European Union Agency for Cybersecurity and EU cybersecurity certification framework – evaluation

European Commission · Have your Say · Initiative 13919

Evaluation of ENISA and the European Cybersecurity Certification Framework under Regulation (EU) 2019/881 – Report COM(2026)9 · Statement of October 28, 2026

Core statement: The evaluation confirms what the figures show: the certification framework works where certification already existed, and stalls where it is meant to have an effect. 28 of 30 EUCC certificates re-certify what was already certified. The framework therefore needs three corrections: demand instead of mere supply (public procurement as the engine of certificates), an origin yardstick instead of technical blindness (geopolitical dependency as a certification criterion), and continuous review instead of a one-time attestation (measurement outside the manipulable area, event-driven and sampling-based).

What the evaluation finds

Report COM(2026)9 of 20 January 2026 assesses ENISA and the European Cybersecurity Certification Framework (ECCF) under Regulation (EU) 2019/881: ENISA largely fulfils its mandate – its relevance and cooperation work are undisputed, with room for improvement in resources and operational focus. The ECCF only partially meets its objectives: EUCC (Common Criteria) is the only adopted scheme; EUCS (cloud), 5G, wallets and managed security services have been in development for years. The uptake figures are sobering: since the launch of EUCC on 2 April 2025, only 30 certificates have been issued, 28 of them re-certifications of products already certified under CCRA, only 2 genuinely new. Since February 2026, SOG-IS has been retired – all new Common Criteria certificates must comply with EUCC.

Recognition: testing capacity in European hands

GISAD acknowledges three things. First, the testing infrastructure is concentrated in Europe: 53% of the world’s Common Criteria laboratories, 24 ITSEF testing laboratories and 14 certification bodies under EUCC, plus the transition from SOG-IS to EUCC as a single European scheme. Testing capacity is sovereignty: whoever tests the products shapes the standard. Second, FiTCEM (EN 17640) creates an affordable conformity route for SMEs – participation in the certification system must not depend on corporate size. Third, ENISA has taken on operational responsibility with the Single Reporting Platform of the Cyber Resilience Act – the reporting works, and that is no small thing.

Criticism 1: certificates without demand move in circles

A voluntary certificate that attracts only re-certifications of already certified products swaps labels, not security states. The bottleneck is not the supply of schemes but the demand: without anchor customers, nothing moves. The public sector is the only actor that can set demand reliably – procurement requirements that call for EU-certified products are the missing engine of the framework. The evaluation recommends realistic timelines for schemes; GISAD adds: binding procurement timelines for demand.

Criticism 2: the framework certifies technology, not dependency

The evaluation debate names it itself: non-technical supply chain risks – geopolitical dependencies – remain outside the ECCF. A cloud certificate that examines the technology but ignores ownership and operator relations certifies hyperscaler infrastructure under CLOUD Act jurisdiction as „European secure“. EUCS, unfinished for years, will be decided precisely on this question. GISAD: the origin yardstick belongs in the certificate – owner, operator, legal order of the core systems (Stage-B criterion). A certificate without an origin yardstick is a transit permit for the very dependency the framework claims to dismantle.

Criticism 3: the one-time attestation and the role of the manufacturer

Certification is a snapshot: examined on the cut-off date, issued by the laboratory, paid for by the manufacturer. The security reality between certificates – incidents, updates, modifications – remains invisible. The model the EU-D-S provides for the review of living systems is concept fidelity: event-driven and sampling-based instead of permanent, measured outside the manipulable area by a read-only, independent review layer. For the ECCF this means: re-certification triggers for security-relevant changes, sampling during live operation, zero tolerance for unreported security-relevant modifications. Whoever commissions and pays for the review must not remain its only yardstick.

Criticism 4: roles are growing together

ENISA develops schemes, coordinates certification and, with the Single Reporting Platform, increasingly operates infrastructure itself. The evaluation’s proposal to expand the mandate is right – but only with separation of roles: whoever operates does not review itself; whoever admits does not measure its own practice. The AI Office has just demonstrated this concentration (Union sandbox plus enforcement in one hand); ENISA should take the opposite path and couple every new operational responsibility with an independent review layer.

GISAD’s recommendations

1. Procurement as the engine of certificates: EU-wide procurement requirements for EU-certified products in critical sectors – the public sector as the anchor customer of the ECCF.
2. Origin yardstick in the schemes: ownership, operator and legal-order information as a certificate component (Stage-B criterion), in particular in EUCS; no „European secure“ without European control.
3. From snapshot to concept fidelity: re-certification triggers for security-relevant changes, sampling-based review in live operation, an independent read-only review layer – measurement outside the manipulable area.
4. Expand the SME route: the FiTCEM logic as standard, not as a special path; certification costs as a question of participation – the framework must not be the certificate of the large.
5. Expansion of the ENISA mandate only with separation of roles: couple operational responsibility (SRP) and assessment tasks separately; realistic, binding timelines for EUCS and the outstanding schemes.