EU Cybersecurity Act

Nothing changed in the last 90 days. Sign in to read further back.

1. 2026-01-20 Commission proposes the Cybersecurity Act 2, COM(2026) 11, to replace the Act
2. 2025-02-27 The first scheme under the Act, EUCC, starts to apply
3. 2025-02-04 Amendment on managed security services, Regulation (EU) 2025/37, enters into force
4. 2024-01-31 Commission adopts the EUCC scheme, Implementing Regulation (EU) 2024/482

1. 2026-01-20
   Cybersecurity Act 2 proposal, COM(2026) 11 Draft

   Commission proposal for a new regulation on ENISA, the certification framework and ICT supply chain security that would repeal Regulation (EU) 2019/881. source

   More

   • It adds an ICT supply chain security mechanism, including identification of high-risk suppliers.
   • Not adopted; the European Parliament lists procedure 2026/0011(COD) as awaiting a committee decision, with amendments tabled in committee on 13 October 2026.
2. 2024-12-19
   Regulation (EU) 2019/881 as amended by Regulation (EU) 2025/37 AmendmentCurrent text

   Targeted amendment enabling European cybersecurity certification schemes for managed security services, published in the Official Journal on 15 January 2025. source

   More

   • It entered into force on 4 February 2025.
3. 2019-04-17
   Regulation (EU) 2019/881 Major version

   The Cybersecurity Act on ENISA and ICT cybersecurity certification, published in the Official Journal on 7 June 2019; it repealed Regulation (EU) No 526/2013. source

   More

   • It entered into force on 27 June 2019.

The Act gives ENISA its mandate and creates the EU framework for voluntary cybersecurity certification schemes.

ENISA

Sets ENISA's objectives, tasks and organisation (Article 1(1)(a)); ENISA is established for an indefinite period as of 27 June 2019 (Article 68(4)). source

Certification framework

A framework for European cybersecurity certification schemes for ICT products, ICT services and ICT processes (Article 1(1)(b)), extended to managed security services by Regulation (EU) 2025/37. source source

Voluntary

Certification is voluntary unless Union or Member State law specifies otherwise (Article 56(2)). source

Schemes

ENISA lists EUCC as published; EUCS (cloud), EU5G, EUDI Wallets and EU Managed Security Services (EUMSS) are under development. source

Each scheme sets its assurance levels; certificates come from conformity assessment bodies or national authorities, and a scheme may allow self-assessment at "basic".

Assurance levels

A scheme may specify assurance levels "basic", "substantial" or "high", in line with the risk of the intended use (Article 52(1)). source

Self-assessment

Allowed only for low-risk products, services and processes at assurance level "basic"; the manufacturer issues an EU statement of conformity (Article 53). source

Presumption

Items certified under an adopted scheme are presumed to comply with that scheme's requirements (Article 56(1)). source

National cybersecurity certification authorities supervise certificates and impose the penalties each Member State sets.

Supervisory powers

Request information, audit conformity assessment bodies and certificate holders, access premises, withdraw non-compliant certificates and impose penalties (Article 58(8)). source

Penalties

Member States lay down penalties for infringements of the certification title and of schemes; the Act sets no fine amounts (Article 65). source

1. Law text Regulation (EU) 2019/881 (Cybersecurity Act)
2. Law text Regulation (EU) 2025/37 - managed security services
3. Law text Implementing Regulation (EU) 2024/482 (EUCC scheme)
4. Law text Cybersecurity Act 2 proposal COM(2026) 11 (would repeal the Act; not adopted)
5. Guidance EU cybersecurity certification framework (ENISA)

1. EUCC

   The first scheme adopted under the Act, for ICT products based on the Common Criteria.

2. ENISA

   The agency whose mandate the Act sets; its guidance and publications are tracked separately.

3. Cyber Solidarity Act

   Adopted the same day as the managed security services amendment, whose recitals link certified services to selecting trusted providers for the EU Cybersecurity Reserve.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 7 September 2026. Subscribe to EU Cybersecurity Act (RSS)