Smart and reliable legal services

Since 1 May 2026, the EU-Mercosur Interim Trade Agreement (iTA) has provided an operational framework for preferential trade between the EU and Argentina, Brazil, Paraguay and Uruguay. One hundred days of provisional application offers a timely occasion to examine the agreement through a lens that was far less prominent when negotiations began more than two decades ago: economic security. The December 2025 Joint Communication on Strengthening EU Economic Security (the 2025 Joint Communication) calls for more strategic use of the EU’s economic security toolbox to reduce exposure to economic risks, prevent its de-risking objectives from being undermined and expand opportunities for diversification through EU trade agreements. [1] Within that toolbox trade agreements have a particular role: (1) they diversify markets and sources of supply, (2) they reduce risk dependencies and (3) they build more resilient economic relationships with trusted international partners. Trade agreements remain instruments of openness, but openness is increasingly being deployed strategically. [2] Alongside protective, autonomous instruments, such as FDI screening, export controls and the Anti-Coercion Instrument, trade agreements emerge in the sphere of economic security, reducing vulnerability by widening the range of markets, suppliers and locations available to the EU economy. This update considers the iTA as a case study of that development. It focuses on three areas, tariffs and rules of origin, critical raw materials and government procurement. It assesses how the iTA may facilitate diversification, strengthen supply-chain resilience and improve access to strategic inputs. Trade agreements in the EU’s economic security toolbox The 2025 Joint Communication includes trade agreements among the instruments in the “Trade and competition” pillar of the EU economic security toolbox. The 2025 Joint Communication acknowledges that most of the tools in that toolbox were not originally developed with economic security in mind. [3] They are now to be used more strategically, proactively and efficiently, in coordination with one another. [4] Trade agreements occupy a different position from many of the EU’s autonomous economic security instruments. Export controls, investment screening and anti-coercion measures are autonomous or unilateral instruments designed primarily to protect the EU against identified economic security risks. Trade agreements operate differently, through negotiated and reciprocal commitments: they create rights of access, remove barriers and establish more predictable conditions for economic exchange. Reducing risk exposure through diversification, making the EU economy more resilient [5] Trade agreements are tools to reduce the EU’s exposure risk, including by facilitating access to alternative suppliers and markets. They lower EU dependence on single-country sources of critical inputs and prevent third countries from undermining the EU’s derisking efforts. [6] Where the European Commission identifies such high-risk dependencies, trade agreements serve as a mechanism to open up second and third supply sources. The use of trade agreements therefore answers to the risk that third countries weaponise such high-risk dependencies. Supply chain building with trusted partners The 2025 Joint Communication envisages building on existing trade agreements, alongside other bilateral and plurilateral forms of cooperation. [7] Trade agreements can provide a stable and legally binding framework for these economic relationships by reducing barriers, establishing predictable trading conditions and creating institutional mechanisms for cooperation. Hosting production of critical goods in partner countries The Joint Communication also refers to the possibility of locating production of certain critical products in candidate countries and other partner countries, including in the Middle East and North Africa. [8] Trade agreements can support that objective by establishing the conditions in which alternative production of critical goods outside the EU but within trusted jurisdictions becomes commercially viable. This goes further than market access – it is about anchoring supply chains for critical goods in countries the EU works with closely and creating more geographically diversified supply chains. Role of EU-Mercosur Agreement for the EU’s economic security The EU-Mercosur iTA provides a practical example of how a trade agreement, originally negotiated principally as a market-opening instrument, can acquire a broader economic security relevance. Its contribution lies in providing EU businesses with alternatives, such as alternative export markets, sourcing routes, raw material supply, and procurement opportunities. Several chapters in the iTA are particularly relevant in this respect, including but not limited to tariff liberalisation and rules of origin, improved access to critical raw materials and public procurement. Tariffs and rules of origin The tariff reductions are substantial, lowering the tariffs on cars (previously up to 35%), machinery (previously 14-20%), and pharmaceuticals (previously up to 14%). [9] The European Commission estimated the agreement will save EU firms more than €4 billion each year in customs duties. [10] Rules-of-origin determine which products benefit from those preferences, Where EU products incorporate non-EU inputs, preferential treatment depends on compliance with the origin requirements in Chapter 3 and the product-specific rules in Annex 3-B. Those rules therefore also influence which supply chain can effectively benefit from the agreement. Critical Raw Materials Critical raw materials provide perhaps the clearest connection between the iTA and economic security. The EU remains dependent on external sources for a number of materials that are important to its industrial and strategic capabilities. Concentration of those supplies can create vulnerabilities where exporting countries impose restrictions, licensing requirements or other limitations. The EU-Mercosur contributes to diversification in several ways. First, it reduces tariffs affecting critical raw materials and derived products, reducing the costs for EU manufacturers. Second, it limits export restrictions, such as export duties, export monopolies, and non-automatic import licensing requirements. [11] Brazil retains limited exceptions, but the agreement provides preferential treatment for EU operators in relevant circumstances. [12] Finally, the EU-Mercosur agreement can facilitate EU investment in production and processing activities in Mercosur. From an economic-security perspective, this can help diversify the geographical base of supply and reduce reliance on a small number of production locations. The iTA does not, however, contain a conventional investment-protection chapter. Its contribution lies principally in improving market access and conditions for establishment rather than providing comprehensive post-establishment investment protection. Procurement Public procurement provides another route through which the iTA may contribute to economic security. The agreement does not open every public contract. It applies only to “covered procurement”, which requires checking the procuring entity, contract value, type of goods or services, applicable thresholds, relevant country schedule and any exclusions. This can broaden access to public markets that shape infrastructure, industrial capacity and long-term supply relationships. For procurement covered by the iTA, Mercosur suppliers occupy a different legal position from suppliers from third countries for which the EU has undertaken no comparable procurement commitment. That distinction remains subject to the scope of Chapter 12 and the applicable coverage schedules. Concluding remarks The EU-Mercosur iTA significance for economic security lies in the alternatives it creates. By lowering barriers to an additional market, facilitating access to strategic inputs and establishing reciprocal procurement rights, the agreement can contribute to diversification and resilience. Whether those legal opportunities ultimately translate into less concentrated trade and supply relationships will depend on how they are used in practice. The EU-Mercosur iTA therefore illustrates a broader shift in EU trade policy: trade agreements remain instruments of openness, but openness itself is increasingly being assessed – and deployed – through an economic security lens. [1] European Commission, “Joint Communication to the European Parliament and the Council. Strengthening EU Economic security” (3 December 2025) JOIN(2025)977 final, page 2. [2] Ignacio García Bercero, Petros C. Mavroidis, André Sapir, “Updated assessment: Memo to the commissioner responsible for trade” (30 January 2025) Bruegel, available at: https://www.bruegel.org/first-glance/updated-assessment-memo-commissioner-responsible-trade . [3] European Commission, “Joint Communication to the European Parliament and the Council. Strengthening EU Economic security” (3 December 2025) JOIN(2025)977 final, page 2. [4] Ibid. [5] Federico Steinberg, Guntram Wolff, “Dealing with Europe’s economic (in-)security” (18 October 2023) 15 Global Policy 1, available at: https://doi.org/10.1111%2F1758-5899.13303c . [6] European Commission, “Joint Communication to the European Parliament and the Council. Strengthening EU Economic security” (3 December 2025) JOIN(2025)977 final, page 3. [7] Ibid., pages 6 – 7. [8] Ibid. [9] European Commission, “The EU-Mercosur trade agreement”, accessed on 7 August 2026, available at: https://commission.europa.eu/topics/trade/eu-mercosur-trade-agreement_en . [10] Ibid. [11] EU-Mercosur iTA, Chapter 2, Articles 2.9, 2.7. [12] EU-Mercosur iTA, Annex 2-B, Section D.

On 20 January 2026, the European Commission published a Proposal for a Regulation of the European Parliament and of the Council on the European Union Agency for Cybersecurity (ENISA), the European cybersecurity certification framework, and ICT supply chain security and repealing Regulation (EU) 2019/881 (“ The Cybersecurity Act 2 ”). The Cybersecurity Act 2 covers three key areas: 1) rules and organisation matters relating to ENISA; 2) the creation of European cybersecurity certification schemes to ensure an adequate cybersecurity level for ICT products, ICT services, ICT processes, managed security services and the cybersecurity posture of EU entities; and 3) rules relating to a trusted ICT supply chain framework. This Guide focuses on the trusted ICT supply chain framework and its potential impact on businesses. All references to Articles below refer to the Cybersecurity Act 2 unless stated otherwise. As this is only a proposal, the final obligations may differ. Trusted ICT supply chain framework The trusted ICT supply chain framework will offer a security mechanism at the EU level to tackle non-technical risks in sectors of high criticality and other critical sectors as referred to in Annex I and Annex II to the Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (“ NIS2 Directive ”). Non-technical risks are defined as the “ likelihood of the supplier being subject to influence by a third country with the potential to cause loss or disruption of the service provided or to compromise the product manufactured by an entity or to lead to exfiltration of data, including for the purposes of espionage or revenue generation ”. (Article 2(42)) The framework aims to protect critical sectors from third-country influence by identifying key ICT assets in critical ICT supply chains and imposing mitigation measures where necessary. Security risk assessments The European Commission or a group of three or more EU Member States may request the NIS Cooperation Group to conduct an EU coordinated security risk assessment. In the event of a significant cyber threat, the European Commission may conduct a security risk assessment taking into account the consultation with the EU Member States. (Articles 99(1) and 99(3)) The security risk assessment will encompass the proposed identification of key ICT assets, main threat actors, risks and vulnerabilities impacting such assets. It will also formulate risk scenarios and suggest mitigation measures. (Articles 99(1) and 99(3)(b)) Identification of key ICT assets Where security risk assessments identify significant cybersecurity risks in relation to an ICT supply chain, the European Commission may adopt implementing acts identifying key ICT assets used by sectors of high criticality and other critical sectors under the NIS2 Directive to manufacture products or provide services (Article 102). Mitigation measures in the ICT supply chain The European Commission may adopt implementing acts prohibiting certain types of entities in sectors of high criticality and other critical sectors from using, installing or integrating ICT components from high-risk suppliers in key ICT assets. (Article 103). A similar prohibition exists for providers of mobile, fixed and satellite electronic communications networks (Article 111(1)). The European Commission may oblige certain entities in sectors of high criticality and other critical sectors to implement mitigating measures in their ICT supply chain especially in relation to key ICT assets. These may include transparency requirements, prohibition on the transfer of data to third countries, audits, restrictions on contractual relations and diversification of ICT components supply. (Article 103(2)). Identification of high-risk suppliers and consequences of the listing The European Commission will establish lists of high-risk suppliers that could be subject to mitigation measures provided above. In assessing suppliers, the European Commission will investigate the place of establishment as well as the ownership and control structure. (Article 104(4)). Listing may result in, amongst others, exclusion from EU public procurement procedures and EU funding programmes. Designation of third countries posing cybersecurity concerns The European Commission may designate third countries posing cybersecurity concerns to ICT supply chains. In doing so, it will take into account, amongst others, laws and practices in such third country that require entities in their jurisdiction to inform the authorities of software or hardware vulnerabilities before such vulnerabilities are known to have been exploited, substantiated information concerning incidents of threat actors controlled from such third country or conducting its operations from that third country to implement malicious cyber activities. (Articles 100(1) and 100(2)) Entities established in or controlled by entities from the designated third country may request for an exemption from being subject to the prohibitions imposed on entities from sectors of high criticality and other critical sectors on the use, installation or integration of its ICT components in key ICT assets and from being subject to the prohibition on participation in public procurement procedures. (Article 105(1)) Penalties Violation of the prohibition to use, install or integrate ICT components from high-risk suppliers could result in a fine of a maximum of 7% of the total worldwide annual turnover in the preceding financial year. Violation of mitigation measures could result in a fine of a maximum of 1-2% of the total worldwide annual turnover in the preceding financial year, depending on the measure concerned. How it may impact businesses Companies operating in sectors of high criticality and other critical sectors may face disruption in their ICT supply chain and increased costs if suppliers are listed as high-risk and/or the sourcing countries are designated, particularly where alternative ICT components are limited. In some cases, product or service redesign may be required. Subject to the final text, companies should consider mapping in-scope suppliers, reviewing contractual arrangements, and assessing data transfer and remote data processing practices to prepare mitigation strategies and compliance processes. ICT components suppliers from third countries may face restrictions on access to the EU market if listed as high-risk. Although the right to be heard and exemption procedure exist, the process may be time-consuming. The operational implications are likely to follow three main lines:  Supplier risk exposure : companies active in critical sectors will need to factor jurisdictional and ownership risk into vendor selection and supply-chain design. Compliance integration : ICT due diligence will extend beyond technical assurance and certification into governance, legal-environment and control-structure assessments. Supervisory enforcement : mitigation obligations adopted through implementing acts will feed into national oversight, with associated compliance and liability consequences (likely to lead to enforcement divergence). In this sense, the trusted ICT supply chain framework illustrates how EU cybersecurity regulation is becoming structurally intertwined with questions of resilience, strategic autonomy and security of supply, a trajectory that is likely to shape both legislative negotiations and downstream compliance practice. Next steps in the legislative process and indicative adoption timing The Cybersecurity Act 2 is in the ordinary legislative procedure. As of early February 2026, the file has formally entered the Parliament’s preparatory phase, with technical examination ongoing in the Council. Adoption is currently expected in late 2026 or in 2027. Trusted ICT supply chain framework – positioning within the Cybersecurity Act 2 The trusted ICT supply chain framework introduced in the Cybersecurity Act 2 adds a distinctly geopolitical and security-policy layer to EU cybersecurity law. Whilst the original Cybersecurity Act focused primarily on technical assurance and certification, the revision moves into risk governance linked to third-country exposure, supplier influence and systemic dependency in critical sectors. From a legal-policy perspective, the framework reflects a wider evolution in EU digital legislation: cybersecurity risk is no longer treated solely as a technical or resilience question, but increasingly as a matter of economic security and systemic dependency management. The developing regime around high-risk supplier identification is particularly illustrative of this shift. Whilst the detailed listing mechanics and consequences are still being shaped legislatively, the EU’s approach makes clear that participation in sensitive ICT ecosystems may become contingent on security, governance and jurisdictional risk considerations, not only on technical performance or certification status. More broadly, the framework signals that EU cybersecurity law is moving closer to the EU’s wider economic security agenda. Legislative instruments are increasingly designed to manage exposure to external influence, strategic dependencies and systemic vulnerabilities across critical sectors. For information on how the Cybersecurity Act 2 could impact your business or economic operators in your country, please contact Yapa Thepkanjana at yapa.thepkanjana@acquislp.eu and Patrick Mascott at patrick.mascott@acquislp.eu.

EU–US trade tensions and the anti-coercion instrument: a new risk scenario for economic operators