EUCC (EU Common Criteria cybersecurity certification scheme), explained

Last updated: 2026-10-28

The EUCC (European Common Criteria-based cybersecurity certification scheme) is a voluntary EU-wide certification scheme that lets ICT suppliers run their chips, smartcards, hardware, and software through a single, EU-commonly-understood assessment process instead of a patchwork of national ones. ENISA, the EU Agency for Cybersecurity, drafted it as a candidate scheme starting in 2020; the European Commission adopted it as Commission Implementing Regulation (EU) 2024/482 of 31 January 2024, and it has applied across the EU since 27 February 2025 — the first scheme adopted under the certification framework the Cybersecurity Act (Regulation (EU) 2019/881) established.

Two assurance levels: Substantial and High

ENISA's certification site states plainly that the EUCC "defines two assurance levels: Substantial, High," chosen according to the risk associated with how the product, service, or process will actually be used. The two levels are tied to AVA_VAN, the Common Criteria vulnerability-assessment component family: ENISA states the levels "have been mapped with AVA_VAN, the vulnerability assessment class of the Common Criteria standard." Interestingly, ENISA's broader description of the EU certification framework notes that schemes in general may offer any of three tiers — basic, substantial, or high — which means EUCC's designers deliberately chose to skip the "basic" tier and only certify at the two higher bars.

This guide did not independently verify, against the regulation's own article text this run, the precise mapping between specific AVA_VAN components and Common Criteria Evaluation Assurance Levels (EAL1 through EAL7) that several third-party commentaries describe. Treat any such EAL correspondence you encounter elsewhere as to be confirmed against Regulation (EU) 2024/482 directly before relying on it for a certification decision.

Built on Common Criteria and SOG-IS, not from scratch

EUCC isn't a new evaluation methodology — it formalizes one that already existed. The underlying standard is Common Criteria, also published internationally as ISO/IEC 15408, and ENISA states the EUCC scheme itself "is based on the time-proven SOG-IS Common Criteria evaluation framework already used across 17 EU Member States." SOG-IS (Senior Officials Group Information Systems Security) is the informal multi-country mutual-recognition arrangement that predates EUCC; ENISA's site notes vendors holding an existing national SOG-IS certificate can have it reassessed and converted into an EUCC certificate, rather than starting the evaluation over.

Who actually does the evaluation

Role	Who	What they do
ENISA	EU Cybersecurity Agency	Authored the scheme's technical content; maintains the public certificate register and supporting documents
ITSEF	IT Security Evaluation Facility	Runs the technical Common Criteria evaluation against the product
CB	Certification Body	Issues the certificate based on the ITSEF's evaluation
NCCA	National Cybersecurity Certification Authority	The Member State authority that accredits and oversees ITSEFs and CBs

ITSEFs and CBs are collectively referred to in the regulation as Conformity Assessment Bodies (CABs). Authorization requirements differ by assurance level: ENISA's documentation notes that a CB seeking authorization to certify at the high level faces additional requirements, including NCCA involvement in a pilot certification, reflecting the higher stakes of a high-assurance evaluation.

Where EUCC sits alongside EU hardware/software rules

EUCC isn't a product-safety law like the Cyber Resilience Act or RED/EN 18031 — it's a voluntary certification a manufacturer can choose to pursue on top of whatever baseline those laws already require. For a maker of chips, smartcards, HSMs, or other security-critical hardware components already working through IEC 62443-4-2 component requirements, an EUCC certificate gives a formally recognized, EU-wide assurance credential that can be shown to customers and regulators alike, backed by an independent ITSEF evaluation rather than a vendor's own self-assessment.

SoftWSP's device and firmware security assessments can help a team scope what level of independent assurance — EUCC, IEC 62443-4-2, or another route — actually fits their product and customer base before committing to a formal certification evaluation: see device & firmware security services.

This guide summarises public ENISA and European Union publications; it does not constitute legal or compliance advice.

Frequently asked questions

What is the EUCC, and what does it certify?

The EUCC (European Common Criteria-based cybersecurity certification scheme) is, per ENISA's own description, a voluntary EU-wide scheme that "allows ICT suppliers who wish to showcase proof of assurance to go through an EU commonly understood assessment process to certify ICT products such as technological components (chips, smartcards), hardware and software." ENISA developed it as a candidate scheme starting in 2020, drawing heavily on the existing SOG-IS Common Criteria evaluation framework already used across 17 EU Member States. The European Commission adopted it as Commission Implementing Regulation (EU) 2024/482 of 31 January 2024 — the first scheme adopted under the EU's cybersecurity certification framework established by the Cybersecurity Act, Regulation (EU) 2019/881.

What are the EUCC's two assurance levels?

ENISA's own certification site states the EUCC "defines two assurance levels: Substantial, High," selected according to "the level of risk associated with the intended use of the product, service or process, in terms of probability and impact of an accident." ENISA states these two levels "have been mapped with AVA_VAN, the vulnerability assessment class of the Common Criteria standard" — the family of Common Criteria components that determines how resistant to attack a product must be shown to be. This guide did not independently verify the regulation's precise article-level mapping of AVA_VAN components to Common Criteria Evaluation Assurance Levels (EAL1-EAL7) against the regulation's own text this run; treat any specific AVA_VAN-to-EAL correspondence you see cited elsewhere as to be confirmed against Regulation (EU) 2024/482 itself, not assumed from secondary summaries. Separately, ENISA's broader certification-framework page notes that EU certification schemes in general may specify any of three tiers — "basic, substantial, or high" — so the EUCC's decision to offer only the top two of those three is itself a notable scoping choice, not the full range the framework allows.

How does EUCC relate to Common Criteria, ISO/IEC 15408, and SOG-IS?

EUCC is built on Common Criteria, the international IT-security evaluation standard also published as ISO/IEC 15408, and ENISA states the scheme "is based on the time-proven SOG-IS Common Criteria evaluation framework already used across 17 EU Member States." SOG-IS (the Senior Officials Group Information Systems Security mutual-recognition agreement) is the pre-existing, informal multi-country arrangement EUCC is designed to formalize and eventually supersede at EU level; ENISA's site notes that vendors holding an existing national SOG-IS certificate can have it reassessed and converted to an EUCC certificate rather than starting evaluation from zero.

Who runs the EUCC, and when did it start applying?

ENISA (the EU Agency for Cybersecurity) authored the EUCC's technical content and maintains the public certificate register and supporting technical documents, but certification itself is carried out by accredited Conformity Assessment Bodies (CABs) — IT Security Evaluation Facilities (ITSEFs) that run the technical evaluation, and Certification Bodies (CBs) that issue the certificate — overseen by each EU Member State's National Cybersecurity Certification Authority (NCCA). Commission Implementing Regulation (EU) 2024/482 was adopted 31 January 2024, published in the Official Journal on 7 February 2024, and — per its own entry-into-force clause, which states the Regulation "shall apply from 12 months after entry into force" — has applied across the EU since 27 February 2025. Two amending regulations followed, in December 2024 and December 2025.