Cyber-Management
EN / FRbook a consultation

EU Cybersecurity Act

EU Cybersecurity Act: when your product needs EU certification.

A buyer or the Cyber Resilience Act asking for certified security? See which route fits.

book a free 25-minute consultation

Does it apply to you?

Does your market ask for certified security?

Certification is voluntary. It becomes worth it when someone you sell to, or another law, asks for it. The exact rules are in the section for your IT manager, below.

  • A public tender asks for EU certificationBuyers can require it where an EU scheme exists. Today that means EUCC, for IT products such as smart cards, network equipment and operating systems.
  • Your product falls under the Cyber Resilience ActFrom 11 December 2027, products with software or a connection need security conformity for the CE marking. EU certification is one way to show it.
  • Customers covered by NIS2 check your securityThey must check their suppliers, and a certificate is strong evidence.
  • You sell cloud servicesAn EU cloud scheme (EUCS) is in development but not adopted. Prepare without over-investing.

What changes for you

A voluntary EU label that the CRA makes more useful.

The EU Cybersecurity Act sets up EU-wide security certification for IT products, services and processes. Schemes are prepared by ENISA, the EU cybersecurity agency, and certify at three levels: basic, substantial and high.

One scheme applies today: EUCC, for IT products, since 27 February 2025. From 11 December 2027 the Cyber Resilience Act makes security a condition of the CE marking, and a European scheme at level substantial or higher is one way to show it.

There are no fines for not certifying. The risk is commercial: tenders and customers that require a certificate. The fix is choosing the right route and level early, because certification takes months.

What to do first

Pick the right route, then prepare the evidence.

What we deliver

  • Which scheme and level fit your product, and whether you need one at all
  • What the Cyber Resilience Act changes for your products, and when
  • Your gaps: the evidence and documentation an evaluator will ask for
  • The file for the evaluation body or the national authority
  • Help choosing the evaluation body

Who does what

We lead the certification work. Your product team keeps the engineering.

What we lead

  • Choose the scheme, the level and the route
  • Rank the gaps and set the plan
  • Prepare the documentation file
  • Coordinate with the evaluation body

What stays with your product team

  • Fix security flaws in the product
  • Provide the technical evidence evaluators test
  • Keep the product documentation up to date

We do not test or change the product: an independent evaluation body tests it.

How it starts

Your first step: find out whether you need certification.

You learn which scheme and level, if any, fit your product and your buyers, and how the Cyber Resilience Act affects it. The rest is sized from that answer, at a fixed fee.

Price
Fixed fee

Fixed quote after the free call.

book a free 25-minute consultation

For your IT manager, DPO or CFO

How rigorous the assessment is.
  1. 01Basic

    Documentation review; self-assessment only where the scheme allows it

    A scheme may allow the vendor's own conformity self-assessment at this level only (CSA Article 53). Typical for consumer IoT, standard software, low-criticality IT services.

  2. 02Substantial

    Independent CAB testing against attack scenarios

    Testing by an independent Conformity Assessment Body (CAB). Typical for professional software, cloud services, business network equipment.

  3. 03High

    National authority or accredited body, stringent methodology

    Most rigorous evaluation. Typical for critical infrastructure, government systems, high-security network equipment.

  4. 04EUCC

    EU Common Criteria scheme (EUCC) — applies since Feb 2025

    Adopted January 2024, applicable since 27 February 2025. Replaces national Common Criteria-based schemes for the ICT products it covers. Substantial and high assurance levels. Based on ISO/IEC 15408.

  5. 05EUCS

    EU Cloud Services scheme — IN DEVELOPMENT

    For IaaS, PaaS, SaaS. Will cover availability, confidentiality, integrity, and portability at all three assurance levels.

  6. 06EU5G

    EU 5G certification — IN DEVELOPMENT

    Certification scheme for 5G network components and technology. Critical-infrastructure focus.

No statutory fines. Market access is the lever.

The Cybersecurity Act itself does not specify direct fines for non-certification — but the consequences of not having certification compound through three mechanisms.

First, public procurement: buyers can require EU certification where a scheme exists — today that means EUCC; the cloud scheme (EUCS) has not been adopted. Second, NIS2 supply chain requirements: NIS2-covered entities push certification down their supply chain as evidence of supplier security. Third, the Cyber Resilience Act: from 11 December 2027, CE marking for products with digital elements is conditional on cybersecurity conformity, and its own fines reach €15M or 2.5% of worldwide turnover. No conformity, no CE mark, no EU market access.

  • CRA CE marking

    11 Dec 2027

    cybersecurity conformity becomes a condition of CE marking for products with digital elements.

  • Public procurement

    Where schemes exist

    tenders can require EU certification; EUCC is adopted, EUCS is not yet.

  • Certification and the CRA

    One route

    to CRA conformity — most products self-assess; class II and critical products use a notified body or an EU scheme.

Typical timeline

Depends on scheme, assurance level, and product maturity.

  1. Weeks

    Basic assurance — well-documented product

    Self-assessment plus documentation pack. Fastest path; suitable for consumer-grade and low-criticality products.

  2. 6–12 months

    Substantial assurance (EUCC) — CAB-led

    For products already documented against the Common Criteria. CAB testing against defined attack scenarios.

  3. 12–24 months

    High assurance — national authority or accredited body

    Most stringent path — for critical infrastructure and high-security products.

FAQ

What product and IT teams ask us about EU cybersecurity certification.

What does the Cybersecurity Act actually contain?
Regulation (EU) 2019/881 has two parts. Part I (Articles 1–11) gives ENISA, the EU Agency for Cybersecurity, a permanent mandate and resources. Part II (Articles 46–68) sets up the EU cybersecurity certification framework for ICT products, services and processes. Certification is voluntary, but a European scheme at assurance level at least substantial is one route to Cyber Resilience Act conformity, and can become the required route for certain critical products if the Commission adopts a delegated act under CRA Article 8(1).
Who does the Cybersecurity Act concern?
ICT vendors and manufacturers (hardware security modules, network equipment, smart cards, operating systems, embedded systems), whose CE marking depends on cybersecurity conformity once the CRA product regime applies; cloud providers, targeted by the planned EUCS scheme; software and SaaS companies selling to public buyers and NIS2-covered customers; critical-infrastructure suppliers (EU5G scheme in development); and suppliers to NIS2-covered entities, who increasingly ask for EU certification as evidence of security.
Does the EU Cybersecurity Act apply to software companies and SaaS providers?
Increasingly, yes — through three pathways. (1) Public procurement bidding where EU/national tenders require certification. (2) NIS2 supply chain pressure from covered customers. (3) From 11 December 2027, CRA-driven CE marking for software products that fall in scope — with the CRA reporting obligation already live since 11 September 2026. Even today, the EUCS scheme (in development) targets cloud and SaaS specifically.
What is EUCC and does it replace national certifications?
EUCC is the EU Common Criteria scheme, adopted in January 2024 and applicable since 27 February 2025, based on ISO/IEC 15408 and ISO/IEC 18045. It covers hardware security modules, operating systems, network equipment, smart cards and similar products at substantial and high assurance levels. For the products it covers, it replaces the national Common Criteria schemes (for example in Germany, Italy and the Netherlands); existing national certificates stay valid until they expire. France's CSPN is a separate first-level national certification — ANSSI presents it as an alternative to Common Criteria evaluations — and continues alongside EUCC.
What is the Cyber Resilience Act and how does it relate?
The Cyber Resilience Act, Regulation (EU) 2024/2847, is a separate regulation, designed to interlock with the Cybersecurity Act. It sets essential cybersecurity requirements for products with digital elements and, from 11 December 2027, makes CE marking conditional on a cybersecurity conformity assessment; its Article 14 reporting obligation has applied since 11 September 2026. A European scheme at assurance level at least substantial is an accepted conformity route; for Annex III class II and Annex IV critical products, the alternative is a notified body.
How does EU cybersecurity certification help with NIS2 compliance?
NIS2 covered entities are required to assess and manage ICT supply chain risk under Article 21(2)(d). They use EU CSA certification as evidence of appropriate security. If your customers are NIS2-covered, expect increasing pressure to hold an applicable certification — even before procurement makes it formal.
How long does certification take and what does it cost?
Time and cost depend heavily on the scheme (EUCC vs EUCS), the assurance level (basic/substantial/high), and the current security maturity of the product or service. Basic-assurance certifications can complete in weeks for a well-documented product. Substantial-assurance EUCC typically runs 6–12 months through a CAB. High-assurance certification can run 12–24 months. Pricing is shared in the proposal after the scoping call.
Does existing ISO 27001 help with Cybersecurity Act certification?
Partly. EUCC evaluates the product against the Common Criteria (ISO/IEC 15408 and 18045); it does not require ISO 27001. An existing ISMS still helps with the documentation, risk assessment and secure-development processes evaluators look at. For cloud services, the EUCS scheme has not been adopted, so its final requirements are not yet known.

Related

The frameworks it works with.

ISO 27001

Useful groundwork — documented processes evaluators look at; not a requirement of EUCC.

Read more

Cyber Resilience Act

The regulation that turns this voluntary framework into a market-access route — a European scheme at assurance level substantial is an accepted CRA conformity path.

Read more

NIS2

Drives demand for supplier certification through Article 21(2)(d) supply-chain obligations.

Read more

Data Governance Act

Adjacent EU digital regulation — both part of the EU digital single-market strategy.

Read more
back to compliance hub