures.

4 | Resilience: Sector-specific framework for Cybersecurity and Resilience in Space

Cybersecurity and resilience of space systems was another pillar that was expected to be in the EU Space Act and reflected in one way or the other.

Space operators must perform and improve continuous risk assessments covering cyber threats and attack vectors, implement an information security management system, access control, cryptography, backup management, and incident response plans, among others.

The EU Space Act as proposed by the Commission follows a sector-driven approach and declares space as a separate sector which would be carved out from the existing framework on cybersecurity (NIS 2 Directive) and complement the existing framework on the resilience of critical entities (CER Directive).

The sunny side of the EU Space Act replacing the NIS 2 Directive insofar as risk management is concerned would be that the EU Space Act would directly und uniformly apply across all EU member states, without the need for any transposition or local implementation by the EU member states, thereby removing any chances of local deviations from a common standard. Space operators could rely on one single framework for cybersecurity in space. The challenge, however, is the compliance with the legal requirements laid down in the draft EU Space Act and the need to agree on more detailed requirements that have been proven practical and reasonable and enjoy a wide acceptance in the space industry. It remains to be seen whether the Commission will propose implementing acts to further detail the technical and operational requirements on resilience and cybersecurity.

The draft act also proposes the Union Space Resilience Network (EUSRN) to facilitate the cooperation between the Commission, EUSPA, and the national competent authorities regarding the monitoring and handling of significant cyber incidents and alignment of resilience measures with other Union cybersecurity frameworks.

Further obligations include incident reporting and management. Mandatory on‑site audits and inspections may be conducted by EUSPA or Commission teams.

Non‑compliance could incur fines up to 2% of global annual turnover, similar to other EU frameworks.

5 | Sustainability: Environmental Requirements

Sustainability was the third pillar expected to be included in the draft EU Space Act. At first glance, the rules aiming at sustainability in space, including environmental requirements, seem less strict and less enforceable compared to rules on safety and resilience/cybersecurity.

Operators would need to apply a Life‑Cycle Assessment (LCA) methodology from design to decommissioning, reporting environmental impacts in a harmonized format.

Data would feed a declared EU‑wide database to standardize environmental reporting on elements such as CO₂, debris and resource use.

While there does not seem to be a strict enforcement mechanism, space operators without a certificate on their environmental footprint would likely not be able to successfully apply for an authorization under the EU Space Act.

The proposed EU Space Act also incentivizes innovation in green space technologies including in‑orbit servicing, propulsion, and debris-cleaning methods.

6 | Expanding the Role of EUSPA

The EU Agency for the Space Programme (EUSPA) would take on expanded responsibilities: managing the Union Register of Space Objects (URSO), conducting technical assessments, issuing compliance certificates, and coordinating the Union Space Resilience Network (EUSRN).

7 | Enforcement Mechanisms

The Commission and EUSPA would be able to perform inspections and enforce compliance directly.
Regulatory penalties for infractions, especially in cyber or debris management, can reach up to 2% of annual global revenues. 

What the EU Space Act would mean for Space Operators

1 | EU Start‑ups and SMEs

On the one hand, start-ups and SMEs would benefit from a simplified multi‑state licensing framework that removes bureaucratic bottlenecks, thereby accelerating growth.

One the other hand, start‑ups would have to prepare for new compliance challenges, environmental reporting, and cybersecurity investments.

2 | Non‑EU Space Operators

Operators in the UK, US or elsewhere outside of the EU would have to adapt to substantive EU standards if servicing the EU market.

Space operators located in non-EU countries servicing the EU market would have to have a legal representative located within the EU. This concept is already known from Art. 27 GDPR and Art. 13 DSA, among other regulations.

Companies fully complying with the EU Space Act, integrating safety measures, improving resilience and cybersecurity, and decreasing their environmental footprint, may gain a competitive advantage over other companies that don't.

3| Strategic and Competitive Implications

The EU Space Act would improve space situational awareness (SSA) via the Union Register of Space Objects (URSO), and would benefit Copernicus, Galileo, and GOVSATCOM.

The draft act positions the EU as a global leader in space regulation, potentially becoming a gold standard that other jurisdictions adopt. It supports the EU’s strategic autonomy, enabling local companies to scale globally with consistent regulation.

The legal framework of the proposed EU Space Act, with steep penalties, signals a new era of compliance-driven innovation, aligning with global standards like GDPR and NIS 2. It contrasts, however, with frameworks that are predominantly based only voluntary compliance or best industry practices.

Timeline and Next Steps

The EU Space Act proposed by the Commission will be reviewed by the European Parliament and Council as required under the ordinary legislative procedure. Hence, the current draft act might see several changes.

Once adopted and entered into force, the EU Space Act would apply across all EU member states as of 1 January 2030. There is no need for national implementations by the EU member states. The Commission, however, may propose implementing acts on, e.g., common specifications for technical requirements, among others.

Final Remarks

The Commision's proposal for the EU Space Act is a cornerstone in creating a safer, greener, and more resilient space ecosystem. Set to apply from 2030, it balances innovation and regulation: streamlining operational access while raising the bar on cybersecurity, debris mitigation, and environmental accountability.

For space operators within the EU and global companies eyeing the European market, the message is clear: build with foresight - integrate sustainability, secure your systems, and prepare for a harmonized framework. Now is the time to audit processes, secure technical certifications, and engage with EUSPA and advisors to ensure compliance readiness when the draft is enacted as law and enters into force in 2030. While that future seems distant, and changes to the draft act possible, it is advisable to keep an eye on the legislative initiative and remain one step ahead. Watch this space for regular updates on the EU Space Act.


Credits: Photo "Sky on the night the draft EU Space Act was published" by SpaceTech.Lawyer. The photo shows M13, the Great Globular Cluster in Hercules.