We are delighted to unveil the first edition of GT European Space and Satellite Law Report, new quarterly newsletter dedicated to the most significant legal, regulatory, and commercial development
EU Regulatory Initiatives Reflect a Growing Focus on Space Infrastructure Resilience
Over the past few years, the European Union’s view of the space sector has evolved. Spaceinfrastructure is no longer seen only as a driver of innovation, scientific progress, orcommercial opportunity. Increasingly, it is being treated as critical digital infrastructure thatunderpins communications, navigation, Earth observation, financial services, defencecapabilities, and the functioning of modern economies. This shift is reflected across a growing body of EU legislation and policy initiatives.Cybersecurity, resilience, sustainability, and strategic autonomy have become recurringthemes in European space regulation.
Opening note
EU Regulatory Initiatives Reflect a Growing Focus on Space Infrastructure Resilience
Over the past few years, the European Union’s view of the space sector has evolved. Space infrastructure is no longer seen only as a driver of innovation, scientific progress, or commercial opportunity. Increasingly, it is being treated as critical digital infrastructure that underpins communications, navigation, Earth observation, financial services, defence capabilities, and the functioning of modern economies.
This shift is reflected across a growing body of EU legislation and policy initiatives. Cybersecurity, resilience, sustainability, and strategic autonomy have become recurring themes in European space regulation. In particular:
· The proposed EU Space Act would build an EU market-access gate around safety, resilience, and sustainability, reaching operators well beyond the EU’s borders (see Regulatory Spotlight).
· The Cyber Resilience Act is beginning to reach space hardware and software (see Cybersecurity Corner).
· The EU Space Act is designed to sit alongside NIS2 and CER, not replace them – layering a sector-specific resilience baseline on top of the horizontal framework (see Compliance Stack).
For EU and non-EU operators alike, compliance is becoming multi-layered and cumulative. Understanding which instruments are already in force, which are still proposals, and how they interact is now part of doing business in European space.
We close with a look at the European Union space market (see EU Market Watch) and Poland’s emergence as one of the continent’s notable space markets (see Poland Spotlight).
2. Regulatory Spotlight
2.1. Why the EU Space Act Matters to Non-EU Space Companies
For non-EU space companies, exposure to the EU Space Act (the Act or the Regulation) turns not on where they are incorporated, but on whether they provide space services or space-based data that are used or supplied in the EU. The Act builds an EU-market access gate: registration and certification may become the practical condition for supplying space services or space-based data into Europe.
The proposed EU Space Act is structured around three key pillars:
· Safety. Tracking space objects, mitigating space debris, and preserving Europe’s secure and uninterrupted access to space.
· Resilience. New cybersecurity and risk assessment requirements.
· Sustainability. Assessment and reduction of environmental impact.
The draft EU Space Act is still at the proposal stage. If adopted in its current form, it will apply from 1 January 2030. However, assets launched before that date are excluded from the Regulation’s scope.
Why the Regulation Will Reach Non-EU Companies
The Regulation applies to space service providers regardless of place of establishment if the space-based data or space services are provided in the EU. Such provision is treated as demonstrating a substantial connection to the internal market. According to the proposal, the objective is to avoid competitive differences between operators subject to the Regulation and those outside its scope. Accordingly, third-country space operators will be required to register in the Union Register of Space Objects (URSO) and obtain an e-certificate.
Which Non-EU Companies Are Caught
The table below provides a non-exhaustive list of space service providers and their equivalents under the EU Space Act.
Your Service in the EU | Covered by the EU Space Act? | How Is It Included? |
Satellite operators | YES | “Spacecraft operator” (the EU Space Act uses “spacecraft,” a broad term that includes “satellite.”) |
EO / space-based data providers | YES | No standalone category. Classification depends on role – “spacecraft operator” if you run the satellite, or “primary provider of space-based data” if you perform first processing of observation data. |
Launch providers | YES | “Launch operator,” and possibly “launch site operator.” |
ISOS | YES | “ISOS provider.” |
D2D | YES | No dedicated category. If an entity that is an electronic communications network and services provider acts as a user of a facility offered by a space operator, it will qualify only as a primary provider of space-based data under the EU Space Act. If it also operates or controls a satellite, a launch or a launch infrastructure, it will qualify as a space operator under the EU Space Act. |
What Compliance Looks Like for Third-Country Space Operators
The following are the main obligations for third-country space operators. The precise list varies based on the service provided.
· Market-access conditions: Registration in the URSO and acquiring an e-certificate.
· EU legal representative: Third-country space operators must designate, in writing, one or more legal persons in a Member State to act as their EU representative, with the powers and resources to engage with the authorities, the Commission, and the Agency.
· Substantive obligations: The same requirements as EU operators, including: trackability, mandatory collision-avoidance subscription, debris and end-of-life requirements, resilience, and environmental footprint.
· Ongoing supervision: Registration can be suspended or withdrawn.
Potential Compliance Pathways for Third-Country Space Operators
There are potential compliance pathways for third-country space operators, including:
· The Commission may adopt an equivalence decision for a third country. Space operators from that country would be presumed to comply with certain EU Space Act requirements.
· The EU may conclude cooperation or mutual-recognition agreements with third countries.
· Limited public-interest derogations may be available for third-country launch operators, with a parallel derogation for the EU operator using them.
3. Cybersecurity Corner
3.1. The Cyber Resilience Act Meets Space Hardware and Software
The Cyber Resilience Act: An Overview
Cybersecurity has been a focal point for regulatory activity in recent years. As part of its digital strategy, the European Commission has formulated a number of legislative instruments intended to safeguard cybersecurity across the EU. One such instrument is the Cyber Resilience Act (CRA). It is the first horizontal EU regulatory framework prescribing cybersecurity requirements for hardware and software “with digital elements” made available on the internal market. As a regulation, it is directly and automatically applicable across the EU.
The CRA applies to manufacturers, importers, and distributors placing products with digital elements on the EU market. In practice, this covers almost any hardware or software that connects, directly or indirectly, to another device or network. This approach produces a broad scope, covering everything from consumer devices to industrial software components and standalone applications. The precise obligations placed on an entity, however, depend on its position within the supply chain.
Manufacturers carry the most obligations: building security into products from the design stage, handling vulnerabilities throughout the support period, providing free security updates, ensuring CE marking and an EU declaration of conformity, and actively reporting exploited vulnerabilities and severe incidents to the national CSIRT and ENISA within strict timeframes – a 24-hour early warning, a 72-hour full report, and a final report once resolved. Importers and distributors carry verification duties. Penalties are steep, with fines for non-compliance with the reporting obligation reaching up to EUR 15,000,000 or up to 2.5% of annual worldwide turnover, whichever is higher.
Although the CRA will fully apply from 11 December 2027, its incident reporting obligations for manufacturers come into force on 11 September 2026. Entities that may fall under this definition should implement appropriate reporting policies and procedures.
The Space Sector and the CRA
Due to its broad scope, many participants in the space industry are already subject to the CRA. Space companies place numerous products on the internal market, ranging from ground station equipment and onboard hardware components to connected software platforms and network infrastructure. Entities involved in the manufacture, import, or distribution of such products have obligations under the Act. That said, the CRA’s market-placement trigger means that it does not reach all space infrastructure.
Space infrastructure operates based on global interconnectedness, creating situations where a product in the supply chain may fall outside the CRA’s scope. Such a gap could constitute a cybersecurity weakness. The proposed EU Space Act is intended to close the regulatory gap by establishing cybersecurity standards specific to the space sector.
How the Proposed EU Space Act Extends the CRA
The CRA’s reach and obligations are tied to the market placement trigger. The proposed EU Space Act has been drafted to extend cybersecurity standards to space assets and actors that fall outside this scope. The following are instances in which the proposed Act would accomplish that extension:
Spacecraft security. Although the CRA imposes obligations on spacecraft components placed on the internal market, non-PECN/PECS spacecraft are not regulated. Components launched outside the EU also fall outside the CRA’s scope. The proposed EU Space Act aims to regulate this gap.
Supply chain. The CRA imposes product-security requirements on products within its scope, yet the space supply chain extends well beyond the finished products placed on the market. The specific risks arising across space supply chains are, moreover, not fully addressed. The proposed EU Space Act seeks to fill this gap through additional, tailored measures.
Ground segment. Although the CRA covers ground-segment equipment entering the internal market, non-PECN/PECS ground operators remain unregulated, as do operators established outside the EU and products not placed on the internal market. The proposed EU Space Act aims to address this gap.
Launchers and spacecraft. The CRA reaches spacecraft and ground-segment equipment placed on the internal market, but leaves spacecraft not placed on that market unregulated. Launch infrastructure beyond the market-placement trigger similarly falls outside its scope. Bridging this gap is one purpose of the proposed EU Space Act.
Governance and licensing. The CRA attaches cybersecurity requirements through notified bodies and conformity assessment under the New Legislative Framework, but these are not tailored to the space authorisation and governance framework. The CRA also does not address the link between cyber-resilience obligations and space licensing. The proposed EU Space Act is designed to address this gap.
Incident reporting. The CRA covers incidents affecting product security and actively exploited vulnerabilities, but space products falling outside its scope are not regulated, and no reporting obligations attach to them under the CRA. The proposed EU Space Act aims to close this gap while leaving the existing CRA reporting mechanism in place.
The proposed EU Space Act represents a further step by the European Commission toward implementing cohesive cybersecurity standards across the EU and its sectors, introducing cybersecurity requirements and obligations for entities involved in the space sector.
4. Compliance Stack
4.1. Why Europe Needs the EU Space Act Despite NIS2 and CER
The EU legislative framework aims to create a cyber-resilient environment across critical sectors of the economy. To achieve this, the EU has adopted legislation designed to strengthen both cybersecurity and physical resilience. The cornerstone of this framework consists of the NIS2 Directive,[1] which focuses on cybersecurity, and the CER Directive,[2] which addresses the resilience of critical entities against physical threats. In addition, the EU is developing sector-specific regulatory regimes tailored to individual industries, such as the proposed EU Space Act[3] for the space sector. As explained in our July 2025 GT Alert, The EU Space Act: ‘Foreign’ Space Service Providers, Equivalence, and Registration, the EU Space Act reaches operators providing data or services into the EU.
What the NIS2 and CER Directives Are
As covered in prior GT Alerts, the NIS2 Directive is a horizontal EU directive establishing a high common level of cybersecurity across the EU. It imposes cybersecurity risk-management and incident reporting obligations on “essential” and “important entities” in designated sectors. The space sector is only partially covered: the directive primarily reaches ground-segment operators and providers of electronic communications networks and services, but not all space operators.
The CER Directive is an EU directive addressing the physical resilience of critical entities – against non-cyber threats such as natural disasters, physical attacks, and sabotage. It imposes risk-assessment and resilience-measure obligations on entities designated by Member States as “critical entities.” In the space sector, it covers operators of ground-based infrastructure listed in the annex to the directive – but only where a Member State identifies them as critical entities.
Both NIS2 and the CER Directive are directives rather than regulations, and therefore do not apply directly within Member States. Instead, they establish harmonised requirements that must be transposed into national law by each Member State. While this approach promotes a common baseline across the EU, it may result in divergences in implementation and enforcement between jurisdictions.
The Gaps Left by NIS2 and the CER Directive
While NIS2 and the CER Directive provide an important baseline for cyber and physical resilience, they were not designed specifically for the space sector. Several regulatory and operational gaps therefore remain. The proposed EU Space Act seeks to fill those gaps through a dedicated resilience framework tailored to space activities and services. The table below identifies gaps in the NIS2/CER Directive framework and how the EU Space Act addresses them.
Aspect | What NIS2 / CER Directive Cover | Gap Addressed by the EU Space Act |
Space and link segments | NIS2 and the CER Directive focus on the ground segment. The space segment and link segment are not comprehensively covered. | The EU Space Act covers all segments coherently – ground, space, and links, including systems and subsystems. |
Union-owned assets | Neither NIS2 nor the CER Directive covers Union-owned assets operating under the Union Space Programme. | The EU Space Act closes this gap, covering Union-owned as well as national governmental and non-governmental assets. |
Full range of operators | NIS2 mainly captures medium and large entities. Smaller operators, research and education institutions, and certain non-PECN/PECS spacecraft fall outside its scope. | The EU Space Act extends coverage to small operators, research and education institutions, Earth observation, SSA, and non-EU launchers. |
Space-tailored baseline | NIS2 sets generic rules, not tailored to space needs. | The EU Space Act establishes a dedicated resilience baseline for the sector, as lex specialis to Article 21 of the NIS2 Directive.[4] |
Uneven protection: EU vs. national assets | Asymmetry exists between Union-owned and national assets. | The EU Space Act closes the gap between the resilience levels of EU-owned and Member State assets. |
Safety/debris/ trackability/ sustainability | Outside the scope of NIS2 and the CER Directive. |
How the EU Space Act Fits In Lex specialis for Article 21 of the NIS2 Directive. In relation to space operators qualifying as essential or important entities under NIS2 for space activities and space services covered by the EU Space Act, the Act will be considered a sector-specific EU legal act.
Complementary to the CER Directive. The EU Space Act will complement the CER Directive where space operators are identified as critical entities in accordance with the CER Directive.
Incident reporting obligations. The proposed EU Space Act does not replace or supersede the incident reporting mechanisms established under NIS2 and the CER Directive. Reporting obligations under those frameworks remain applicable to entities within their respective scope. The EU Space Act introduces an additional reporting regime for incidents affecting union-owned space assets.
Coherence with the EU resilience framework. The proposed EU Space Act is intended to operate alongside existing resilience frameworks, in a manner similar to the relationship between the CER Directive and sector-specific legislation. In doing so, it seeks to preserve the integrity of the supervisory and enforcement powers already conferred on competent authorities under the NIS2 and CER Directives. The regulation is therefore designed to complement, rather than replace or diminish, existing national oversight mechanisms.
Impact on Space Operators
For both EU and non-EU companies seeking to provide activities or space services within the EU market, compliance with the EU’s evolving cybersecurity and resilience framework is paramount. This framework is complex and continues to develop. Organizations should seek to understand:
· Which EU legal instruments are already in force;
· Which rules apply directly and which require implementation through national legislation;
· The specific requirements adopted by individual Member States; and
· Which legislative proposals are currently under discussion, and how and when to prepare for their future implementation.
The entry into force of the EU Space Act will not eliminate the need to comply with other EU cybersecurity and resilience legislation. The EU Space Act is designed to complement existing frameworks, including NIS2 and the CER Directive, by introducing sector-specific requirements for the space sector while preserving the application of broader cybersecurity and resilience obligations.
5. EU Market Watch
Having outlined the evolving legal and regulatory framework, we now turn to the market developments that are shaping Europe’s space economy in practice. The sector is entering a new phase in which public policy, strategic investment, and private capital increasingly converge around sovereign capabilities, resilient infrastructure, and commercially scalable technologies. The transactions and projects highlighted below illustrate where momentum is building – from Earth observation and launch services to in-orbit operations and secure satellite connectivity – and provide early indicators of the technologies, operators, and business models likely to influence the next stage of the European market.EU investment in ICEYE. On 5 August 2026, the European Commission’s Scaleup Europe fund announced its first investment in ICEYE: 450 million EUR (519.9 million USD) at a valuation exceeding 10 billion EUR (11.5 billion USD).
ICEYE is a Finnish provider of sovereign space intelligence. with a strong European footprint, operating in Poland, Spain, and Greece, with established entities in Germany and Portugal.
5.1 Isar Aerospace Funding
On 9 June 2026, the Munich-based launch company Isar Aerospace closed a 270 million EUR (311 million USD) Series D round, led by new investors Island Green Capital and Molten Ventures, with participation from existing backers HV Capital, Lakestar, and UVC Partners, alongside co-investor KfW Capital. The round drew substantial contributions from European stakeholders and will fund global scaling and the ramp-up of serial production of the company’s Spectrum launch vehicle.
Isar Aerospace designs, manufactures, and tests its launch vehicles largely in-house at its Parsdorf facility near Munich. Founded in 2018, the company operates across five international locations and is expanding its launch network: following its launch complex at Andøya, Norway, it signed a letter of intent with Maritime Launch Services to add Spaceport Nova Scotia in Canada. The funding round preceded the company’s qualification flight, “Onward and Upward,” with a launch window from 15 to 21 June.
5.2 Creotech Astral Project
Creotech Instruments S.A., a Polish space mission integrator listed on the Warsaw Stock Exchange, has been selected by Orbit Fab to participate in the ASTRAL project, a European in-orbit satellite refuelling demonstration carried out in cooperation with the European Space Agency (ESA). Creotech will supply two of its HyperSat platforms, which will form the basis of a Servicer spacecraft and a Target spacecraft designed to demonstrate autonomous docking and fuel transfer in orbit. The two spacecraft will be deployed as an integrated stack and, once in their target orbit, will conduct a series of docking, undocking, approach, and refuelling experiments. The mission is scheduled for 2028–2029.
Creotech is carrying out the first phase of the project, valued at approximately 250,000 EUR, over an eight-month scope focused on system documentation for both platforms. ASTRAL is led by Orbit Fab as mission integrator and delivered by an international consortium spanning the United Kingdom, Austria, Lithuania, and Poland. The project extends Creotech’s work in in-orbit servicing, building on its work on the InSPoC-1 and RAVEN missions and its lead roles in the MikroGlob, CAMILA, and PIAST programmes.
5.3 HispaSat Named Prime Contractor for IRIS² Ground Segment
On 7 August 2026, the European Commission and ESA concluded negotiations with the SpaceRISE consortium, comprising operators Eutelsat (France), HispaSat (Spain), and SES (Luxembourg), to launch the IRIS² secure satellite communications constellation, and designated HispaSat as prime contractor for the ground segment, a system valued at more than 1.6 billion EUR. The ground segment covers the antenna infrastructure, control systems, and ground-network connectivity for the entire constellation. HispaSat will be the first Spanish company to hold a lead role in the consortium managing a major European space project.
HispaSat, which operates under the Indra Space umbrella, is one of Europe’s satellite operators. Beyond the ground segment, it will lead development of the constellation’s very low Earth orbit layer (below 750 km) and has committed up to 600 million EUR (693 million USD) in exchange for exploitation rights in orbits of high strategic and commercial value. IRIS² is a public-private partnership with a total planned investment exceeding 15.6 billion EUR, comprising 342 satellites (330 in LEO and 12 in MEO), with first launches scheduled for 2029 and initial services from 2030.
6. Poland Spotlight – Recent Growth and Investment Activity in Poland’s Space Sector
Poland’s space sector is moving beyond its earlier role as a specialist supplier and is increasingly becoming a market in which strategic infrastructure, public capital and commercially scalable technologies come together. The scale and pace of recent commitments – spanning secure satellite communications, civil-security capabilities, Earth observation, advanced payloads, and dedicated investment instruments – point to a more mature and execution-focused ecosystem. This creates opportunities not only for Polish technology companies, but also for international operators, investors and industrial partners seeking access to European programmes, institutional customers and the wider Central and Eastern European market. The developments highlighted below illustrate how Poland is building the funding base, infrastructure and operational relevance required to become a significant European space hub.
6.1 ESA to Establish Civil Security and Crisis Management Centre in Warsaw
On 13 July 2026, the ESA and the Republic of Poland announced that a new ESA centre for civil security and crisis management would be established in Warsaw, supporting the development of European capabilities in these areas. The announcement was made at a joint press conference in Warsaw attended by ESA Director General Josef Aschbacher, Prime Minister Donald Tusk, and Minister of Finance and Economy Andrzej Domański. The centre will support the Agency’s activities in security and crisis management and will operationally complement ESA’s other centres across Europe, including the European Space Security and Education Centre (ESEC) in Belgium.
The announcement follows a letter of intent signed between ESA and Poland in November 2025 at the ESA Council meeting at ministerial level (CM25) in Bremen, which initiated joint work on establishing the centre and led to the creation of a joint ESA-Poland task force to define its objectives, scope, and implementation framework.
6.2 Poland's Role in IRIS²
Poland has committed 656 million EUR (757.7 million USD) to the IRIS² programme, becoming one of its principal national contributors alongside Hungary and, on the industrial side, Spain through HispaSat. As part of the investment, Poland will host a system ground station and a command centre connected directly to the government fibre-optic network GovNet, giving the country a permanent operational role in the constellation’s infrastructure. The agreement, which concludes negotiations ongoing since January, also expands the main constellation by 66 additional low Earth orbit satellites intended to strengthen the system’s resilience and its capabilities for defence, security, and emergency services.
6.3 Scanway and KP Labs Begin ScyLab Project for ESA
Scanway S.A. and KP Labs Sp. z o.o. have begun work on the ScyLab project for ESA, under which the companies will develop a solution combining a telescope operating in the short-wave infrared range (SWIR) with a Data Processing Unit (DPU). The 18-month project is led by KP Labs and is expected to result in an engineering model of the system, which both companies will jointly test to verify its observational and operational parameters. The contract value attributable to Scanway amounts to 815,000 EUR, with full settlement expected by end of 2027.
6.4 Thorium Space Raises Nearly 34 Million Zloty (9.1 Million USD) and Advances SATCOM Programmes
Thorium Space, a Polish provider of secure satellite communications technology, raised nearly 34 million zloty across two public offerings in the first half of 2026: 11.7 million zloty (3.1 million USD) from a series H rights issue in April and 22 million zloty (5.9 million) from a series I offering in June, conducted as a pre-IPO ahead of a planned NewConnect debut. The proceeds will fund commercialisation of the company’s SATCOM technology and development of its own integrated circuits. In May 2026, the company adopted a 2026 to 2036 strategy to build its position as a European technology supplier for the secure SATCOM market and entered a cooperation and share-option agreement with Creotech Instruments covering satellite communication systems for commercial, institutional, and defence customers.
Thorium Space is currently running six technology projects and reported progress in three during the first half of the year. In HummingSat, carried out with ESA and Switzerland's SWISSto12, the company is responsible for mission requirements and the design of a flexible digital communications payload. ESA accepted its test readiness review, and the current phase is due to close in November 2026. In T-XPDR, co-financed under NCBR’s SZAFIR program, engineers completed the second stage of work on a Ka-band adaptive satellite transponder demonstrator for tactical satellite communications. In SUBCOM, co-financed from FENG, the company completed production and functional testing of a communications and tracking system for the ILR-33 Bursztyn 2K suborbital rocket and carried out an initial integration with the vehicle.
6.5 Katowice Plans Space Technology Centre
On 3 August 2026, Minister of Finance and Economy Andrzej Domański announced that a local-government special-purpose vehicle will be created to prepare a feasibility study for a space technology centre at the site of the Wujek coal mine in Katowice, which is currently being decommissioned. The company will be established by the regional and municipal authorities, Katowice, the Silesian Voivodeship, and the Upper Silesian-Zagłębie Metropolis, with the feasibility study among its most urgent tasks. The State Treasury is not joining the vehicle at this stage. Domański stated that the government views the project favourably and considers it a business initiative intended to contribute to economic growth in Poland.
6.6 Poland to Launch 500 Million Zloty (134.2 Million USD) Fund for the Space Sector
On 3 August 2026, Minister of Finance and Economy Andrzej Domański set out details of a 500 million zloty (134.2 million USD) fund to invest in Polish space-sector companies, to be established by companies of the Polish Development Fund (PFR) group, in particular Bank Gospodarstwa Krajowego (BGK). According to BGK, the fund will finance research, development of new technologies, startups, spin-offs, and first industrial deployments, targeting high risk technological ventures to accelerate commercialisation of solutions developed in Poland. Domański also announced that BGK will launch a separate financing line for local governments, offering, for the first time, financing over a 50-year term with attractive repayment conditions, including flexible schedules and the possibility of multi-year grace periods, to fund large-scale infrastructure such as technology centres, research laboratories, industrial parks, and data infrastructure.
[1] Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS2 Directive).
[2] Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC.
[3] Proposal for a Regulation of the European Parliament and of the Council on the safety, resilience and sustainability of space activities in the Union.
[4] Article 21 NIS2 is the provision that sets out the core cybersecurity risk-management obligations for essential and important entities (risk analysis, incident handling, business continuity, supply-chain security, encryption, and similar). Because these are generic, cross-sector rules, the EU Space Act is intended to displace them with a space-tailored baseline
[5] Life Cycle Assessment.
[6] Product Environmental Footprint Category Rules.
Comments