EU Cybersecurity Act and Certification Schemes
The EU Cybersecurity Act (Regulation (EU) 2019/881), or CSA, strengthens the role of ENISA, the European Union Agency for Cybersecurity. It also creates a framework for certifying the cybersecurity of ICT products, services, and processes. The regulation aims to improve cybersecurity across the EU and to create a uniform digital single market.
On January 20, 2026, the European Commission proposed a Cybersecurity Act 2 (COM(2026) 11) that would replace the regulation. Our article on the proposed Cybersecurity Act 2 explains what would change.
Contents
ENISA: the EU Agency for Cybersecurity
The Cybersecurity Act gave ENISA an extended mandate with more resources and new tasks. ENISA's main tasks are:
- Developing and maintaining the European cybersecurity certification framework: ENISA prepares the technical basis for specific certification schemes.
- Informing the public: ENISA informs the public about certification schemes and issued certificates through a dedicated website.
- Supporting the response to cyber incidents: ENISA promotes cooperation at EU level, helps Member States deal with cyber incidents, and coordinates the response to large-scale cross-border cyberattacks and crises.
The European cybersecurity certification framework
The EU's European cybersecurity certification framework aims to build trust in, and security of, information and communication technology (ICT) products, services, and processes. It does this through certification schemes that assess the level of security and the conformity of these products, services, and processes.
The framework standardizes cybersecurity practice across the EU by setting security requirements for ICT products, services, and processes, so that they reach a uniform level of protection. It divides certification into three assurance levels, “basic”, “substantial”, and “high” (Article 52 of the CSA). It also outlines ENISA's role and the mechanisms for compliance with market rules. The framework emphasizes cooperation with stakeholders, is aligned with international standards, and can be adapted as cybersecurity threats change.
What a certification scheme contains
A certification scheme under the Cybersecurity Act is a complete framework intended to ensure the cybersecurity of ICT products, services, and processes. Each scheme usually covers:
Subject matter and scope
Which types of ICT products, services, and processes the scheme covers.
Purpose of the scheme
How the selected standards, evaluation criteria, and assurance levels match the needs of the scheme's users.
References to standards
The international, European, or national standards used for the evaluation.
Assurance levels
Defined assurance levels (“basic”, “substantial”, “high”), based on risk.
Conformity assessment
The specific evaluation criteria and methods used to check the requirements.
Conditions for certificates
The conditions for issuing, maintaining, and renewing certificates.
Monitoring
Rules for monitoring compliance and for handling non-conformities and newly identified vulnerabilities.
By setting these elements, a certification scheme under the CSA provides a structured and reliable approach to certifying the cybersecurity of ICT products, services, and processes. This builds trust and security in the digital market.
How certification schemes are developed
Certification schemes are developed in several steps:
- Request by the European Commission or the Member States: ENISA develops draft certification schemes at the request of the European Commission or the Member States.
- Support from experts: ENISA works closely with experts, ad hoc working groups (AHWGs), and relevant stakeholders to prepare the schemes.
- Public consultation: The draft schemes are published for public consultation.
- Adoption by the EU: After revision and final agreement, the scheme is adopted as an EU legal act (an implementing act).
- Preparation by the Member States: After adoption, the Member States have time to take the measures needed to put the scheme into operation.
ENISA explains the process in more detail on its page on developing certification schemes.
Existing and planned schemes
Several certification schemes have been developed under the Cybersecurity Act or are in development. Each addresses a different area of cybersecurity.
EUCC
The EUCC (European Common Criteria-based cybersecurity certification scheme) is used to certify ICT products such as hardware, software, and components. It builds on the Common Criteria (ISO/IEC 15408).
On January 31, 2024, the European Commission adopted Commission Implementing Regulation (EU) 2024/482, which introduces the scheme. It has applied since February 27, 2025. ENISA provides the supporting documents listed in Annex I of the implementing regulation. The scheme is based on the established SOG-IS framework for Common Criteria evaluations, which was already in use in 17 EU Member States.
ENISA provides more information on the EUCC certification scheme.
EUCS
The EUCS (European Cybersecurity Certification Scheme for Cloud Services) is intended to certify the cybersecurity of cloud services. The first draft was published on December 22, 2020. The scheme has not been adopted to date. The main point of dispute is requirements for independence from providers outside the EU at assurance level “high”. The draft was prepared with the support of an ad hoc working group and the Member States. It is intended to set uniform security requirements for cloud services in the EU.
EU5G
The EU5G (European Cybersecurity Certification Scheme for 5G) is intended to certify the cybersecurity of 5G networks. Its development was originally planned in two phases. The first phase ended in fall 2022, when ENISA, experts, and the European Commission analyzed existing industry assessments and certification schemes. According to ENISA's 2026 work program, the scheme is still being developed, and no draft has been published so far. The scheme will focus on several use cases. These include the provision and deployment of identified 5G network equipment, the management of subscriber identities, remote SIM provisioning, 5G authentication (including roaming), and subscriber connection services.
Artificial intelligence
For artificial intelligence, ENISA is examining whether and how AI systems could be subject to cybersecurity certification. This work is preliminary, because the European Commission has not yet made an official request to develop a certification scheme for AI. The aim is to prepare for a possible integration of AI into the existing certification framework.
Managed security services
Managed security services are central to preventing and responding to cybersecurity threats and incidents. The NIS2 Directive names them as a critical sector, and the Cyber Solidarity Act (Regulation (EU) 2025/38) refers to them. Regulation (EU) 2025/37 amended the Cybersecurity Act so that these services can also be certified. In summer 2026, ENISA put a first draft of the scheme (EUMSS) out for public consultation.
The Cybersecurity Act is the basis for European cybersecurity certification and has effects on other legislation such as NIS2 and the Cyber Resilience Act. If you want to understand what this means for your products, processes, or roadmaps, we can sort it out with you in a no-obligation call.