EUCC

No changes recorded yet — we are watching, and nothing has been published.

1. 2027-12-31 in 417 days Last day certificates may be issued against the older Common Criteria 3.1 / ISO/IEC 15408:2008 standards (Article 3(2), as amended)
2. 2025-12-29 Amending Implementing Regulation (EU) 2025/2462 enters into force
3. 2025-02-27 The EUCC scheme applies
4. 2025-01-08 Amending Implementing Regulation (EU) 2024/3144 enters into force
5. 2024-02-27 Implementing Regulation (EU) 2024/482 enters into force; its Chapter IV and Annex V apply from this date

1. 2025-12-08
   Implementing Regulation (EU) 2024/482 as amended by (EU) 2025/2462 AmendmentCurrent text

   Amends the scheme as regards definitions, certification of ICT product series, assurance continuity and state-of-the-art documents, and replaces Annexes I to III. source

   More

   • It entered into force on 29 December 2025.
2. 2024-12-18
   Implementing Regulation (EU) 2024/482 as amended by (EU) 2024/3144 Amendment

   Amends the applicable international standards and corrects the original text, with a transition for older Common Criteria versions. source

   More

   • Until 31 December 2027 certificates may still be issued using ISO/IEC 15408:2008/2009, Common Criteria 3.1 revision 5, ISO/IEC 18045:2008 or CEM 3.1 revision 5 (new Article 3(2)).
   • Notification of conformity assessment bodies moves to the horizontal Implementing Regulation (EU) 2024/3143, and Articles 23 and 24 are deleted.
   • It entered into force on 8 January 2025.
3. 2024-01-31
   Implementing Regulation (EU) 2024/482 Major version

   Adopts the European Common Criteria-based cybersecurity certification scheme (EUCC), published in the Official Journal on 7 February 2024. source

   More

   • It entered into force on 27 February 2024 and has applied since 27 February 2025.

EUCC is a voluntary EU-wide certificate for ICT products and protection profiles, based on the Common Criteria.

Scope

All ICT products, including their documentation, submitted for EUCC certification, and protection profiles certified as part of that process (Article 1). source

Voluntary

Cybersecurity certification under the Cybersecurity Act is voluntary unless Union or Member State law specifies otherwise (Cybersecurity Act Article 56(2)). source

Where it can be required

Member States may require NIS2 entities to use ICT products certified under European schemes (NIS2 Article 24). source

National schemes

National certification schemes for ICT products covered by the EUCC cease to produce effects 12 months after the Regulation entered into force (Article 49). source

An accredited certification body issues the certificate after an evaluation by a testing lab, at assurance level "substantial" or "high".

Assurance levels

"Substantial" corresponds to AVA_VAN levels 1-2 and "high" to AVA_VAN levels 3-5 (Article 4). source

Standards

Evaluations apply the Common Criteria (ISO/IEC 15408) and the Common Evaluation Methodology (Article 3, as amended). source source

Certificate validity

Set by the certification body, at most 5 years unless the national cybersecurity certification authority approves longer (Article 12). source

Vulnerability handling

Certificate holders keep vulnerability management procedures, with a public channel for receiving reports and an impact analysis for each potential vulnerability (Article 33). source

Product series

Since the 2025 amendment, a certification body may certify a product series (Article 5(3), as amended). source

National cybersecurity certification authorities audit certificate holders and certification bodies and apply national penalties.

Supervisory powers

They can request information, audit, access premises, withdraw non-compliant certificates and impose penalties under national law (Cybersecurity Act Article 58(8)). source

Penalties

Member States lay down penalties for infringements of the certification framework and its schemes; no EU fine amounts are set (Cybersecurity Act Article 65). source

1. Law text Implementing Regulation (EU) 2024/482 (EUCC scheme)
2. Law text Implementing Regulation (EU) 2024/3144 - applicable standards and corrections
3. Law text Implementing Regulation (EU) 2025/2462 - product series, assurance continuity, state-of-the-art documents
4. Guidance EU cybersecurity certification framework (ENISA)

1. ISO 15408

   The Common Criteria standard itself; EUCC is the EU legal scheme that certifies against it with EU-wide recognition.

2. EU Cybersecurity Act

   The parent regulation that creates the EU certification framework under which EUCC was adopted.

3. CRA

   Makes cybersecurity mandatory for products with digital elements; European certification schemes are one route to show CRA conformity.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 18 September 2026. Subscribe to EUCC (RSS)