EU works on European playbook for hybrid threats
European ministers want to respond more quickly to sabotage, cyberattacks and other threats below the threshold of war.
.jpg){kind=link}
The European Union is working on an emergency protocol that would allow member states to respond jointly to hybrid threats. The plan has not yet been adopted: ministers mainly discussed on Monday how such a mechanism should relate to NATO.
Foreign and Defence ministers discussed a proposal for a so-called emergency protocol in Brussels. It is intended to help member states share information more quickly and organise a joint response when a hybrid threat affects a country.
EU foreign affairs chief Kaja Kallas said afterwards that this was the first discussion of the proposal. She could not say how many of the 27 member states support the mechanism. The European Commission and Kallas will develop the plan further in the coming months.
Hybrid threats refers to actions that remain below the threshold of open war but can nonetheless undermine security or democratic institutions. The EU cites sabotage, cyberattacks, foreign interference, disinformation and attacks on critical infrastructure, among other examples.
The proposal is inspired by Article 4 of the NATO treaty. That article allows consultations when an ally considers its territorial integrity, political independence or security to be under threat. It differs from Article 5, which treats an armed attack on one NATO country as an attack on all allies.
The European discussion follows several incidents that European governments have linked to Russian activity. According to European and international sources, these include drone incidents, sabotage and cyberattacks. Responsibility has not been publicly established for every individual incident.
The ministers therefore stress that a European mechanism must not overlap with NATO. Kallas said the protocol should instead be complementary and fit with existing national and Atlantic structures.
The practical questions remain open. It is not clear who could formally activate the protocol, what threshold would apply and what obligations member states would then face. It must also be decided how parliamentary oversight and the division of responsibilities between the EU and NATO will be arranged.
One story, several perspectives
What is established
- EU ministers discussed a new mechanism for hybrid threats.
- The mechanism has not yet been designed definitively.
- The EU wants to prevent duplication with NATO.
- Hybrid threats can include cyberattacks, sabotage and foreign interference, among other things.
Left
Arguments A joint European approach could better protect citizens and democratic institutions, but must not lead to unlimited security powers or the militarisation of social problems.
Values Democratic oversight, civil rights, transparency and international cooperation.
Consequences A protocol could increase resilience, but requires clear definitions, parliamentary oversight and protection against misuse of the term hybrid threat.
Centre
Arguments The EU must be able to consult more quickly when infrastructure or elections are threatened, provided the protocol is legally clear and remains complementary to NATO.
Values Administrative feasibility, proportionality, legal certainty and allied cohesion.
Consequences A well-defined mechanism could speed up decision-making without creating a new parallel security structure.
Right
Arguments Europe must be able to respond more quickly to sabotage and foreign intimidation. An overly slow or fragmented approach leaves critical infrastructure and national sovereignty vulnerable.
Values National security, deterrence, order and the protection of vital facilities.
Consequences A robust protocol could raise the costs for attackers, but would also require greater defence spending and a clear willingness to implement measures in practice.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The core facts have been confirmed by the EU agenda and reporting by Euronews and AP. The text clearly distinguishes between the proposal under discussion, existing NATO procedures and unconfirmed attributions for incidents.
- confirmed EU ministers discussed a European mechanism against hybrid threats on 28 September. — It appears on the Council's agenda and is described by Euronews. source
- confirmed The proposed protocol has not yet been definitively adopted. — Kallas described the discussion as a first debate. source
- confirmed The proposal is intended to complement NATO rather than duplicate it. — Kallas said the two structures should be complementary. source
- confirmed NATO Article 4 differs from Article 5. — AP describes the consultative nature of Article 4 and the collective defence provided for by Article 5. source
- confirmed European governments have named Russia in connection with various incidents, but not every incident has been independently established publicly. — AP and the EU describe allegations and hybrid activities; the wording remains cautious. source
Editor's note
It is certain that EU ministers discussed the subject on Monday and that a definitive protocol does not yet exist. Attributions to Russia remain based on statements by European governments; not every incident has been independently established.Sources
- Foreign Affairs Council (Defence), 28 September 2026 — Raad van de Europese Unie
- EU seeks hybrid threat playbook without duplicating NATO — Euronews
- EU chief von der Leyen calls for EU security mechanism — AP News
More on this in Dutch media
- De Telegraaf — „hybride dreiging”
- AD — „hybride dreiging”
- de Volkskrant — „hybride dreiging”