Yesterday, Ursula von der Leyen presented the Emergency Security Protocol to the European Parliament, a mechanism that would allow a member state to request an urgent meeting of all members when an incident seriously threatens national security but does not reach the threshold of armed aggression.
The President of the European Commission described it as the European counterpart to NATO’s Article 4.
In the same speech, she announced a new European security strategy, a dedicated framework for responding to hybrid threats, and the development of a European Security Council with partners such as the United Kingdom, Canada, Norway, and Ukraine.
For now, there is no legal proposal, detailed procedure or defined obligations that would arise from activating the protocol.
The publicly presented idea, however, clearly illustrates the problem the Commission wants to solve.
The European Union has a large number of instruments for dealing with cyberattacks, sabotage, attacks on critical infrastructure, foreign interference and other hybrid activities, but the political response to them runs through multiple national and European procedures.
Von der Leyen proposes a clearer trigger for the moment when a serious incident goes beyond the national framework and requires an urgent joint assessment.
Incidents below the threshold of armed aggression
Article 4 of the North Atlantic Treaty provides for consultations among allies when a member state considers its territorial integrity, political independence or security to be threatened. Article 5 regulates collective defence following an armed attack.
This distinction is crucial in the context of contemporary hybrid operations, which are often designed to remain below the threshold of an event that would unequivocally trigger a military response.
Practice in 2025 demonstrated the political value of Article 4. On 10 September, Poland requested consultations after several Russian drones entered its airspace.
On 23 September, Estonia did the same after an incident in which three armed Russian MiG-31 aircraft remained in Estonian airspace for more than ten minutes.
In both cases, the national incident immediately became a matter for the North Atlantic Council, while the assessment of the broader response remained subject to joint decision by the allies.
Today, the European Union does not have a uniform political mechanism for all types of incidents below the threshold of armed aggression
Today, the European Union does not have a uniform political mechanism for all types of incidents below the threshold of armed aggression.
Article 42(7) of the Treaty on European Union obliges member states to assist a state that is a victim of armed aggression on its territory.
Article 222 of the Treaty on the Functioning of the European Union regulates solidarity in the event of a terrorist attack or natural or man-made disaster.
A hybrid campaign can cause serious security consequences long before it meets the criteria set out in those provisions.
Europe already has the tools to respond
The Commission’s proposal enters a system that already includes a wide range of instruments.
Following the adoption of the Strategic Compass in 2022, the EU created the Hybrid Toolbox, a framework that combines preventive, diplomatic, economic, restrictive and other measures.
There is also the Cyber Diplomacy Toolbox, as well as the Integrated Political Crisis Response (IPCR) mechanism, which enables political coordination during large and complex crises.
In March 2026, the EU Council again called for a stronger response to sabotage, malicious cyber activities, election interference, attacks on critical infrastructure and other hybrid campaigns.
The Council’s 2022 framework already provides that a member state can request a review of an incident that could form part of a hybrid campaign.
The Commission and the High Representative can prepare proposals, the relevant Council working bodies consider them, and the IPCR can be activated when the scale of the crisis requires it.
The system therefore has instruments for assessment, coordination and response. Its weakness becomes apparent when the speed of political decision-making is as important as the substance of the measures.
A request from one member state would be enough for all countries to come together and consider a joint response
The Emergency Security Protocol would provide a clearer procedure for that aspect.
According to von der Leyen, a request from one member state would be enough for all countries to come together and consider a joint response.
The political value of such a mechanism lies in shortening the time between an incident, a joint assessment, and a decision on the next steps.
In an attack on the power grid, submarine cables, railway junctions, communication systems, or other parts of critical infrastructure, a few hours can be crucial to protect other targets, preserve evidence, and halt the operation.
Attribution remains in the hands of the states
The biggest obstacle to a rapid joint response remains the question of accountability.
Hybrid campaigns often use intermediaries, infrastructure in third countries, private companies, criminal networks or cyber infrastructure that makes it difficult to trace the origin of an attack.
Member states do not possess the same intelligence, nor do they apply the same criteria when deciding whether there is sufficient evidence to publicly attribute responsibility for an attack to a specific state or actor.
The EU Council has already established the rule that attributing a hybrid activity to a specific state or non-state actor remains a sovereign political decision for each member state.
This means that the EU can adopt certain measures even without a joint decision by the members to publicly indicate who is behind the attack.
Governments will retain control over their own intelligence assessments and decisions that may have serious foreign policy consequences
Such an approach allows infrastructure protection, information sharing, strengthened cyber defences and other measures while the political and intelligence assessment of responsibility is still ongoing.
The new protocol is unlikely to alter that division of jurisdiction. Governments will retain control over their own intelligence assessments and decisions that may have serious foreign policy consequences.
Its impact will therefore be judged by its ability to accelerate consultations and the preparation of common measures, without seeking to replace national attribution with a centralised European decision.
Security format broader than the EU
The second part of the proposal raises a separate institutional issue. Von der Leyen has announced the creation of a European Security Council and mentioned Canada, Norway, Ukraine and the United Kingdom as possible participants.
All four countries have different formal relationships with the European Union but are closely connected to European security, defence, intelligence cooperation and the protection of critical infrastructure.
For now, the composition of this body, its operating rules, powers and decision-making procedures have not been announced.
The relationship with NATO will be crucial for political credibility
The choice of partners suggests a format that would bring together leaders of states with a direct interest in the security of the European continent and enable consultations beyond the institutional borders of the EU.
Such a framework would be particularly useful in responding to hybrid incidents whose consequences cross Union borders or affect infrastructure and networks linked to non-member states.
The relationship with NATO will be crucial for political credibility. The European security system already operates in conjunction with the Alliance, which remains the basis of collective defence for its members.
Von der Leyen presented her proposal in connection with NATO’s Article 4. The European Security Council will most likely have a role in political coordination and linking partners, while military deterrence and collective defence will remain within existing NATO structures.
The new protocol will rely on the existing system
The most likely next step is to incorporate the Emergency Security Protocol into the existing European crisis framework, using the IPCR, Hybrid Toolbox, Council working bodies and established channels for intelligence assessments. At the initial stage of such a model, changes to European treaties would not be necessary.
Political agreement among the member states can determine who convenes consultations, which institutions enter the process immediately, and what kind of assessment is prepared in the first hours after the protocol is activated.
The most realistic compromise would maintain a clear distinction between initiating consultations and taking concrete decisions.
A country would have the right to escalate an incident to the European level rapidly, while sanctions, security assistance, operational measures and other forms of response would continue to be adopted through existing legal procedures.
The European Security Council will probably develop as a political forum in which, in addition to EU members, Britain, Norway, Canada and Ukraine would participate
Such a solution reflects states’ interest in preserving their competences and the Union’s need to react more quickly when an incident spreads across national borders.
The European Security Council will probably develop as a political forum in which, in addition to EU members, Britain, Norway, Canada and Ukraine would participate.
Its main purpose would be to enable those countries, in a serious security crisis, to exchange assessments quickly, harmonise positions and agree common actions, even though they do not all belong to the same European institutions.
Von der Leyen’s proposal raises a very specific question for European security: how much time can the Union afford to lose before a serious hybrid incident becomes a shared political problem?
Response instruments already exist, and member states have expanded their scope in recent years.
The next phase will seek to shorten the procedures that lead from national alert to joint European assessment.
The biggest obstacle will be persuading the member states to cede some control over the pace and political framework of the response to a common European mechanism.
