Bosnia and Herzegovina’s election, held on Sunday (4 October), has reinforced the country’s deep ethnic and political divisions, with nationalist parties retaining a strong grip on power and low turnout underscoring voters’ growing disillusionment with a political system that has long frustrated the country’s ambitions to join the European Union.

Public support for EU membership remains strong. According to a 2026 survey by Bosnia’s directorate for European integration, 74.4 percent of citizens said they would vote for EU membership in a referendum. Even in Republika Srpska, the ethnic Serb component, where support is lower, 54.1 percent said they would back joining the bloc.

And Bosnia became an EU candidate in 2022, but its path towards membership remains stalled.

The European Commission has identified 14 priorities that the country must address before it can move towards opening accession negotiations. So far, it has not opened a single accession-talks chapter and does not have a chief negotiator for EU membership.

Meanwhile, Bosnia’s complicated political system, built around three constituent ethnic groups, continues to hamper the adoption of reforms.

Forgotten elections

The Bosnian nationwide turnout was just 42 percent, reflecting political apathy, but the complexity of its system also means few people in the EU followed what went on.

Instead of a single president, Bosnia and Herzegovina has a tripartite presidency comprising one Bosniak (South Slavic ethnic group), one Croat, and one Serb.

Voters registered in the federation may vote for either the Bosniak or Croat member, but not both. Voters in Republika Srpska elect the Serb member.

From the provisional results, on Sunday, Denis Becirović won a second term as the Bosniak member of the presidency with 38.12 percent.

He is to be joined by Darijana Filipović (46.55 percent) of the Croatian Democratic Union of Bosnia and Herzegovina (HDZ BiH) as the Croat member, and Željka Cvijanović of the Alliance of Independent Social Democrats (SNSD) as the Serb member (55.37 percent).

The Bosnian system excludes citizens who do not identify as Serb, Croat, or Bosnian from standing for the presidency.

And the post-war power sharing agreement includes 14 parliaments and governments in total for the country of some 3.1 million people, making reforms hard to push through.

But amid the complexities, the biggest winner from Sunday’s elections could be Serb nationalist politician Milorad Dodik, while the big loser could be the EU, according to Adi Ćerimagić, a senior analyst on the Western Balkans at the European Stability Initiative think tank.

This article continues, but the full version is available only to EUobserver.com subscribers. Visit account.euobserver.com/membership

Europe is facing more immediate cyber threats, but whether its member states are prepared to deal with it collectively is becoming a question harder to answer.

Even as drone threats, such as Russia’s bomb plot at the Leipzig-Halle airport in Germany in August, dominated European headlines in September, other, less visible hybrid attacks are also being waged against the EU every day, whose sheer weight of numbers should also cause grave concern.

Poland, for instance, recorded 4,200 cyber-security incidents in military networks and systems in 2024 and 7,100 in 2025, Polish cyber command spokesperson, Przemek Lipczyński, told EUobserver.

In 2025, Polish security systems blocked four million phishing emails targeted at soldiers and defence personnel.

And Poland aside, evolving technology meant Russian cyber-attacks “do not know any border”, said Jamila Boutemeur, the EU’s head of cybersecurity body, in what amounted to a single market for hacking.

For its part, the European Union has built its cybersecurity architecture around the Boutemeur’s European Union Agency for Cybersecurity, ENISA, in Athens, as well as the 27 national cybersecurity agencies.

But as Russia’s threat levels up, the European structure is seeing familiar problems: information is not always shared, responsibilities remain divided between national governments and EU institutions, while ENISA itself is being asked to do more with limited resources.

And the European Court of Auditors (ECA) confirmed it on 21 September in its ENISA study.

“The architecture is there, the structure is there. Now it’s a matter of willingness and trust,” to effectively fight back, said George-Marius Hyzler, the ECA’s main auditor.

Stress test shows EU cracks

“It always boils down to the same thing, lack of information sharing,” he said, identifying the EU’s key weakness.

And for Czech Greens MEP Markéta Gregorová, who is also the lead rapporteur on the EU’s incoming Cybersecurity Act 2 (CSA2), duplication of work also bedevilled the EU’s response.

“The [ECA] auditors describe a system that does not work” and was “wasteful”, she told EUobserver.

“Six European legal acts force the same company to report the same incident to different authorities. Two EU bodies monitor the same threats,” Gregorová said.

She also advocated a stronger operational role for ENISA.

But the EU fault lines have underlying political as well as legal tensions.

Cybersecurity remains largely within the competence of the member states, and governments differ in how much new power they are willing to delegate to European institutions.

And for Dimitar Lilkov, from the Wilfried Martens Centre for European Studies, there were three main sources of friction: national security, trust, and money.

This article continues, but the full version is available only to EUobserver.com subscribers. Visit account.euobserver.com/membership