EUCC certification scheme (Reg. 2024/482)

Summary

The regulation adopts EUCC, the first European cybersecurity certification scheme under the Cybersecurity Act, based on the Common Criteria (ISO/IEC 15408) and the Common Evaluation Methodology (ISO/IEC 18045). It builds on the SOG-IS mutual recognition agreement and allows ICT products and protection profiles to be certified at assurance levels 'substantial' and 'high', linked to the AVA_VAN vulnerability analysis levels. Self-assessment is not allowed: evaluations are carried out by accredited evaluation facilities (ITSEFs) and certification bodies, which for the 'high' level must also be authorised by the national authority. The regulation governs certificate validity, normally no longer than five years, vulnerability handling and disclosure, compliance monitoring and peer assessments. Since 27 February 2025, national schemes covered by EUCC no longer produce effects.

Information

Jurisdiction

European Union

Issuing body

European Commission

Type

Regulation

Available languages

English, Italian (official translation), French (official translation), Spanish (official translation), German (official translation)

Topics

• Certification
• Supply chain

Notes

Published in the Official Journal of the EU on 7 February 2024 and in force since 27 February 2024; it applies from 27 February 2025, except Chapter IV and Annex V, which have applied since entry into force. It was amended by Implementing Regulation (EU) 2024/3144, which updates the reference international standards to the 2022 versions and allows certificates based on the earlier versions until 31 December 2027, and by Implementing Regulation (EU) 2025/2462 of 8 December 2025, in force since 29 December 2025, on product series certification, assurance continuity and state-of-the-art documents. Implementing Regulation (EU) 2025/2392 under the Cyber Resilience Act uses the EUCC AVA_VAN levels to distinguish certain important and critical products. The proposal to revise the Cybersecurity Act presented by the Commission on 20 January 2026 (COM(2026) 11) also covers the certification framework and is still under discussion.

Related technical standards

• ISO/IEC 15408 (Common Criteria)

European Commission. (2024). Commission Implementing Regulation (EU) 2024/482 laying down rules for the application of Regulation (EU) 2019/881 as regards the adoption of the European Common Criteria-based cybersecurity certification scheme (EUCC) (Implementing Regulation (EU) 2024/482). https://eur-lex.europa.eu/eli/reg_impl/2024/482/oj

European Commission. "Commission Implementing Regulation (EU) 2024/482 laying down rules for the application of Regulation (EU) 2019/881 as regards the adoption of the European Common Criteria-based cybersecurity certification scheme (EUCC)." 31 January 2024. https://eur-lex.europa.eu/eli/reg_impl/2024/482/oj.

@misc{eu_eucc_certification_scheme_2024_482,
  author       = {{European Commission}},
  title        = {{Commission Implementing Regulation (EU) 2024/482 laying down rules for the application of Regulation (EU) 2019/881 as regards the adoption of the European Common Criteria-based cybersecurity certification scheme (EUCC)}},
  year         = {2024},
  note         = {Implementing Regulation (EU) 2024/482},
  url          = {https://eur-lex.europa.eu/eli/reg_impl/2024/482/oj},
  urldate      = {2026-10-29}
}