"We urgently need a consensus on how to respond to certain incidents. Those which fall below armed aggression but clearly threaten our national security…It is time for Europe’s own Article 4 – or an Emergency Security Protocol," Ursula von der Leyen told leaders in Milan during her annual State of the Union Address.
An "Emergency Security Protocol" for hybrid attacks
The European Commission chief proposed an EU-wide security response mechanism designed to be triggered in incidents that fall short of armed aggression but nonetheless threaten national security. Von der Leyen framed the idea as an instrument to address the surge in sabotage threats, attacks and drone incursions across Europe. She listed examples of the kind of challenges the protocol might address: cyberattacks, the severing of undersea cables and threats to critical infrastructure.
At this stage the proposal is still at the conceptual level: von der Leyen said one member state would trigger the mechanism and that all member states would then convene to "coordinate a European response and deter further escalation." The speech acknowledged substantial open questions about the protocol’s legal basis and powers, including how decision-making would work, whether activation would require agreement by every member-state government, and whether responses might be predefined — for example, coordinated sanctions or automatic intelligence-sharing.
The EU idea in the context of NATO and Article 42(7)
Von der Leyen explicitly positioned the proposal to complement, rather than replace, existing security frameworks. She invoked the concept of “Europe’s own Article 4,” borrowing the NATO reference for measures that prompt consultation among allies without automatically triggering military action. The address also contrasted the proposal with NATO’s better-known Article 5 — which the source notes was invoked only once, by the United States after the 9/11 attacks.
Separately, the EU already has a mutual-defense clause in Article 42(7), but that provision applies only when a member suffers armed aggression; according to the speech, Article 42(7) has been triggered once, by France in 2015, following terrorist attacks. Von der Leyen’s Emergency Security Protocol is therefore pitched to fill a perceived gap beneath the threshold of armed aggression.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildA European Security Council with Canada, Norway, Ukraine, and the UK
Von der Leyen also proposed creating a new political forum focused on continental security that would include non-EU partners such as Canada, Norway, Ukraine and the United Kingdom. She said the bloc will "set out our ideas to make a European Security Council (ESC) a reality."
The idea is not new: the concept has been floated before, including as a Franco‑German initiative that failed to gain traction because of disagreements over structure, membership and whether to create a formal body. Luigi Scazzieri, senior policy analyst at the European Union Institute for Security Studies, told Breaking Defense that the model currently envisioned is an "inclusive and informal model" — regular, dedicated meetings of the European Council with partners invited to participate — and that the ESC would be designed to complement NATO by focusing on different topics than military planning or operational command.
Canada, associate membership and defense‑industrial implications
In Milan von der Leyen singled out Canada and its prime minister, Mark Carney, who was in attendance. She said she would like to "work with you on opening the door for Canada to be the first associate member of the EU." The speech noted that this step could have potential defense industrial implications, given Carney’s expressed desire to increase trans‑Atlantic ties — while also emphasizing that many questions remain about what associate membership would practically look like.
What this means for technologists, EU policymakers, and non‑EU partners
- Technologists and security teams: The protocol’s stated targets — cyberattacks, severed undersea cables, protection of critical infrastructure and drone incursions — suggest technology operators will be directly affected by any predefined response measures such as coordinated sanctions or intelligence‑sharing arrangements.
- EU policymakers and member-state governments: They will need to resolve the protocol’s legal basis, who triggers activation, whether unanimous agreement is required for responses, and what instruments (intelligence sharing, sanctions, operational measures) are on the table.
- Non‑EU partners (Canada, Norway, Ukraine, the UK): The proposed European Security Council and the idea of Canadian associate membership both create pathways for closer political coordination; partners will watch how “inclusive and informal” the ESC model becomes and what role it gives invited states in shaping strategic direction.
Von der Leyen’s proposals were delivered against a backdrop she described as a recent rise in sabotage and aerial incursions: they aim to create new tools for threats that sit below the threshold of armed aggression. But the proposal leaves major questions unresolved — legal authority, decision rules, membership and the precise division of labour with NATO — and those gaps will determine whether the Emergency Security Protocol and a European Security Council remain ideas or become functioning instruments of continental security.
