Decision CFSP 2026/2195: the STRA space threat response

In brief

The Council of the European Union has rewritten the mechanism through which the Union reacts when a space system comes under threat, and has replaced the decision that had governed it since 2021. The new act is called the European Union Space Threat Response Architecture, abbreviated STRA, and it has 15 articles and three sections, against the 10 articles without sections of the act it repeals.
Those concerned are the Council, the High Representative, the European External Action Service, the European Union Agency for the Space Programme and the Member States, Romania among them. There is no transposition into national law and no new obligation for citizens or for companies. Romania does gain two things it did not have: the right to ask itself that the mechanism be triggered, including for a threat against its own systems, and the duty to designate points of contact in the STRA network.
The set of responses grows from one to five, and the Council has at most four weeks to rule on a provisional response. The decision enters into force on 29 September 2026, the day it is published. The review deadline the Council sets for itself rises from three to five years, that is until 29 September 2031, after the three-year deadline in the old act had fallen due on 12 May 2024, 869 days before the replacement was adopted.

Act: Council Decision (CFSP) 2026/2195 of 28 September 2026 on the European Union Space Threat Response Architecture (STRA) and repealing Decision (CFSP) 2021/698
Published: Official Journal of the European Union, L series, 2026/2195 of 29 September 2026
In force from: 29 September 2026, the day of publication in the Official Journal of the European Union, under Article 15

In Brussels, on 28 September 2026, the Council of the European Union adopted a decision that changes who presses the button, and how quickly, when a satellite, a ground station or a radio link on which the Union depends comes under threat. The act is Decision (CFSP) 2026/2195, the abbreviation CFSP standing for the common foreign and security policy, the field in which the Member States decide together and by unanimity. Among the five kinds of response it makes available are restrictive measures, that is sanctions of the kind adopted in the same week over the file of the deported Ukrainian children, with the freezing of funds and the entry ban they bring with them.

What is at stake is not new obligations for anyone in particular. The decision is not transposed by a Romanian law, it sets no deadline for citizens and it does not show up in any company’s dealings with an authority. What is at stake is the chain of decision: who learns first, whom they tell, who proposes, who decides, in what time, and what can come out at the end of the procedure. All of that existed before too, in Decision (CFSP) 2021/698, which the present act repeals, but it existed in a far narrower form.

What there was before. Decision (CFSP) 2021/698, adopted on 30 April 2021 and published on 12 May 2021, dealt exclusively with the systems and services of the Union Space Programme, that is Galileo and EGNOS, Copernicus, space surveillance and governmental satellite communications, plus, after a single amendment, the Union Secure Connectivity Programme. The response it allowed was a single one: an instruction addressed to the Agency or to the appointed security monitoring structure, decided by the Council acting unanimously. We checked the chain of amendments in the official database of the Union, not in a summary: the only amendment ever made to that act was Council Decision (CFSP) 2023/598 of 14 March 2023, applicable from 20 March 2023, which extended the mechanism to secure connectivity. There was no second amendment, and there is only one consolidated version.

What changes at the foundations. The new act defines for the first time, in a binding provision, what a space threat is. The definition in Article 1(2) has two branches: either a threat to the security of the Union or of one or more of its Member States, arising from the deployment, operation or use of any space system, or a threat to the operation of any space system or to the provision of any space service, the denial of which would harm fundamental interests. The word that matters is „any”. Recital (6) explains it without circumlocution: systems operated by third States and systems operated by commercial companies both count.

What it changes in practice

The first effect is a clear map of who informs whom. Article 2(1) lists who must immediately inform the High Representative of the Union for Foreign Affairs and Security Policy: the Member States, the European Commission, the relevant common foreign and security policy entities and agencies, the operations and missions of the common security and defence policy, the European Union Agency for the Space Programme and any security monitoring structure appointed under Article 34(4) of Regulation (EU) 2021/696. We opened that article: it is precisely the basis on which the Commission may set up such a structure, and for Galileo the structure is the Galileo Security Monitoring Centre. The loop closes in paragraph (2): the High Representative immediately informs the Council.

The second effect is that there are two doors in, not one. Article 1(3), point (a), opens the mechanism for a threat to the security of a Member State or of a group of Member States, including to their territory, to their own space systems and services or to other capacities under their authority. Point (b) keeps the old door, the one for the systems and services of the Union Space Programme and of the Union Secure Connectivity Programme. Recital (11) states that activation through the first door is the sovereign and voluntary decision of the State or of the group of States.

The third effect concerns who starts the procedure and with what margin. Through door (a), Article 3(1) requires a request from the State, together with the relevant information, the response the State has in mind, the measures already taken and their expected impact; the High Representative „may” then submit a proposal to the Council. Through door (b), paragraph (2) uses the indicative, so the High Representative „shall submit” the proposal. The difference between a power and a duty is the only one that counts in practice: on threats of their own, the States leave the political filter in Brussels.

The fourth effect is the set of tools, the real novelty. Articles 5 to 9 list five categories of response. Article 5, diplomatic responses: engaging in contact with third States or international organisations, delivering a demarche, issuing a statement on behalf of the Union, launching a diplomatic campaign. Article 6, technical measures, the only ones tied strictly to the Union programmes, taken through an instruction addressed to the Agency or to the appointed security monitoring structure. Article 7, a strategic communication action plan. Article 8, restrictive measures against relevant persons and entities. Article 9, modifying the mandate of a mission or operation of the common security and defence policy, or establishing a new one. The repealed act had a single lever, the technical one.

The fifth effect is the mandatory impact assessment before every response. Article 3(3) requires the proposal to include an impact assessment. Under Articles 5, 7, 8 and 9, the European External Action Service assesses the likely wider impact of the measure under consideration. Under Article 6 the task is shared differently: the Agency or the appointed security monitoring structure and the European Commission advise the High Representative on the effects on the systems and services, while paragraph (3) obliges the High Representative to ask the Member States, through the STRA network, what effects the measure would have on their governmental users. Paragraph (4) provides that the relevant information is to be given to the users who may be affected, but only „where appropriate”.

The sixth effect is the emergency regime. Article 4(1) authorises the High Representative to adopt a provisional Union response before the Council has decided, and allows the High Representative to direct the Secretary-General of the European External Action Service to issue the instructions to the Agency. Recital (13) explains the haste: a first response might be required within a few hours of the information coming in. Paragraph (2) requires the Council and the Commission to be informed immediately, paragraph (3) imposes constant review on the High Representative, and paragraph (4) gives the Council at most four weeks from the adoption of the provisional response to confirm it, modify it or revoke it. For a provisional response adopted on 29 September 2026 itself, the last day of those four weeks would be 27 October 2026.

The seventh effect is the preparedness part, the one that shows least and that decides whether the mechanism works the first time it is used. Article 10(1) puts the High Representative in charge of preparing the operational procedures for the responses in Articles 5 to 9 and of submitting them to the Political and Security Committee for approval; that committee, abbreviated PSC, is the format of ambassadors in which the Member States prepare foreign policy decisions. The procedures may include predefined instructions, under paragraph (2). The Agency then receives, through paragraph (3), a year counted from the date on which the security configuration of the programme committee determines whether a system or a service is security sensitive, in order to prepare the procedures for Article 6. Review comes at least every two years, under paragraph (4), on the basis of a yearly exercise, and paragraph (5) requires the PSC to be informed at least once a year.

The eighth effect is the network. Article 12 requires the Member States to take the necessary measures in their own area of responsibility, with a reference to Article 34(6), point (a), of Regulation (EU) 2021/696, which obliges them to protect the ground infrastructures of the programme located on their territory at least to the level of critical infrastructures. Then comes, in paragraph (2), the designation of points of contact, which may be natural or legal persons. They receive, through paragraph (3), access to a secure videoconferencing system to be determined by the Council. None of the three obligations has a deadline.

The ninth effect looks outward. Article 11(2) gives the High Representative the authority to conclude administrative arrangements with authorities of third States and with international organisations, subject to approval by the Council acting unanimously, and paragraph (3) ties access to EU classified information to arrangements concluded in line with the Council security rules. Recital (24) names explicitly the cooperation with the North Atlantic Treaty Organisation, which the act calls NATO, and its guiding principles, among them the decision-making autonomy of both organisations.

What has changed compared with the previous situation

The comparison with Decision (CFSP) 2021/698 is made on the text, not on impressions, so we placed the two acts side by side. The old act had 15 recitals and 10 articles, with no division into sections. The new act has 24 recitals, 15 articles and three sections: the STRA mechanism, the toolbox and preparedness. The growth is not decorative, because the articles added are exactly the four new tools and the network.

The scope is the first change of substance. Article 1 of the old act covered only threats linked to the systems set up and the services provided under the components of the Union programmes. An attack on a national satellite or on a ground station under the authority of a single State fell outside the mechanism. Article 1(3), point (a), of the new act brings it inside.

The second change concerns the trigger. In the old act there was no provision by which a Member State could ask for anything; everything started with the High Representative. The request from the State, or from the group of States acting jointly, is created by Article 3(1) of the new act.

The third change is the move from one tool to five. Article 3(1) of the old act referred to „the necessary instructions to the Agency or to any appointed security monitoring structure”. That was all. Diplomacy, strategic communication, sanctions and the missions of the common security and defence policy appeared nowhere.

The fourth change is the easiest to overlook and it concerns what happens to a measure taken in haste. Article 4(4) of the repealed act said plainly that the provisional instructions expire four weeks after being issued, or upon a decision of the Council. Expiry was automatic, and the Council was to rule „as soon as possible”, with no deadline. The new act turns the relationship around: Article 4(4) imposes the four-week deadline on the Council, but the automatic expiry of the provisional response no longer appears anywhere. Combined with the widening of the toolbox, the change means that a provisional response, which can now be a diplomatic demarche, a strategic communication plan or a technical measure, no longer lapses by itself if the Council fails to rule.

The fifth change concerns who writes the procedures. In the old act, Article 5(1) gave the High Representative a year from the determination of security sensitivity in which to prepare the procedures and submit them to the PSC for approval. The task is now split in two: the High Representative prepares the general procedures for Articles 5 to 9 and takes them to the PSC, with no deadline at all, while the Agency prepares the procedures for Article 6, within a year, and sends them to the High Representative, without it being said that they go to the PSC.

The sixth change is the review deadline. Article 7 of the old act required the Council to review the rules and procedures no later than three years from entry into force, that is by 12 May 2024. Article 13 of the new act raises the limit to no later than five years, so by 29 September 2031. The window the European administration reserves for itself grows by two thirds.

The seventh change has to do with the points of contact. Article 8 of the old act required the States to designate one or more points of contact to assist in the operational management of a threat, and nothing more. Article 12 of the new act places them in a structure called the STRA network, gives them a consultative role under Article 6(3) and promises them a secure videoconferencing channel.

The eighth change is one of external cooperation. Article 6(1) of the old act spoke only of administrative arrangements with third States, tied to access to the public regulated service of the Galileo system. Article 11 of the new act adds international organisations and the encouragement of information sharing and of mutual participation in space exercises.

Lastly, a change of calendar. The old act applied retroactively, from 1 January 2021, that is from 119 days before the day it was adopted. This time there is no retroactivity: Article 15 brings the act into force on the date of publication, while the second paragraph of Article 14 keeps applicable the operational procedures written under the repealed decision until they are updated, so that there is no day without rules.

Advantages and disadvantages

What it improves

For the first time there is a binding definition of a space threat, in Article 1(2), and it covers systems operated by third States or by commercial companies as well. The repealed act worked with an undefined notion of threat, tied exclusively to the Union programmes.
A Member State or a group of States can ask for the trigger themselves, for a threat to their own systems, services or territory. Romania no longer depends on the attack happening to touch, by chance, a component of the Union Space Programme.
The response becomes gradual. Between doing nothing and issuing a technical instruction there is now room for diplomacy, strategic communication and, at the other end, restrictive measures and the missions of the common security and defence policy.
Every tool has an impact assessment attached, through Article 3(3) and through the final paragraphs of Articles 5 to 9, and for technical measures the Member States are asked in advance what their governmental users would feel.
There is no day without rules. The second paragraph of Article 14 keeps applicable the operational procedures developed under the repealed decision until they are updated.
The mechanism is rehearsed, not merely written down. The yearly exercise and the review at least every two years sit in Article 10(4), and the yearly briefing of the PSC in paragraph (5).

What remains a problem

The repeal comes without a correspondence clause, even though six binding provisions in two other regulations still point to Decision (CFSP) 2021/698. Whoever applies them has to do the reasoning alone.
The unanimity in Article 3(4) lets a single State stop the Union response. A State that abstains may accompany its abstention with a formal declaration, under Article 31(1) of the Treaty on European Union, and is then not obliged to apply the decision.
The provisional response no longer lapses by itself, and the four-week deadline imposed on the Council carries no consequence if it passes unmet.
The deadlines are shared out unevenly. The Agency gets exactly one year for the procedures under Article 6, while the High Representative has no deadline at all for the procedures under Article 10(1), and the Council none for the secure videoconferencing system under Article 12(3).
Article 9(1) limits the mission tool to threats originating from the territory of a third country, so the typically space-borne threat, the one Article 1 defines, stays outside it.
Everything that matters operationally is classified. The threat landscape analysis mentioned in recital (8), the predefined instructions and the operational procedures never reach the public, and the only window onto the mechanism, the yearly briefing under Article 10(5), stops at the PSC.

Practical advice

Do not look for a Romanian transposing law and do not expect a deadline for citizens, because there is none. The decision is adopted on the basis of Article 28 of the Treaty on European Union, and paragraph (2) of that article says only this: decisions of that kind commit the Member States in the positions they adopt and in the conduct of their activity.
If you use governmental satellite services, bear in mind that a technical measure adopted under Article 6 may reach you as degradation or interruption, with no prior public notice. Article 6(4) provides for information to the users who may be affected only „where appropriate”.
The channel through which Romania can say what such a measure costs it is the consultation under Article 6(3), conducted through the STRA network. Anyone who depends operationally on a service has an interest in knowing who the national point of contact is, and in having told that contact in advance what it cannot afford to lose.
Do not confuse the two doors in. A threat to a national system goes through Article 1(3), point (a), and calls for a request from the State, and there the High Representative may propose without being obliged to. A threat to a system of the Union goes through point (b), where the proposal is mandatory.
The four-week deadline in Article 4(4) runs from the adoption of the provisional response, not from the publication of the decision. For a response adopted on 29 September 2026 itself, the last day would be 27 October 2026.
Internal procedures that cite Decision (CFSP) 2021/698 do not need rewriting straight away, because the second paragraph of Article 14 keeps them applicable until they are updated. The reference to the repealed act will have to change, but the right moment for that is the update itself, not a separate round.

Frequently asked questions

Does the decision apply directly in Romania, like a European regulation?

Not in the same way. It is a decision of the common foreign and security policy, adopted on the basis of Article 28 of the Treaty on European Union. Under paragraph (2) of that article, decisions of this kind commit the Member States in the positions they adopt and in the conduct of their activity. It is not transposed by a Romanian law, it creates no rights or obligations for individuals or for companies, and nobody can invoke it before a Romanian court against an authority.

What does Romania actually have to do?

Three things, all of them in Article 12. Take the necessary measures in its own area of responsibility, with a reference to Article 34(6), point (a), of Regulation (EU) 2021/696, which concerns the protection of the ground infrastructures of the programme located on national territory. Designate points of contact, which may be natural or legal persons. And give those points of contact access to the secure videoconferencing system to be determined by the Council. The text sets no deadline for any of the three.

Can Romania block a Union response?

Yes. Article 3(4) requires the Council to act unanimously, so a single vote against stops the proposal. There is also a middle course: Article 31(1) of the Treaty on European Union allows a State to accompany its abstention with a formal declaration, in which case it is not obliged to apply the decision but accepts that the decision commits the Union.

What happens if the Council does not rule within the four weeks?

The decision does not say. The repealed act had the answer written down: the provisional instructions expired four weeks after being issued. The new wording moves the four weeks onto the Council, as a deadline for ruling, and drops the expiry. What remains is the duty of the High Representative, under Article 4(3), to keep the provisional response under constant review and to revoke it if the urgent action is no longer required.

Does this mean the Union can now strike a hostile satellite?

No. The five tools are diplomacy, technical measures on the Union’s own systems, strategic communication, restrictive measures, and the missions or operations of the common security and defence policy. None of them authorises action in orbit. The tool in Article 9 concerns only the mandate of a mission or operation, and paragraph (1) ties it to threats originating from the territory of a third country.

Why is the mechanism being changed right now?

Recital (5) invokes the experience acquired in recent years in applying the old decision and the need to cover new threats. There is also a calendar explanation: Article 7 of Decision (CFSP) 2021/698 required the Council to review the rules no later than three years from entry into force, that is by 12 May 2024. The act that rewrites them was adopted on 28 September 2026, 869 days after that date.

Errors and inconsistencies in the published text

Article 14, a repeal with no correspondence clause. The article says only „Decision (CFSP) 2021/698 is hereby repealed”, without the usual sentence by which references to the repealed act are read as references to the new one. We searched the texts in force of the two regulations concerned and found six binding provisions that still point to the vanished decision, among them Article 34(4), Article 34(5), point (b), and Article 79(1), point (j), of Regulation (EU) 2021/696, plus Article 31 of Regulation (EU) 2023/588, which says that whenever the operation of the secure connectivity system may affect the security of the Union, „Decision (CFSP) 2021/698 shall apply”. The first two reach secure connectivity as well, because Article 30(4) of Regulation (EU) 2023/588 declares Article 34(3) to (7) of Regulation (EU) 2021/696 applicable to that programme. A reader in good faith arrives at two opposite conclusions: either the obligation lost its object with the repeal, or it is to be read as a reference to the new decision. Neither rests on the text.
Recital (19), which attributes to Regulation (EU) 2021/696 a text the regulation does not have. The recital states that, in accordance with Article 34(5), point (b), of that regulation, the Agency is to ensure the operation of the Galileo Security Monitoring Centre „in accordance with the instructions developed under the scope of this Decision”. We opened the provision cited: it says „the instructions developed under the scope of Decision (CFSP) 2021/698”. In the same way, the recital presents Article 79(1), point (j), as referring to instructions „provided under this Decision”, whereas the regulation writes „instructions provided under Decision (CFSP) 2021/698”. A recital does not amend a regulation, and the decision contains no article amending it, so the substitution is left without any normative support.
Article 10(1) and (3), two authorities and two routes for the same procedures. Paragraph (1) puts the High Representative in charge of preparing, and submitting to the PSC for approval, the operational procedures for the practical implementation of the provisions on a response „referred to in Articles 5 to 9”, wording that includes Article 6. Paragraph (3) asks the Agency to prepare and send the High Representative the procedures for the practical implementation of the provisions „set out in Article 6”, without mentioning PSC approval. Nowhere does the text distinguish between general procedures and per-system procedures, and paragraph (4) speaks without distinction of „the operational procedures” that go to the PSC for approval at review. The result is two possible answers to the same question: who writes the procedures under Article 6, and whether they pass through the PSC before taking effect.

Editorial analysis

This act asks nothing of the ordinary reader, and that is exactly why it deserves careful reading. It describes what happens in the hours when nobody is reading it: an odd signal on a frequency, a ground station that stops answering, a satellite that comes too close to another. Until 29 September 2026, all the Union could do in such hours was give the Agency a technical instruction. From that date it can do five things, three of them political: a diplomatic demarche, a communication campaign and sanctions. Moving sanctions out of the classic geopolitical register and into the space one is the heaviest novelty in the act, even if Article 8 puts it in no more than two paragraphs.

The second observation does not show up when the act is read from start to finish, but when two dates are set side by side. Article 7 of the repealed decision obliged the Council to carry out a review no later than three years from its entry into force, that is by 12 May 2024. The visible result of that review, the present act, was adopted on 28 September 2026, 869 days after the deadline. And Article 13 of the new act raises the window from three to five years, to 29 September 2031. The same administration that overran a three-year deadline by more than two years is lengthening the next one by two thirds. In parallel, the only firm deadline in the whole act, one year, falls on the Agency, in Article 10(3), while the secure videoconferencing system the Council owes the national points of contact, in Article 12(3), carries no date at all.

The third observation comes from combining two provisions and concerns the measure taken in haste. In the repealed decision, the emergency response was a technical instruction addressed to the Agency and it expired automatically four weeks after being issued, if the Council had not ruled in the meantime. In the new decision, the provisional response can be any of the five tools, including a diplomatic demarche or a strategic communication plan, and it no longer expires. What is left is a four-week deadline placed on the Council, with no consequence attached to overrunning it. The change widens the emergency power of the High Representative in two directions at once, in reach and in duration, and the two compound each other. Recital (13) describes only the first half of that change, the review by the Council, and says nothing about the disappearance of the expiry.

The fourth observation concerns the distance between ambition and coverage. Article 1(2), point (a), defines the threat as arising from the deployment, operation or use of any space system, so including in orbit. Article 9(1), the only tool with a military component, applies however only to threats originating from the territory of a third country. Recital (21) goes further still and speaks of the commander mitigating threats originating from the area of operation, a notion that appears in no article. For the typically space-borne threat, the one that leaves from no territory at all, four tools out of five remain.

What should be changed

A correspondence clause in Article 14. A single sentence, by which references to the repealed decision are read as references to the new one, would close the six references left without an object in Regulations (EU) 2021/696 and (EU) 2023/588. Without it, every body that applies Article 31 of Regulation (EU) 2023/588 has to redo the reasoning for itself, and the outcome depends on who does it.
Putting back the automatic expiry of the provisional response. The formula in Article 4(4) of the repealed decision turned the four weeks into an effective limit, not into a duty of diligence. With the toolbox widened, the need for a limit is greater than it was in 2021, not smaller.
A deadline for the secure videoconferencing system. Article 12(3) creates the obligation and gives it no date. A network without its channel is not a network, and the consultation of the Member States under Article 6(3) depends precisely on the channel existing.
The same approval gate for all the procedures. The procedures under Article 6, the only ones that turn into binding instructions for the Agency, should pass through the PSC in the same way as those under Article 10(1). Political approval cannot be missing exactly where the effect is most direct.
Covering threats from orbit in Article 9. The limitation to the territory of a third country should be completed with the threat arising from a space system, so that a category defined in Article 1 is not left without a tool in Article 9.
A public version of the yearly briefing. The High Representative is obliged, by Article 10(5), to inform the PSC at least once a year. A public version, even of a single page, with the number of activations, of provisional responses and of exercises held, would give the citizen a measure of the mechanism without touching anything classified.

Original text of the legal act

The text below is reproduced in Romanian, the official form of publication.

The full text, as published in the Official Gazette of Romania

Official Journal of the European Union, L series, 2026/2195 of 29 September 2026 9 pages PDF, 887 KB

Open the official PDF Download the PDF

The viewer is not shown on small screens. Use the buttons above to open or download the file.

This article is for informational purposes only and does not constitute legal advice. For specific situations, consult a licensed attorney or tax advisor.