The Framework on a Joint EU Diplomatic Response to Malicious Cyber Activities states that a country under attack can exercise its “inherent right of individual or collective self-defence” under international law.

“The EU is concerned by the increased ability and willingness of state and non-state actors to pursue their objectives by undertaking malicious cyber activities,” the paper reads.

In a clear signal of governments’ desire to send a strong message, the document explicitly states that a member state can invoke the EU’s mutual defence clause.

Article 42 (7) of the EU Treaty allows a member state to demand “aid and assistance” from its fellow EU governments. "If a member state is the victim of armed aggression on its territory," the article states, "the other member states shall have towards it an obligation of aid and assistance by all the means in their power."

This would trigger bilateral discussions and potential alliances between EU countries, which could go beyond the constraints of common EU foreign policy. The limits of what “aid and assistance” could represent is vague and is purposefully left up to individual governments to decide between themselves.

The mutual defence clause was invoked for the first and only time by France after the Paris terror attacks in 2015. EU defence ministers agreed unanimously to provide France with military assistance.

The EU itself cannot wage war but the paper warns it could provide support to any member state or coalition of member states reacting lawfully to a cyberattack. Such responses can range from diplomatic steps to “the use of stronger individual or cooperative responses.”

EU support to such action can range from public condemnation, diplomatic pressure and sanctions, including economic measures, arms embargoes and travel bans.

“This will make an attacker weigh the consequences of a cyber attack more carefully,” said one EU source, “and setting out the steps in a formal document shows we are serious.”

The EU move comes after NATO said in June that an Article 5 response was possible if a cyber attack met the international legal definition of an act of war.

Article 5 obliges NATO countries to treat an attack on one member as an attack on all members. Most but not all EU member states are members of NATO.