top of page
SITG-CONSULTING
SITG-Wax-Seal-Transparent.png

Advisory briefing

EU Certification for Cryptographic Products

What each certificate covers, which ones apply to your product, and how to obtain them.

Position as at 13 November 2026

 

Selling a cryptographic product into the European Union (EU) now turns on four pieces of EU law: the EU Cybersecurity Act and its product certification scheme; eIDAS, the regulation on electronic identification, authentication and trust services; the Cyber Resilience Act; and NIS2, the directive on network and information security. They overlap, they use different vocabularies, and parts of them are still being completed. This page sets out what each one certifies or requires, which ones apply to your product and market, and the route to the certificates that do.

 

In brief

  • The European Common Criteria-based cybersecurity certification scheme (EUCC) is the EU’s security certificate for information and communication technology (ICT) products. It is built on the international Common Criteria, it replaced Member States’ own Common Criteria schemes in February 2025, and it is voluntary unless another law requires it.

  • The Cyber Resilience Act makes cybersecurity a condition of selling hardware and software products in the EU. Its vulnerability and incident reporting duties have applied since 11 September 2026. Its main obligations, including conformity assessment and CE marking, apply from 11 December 2027.

  • Hardware security modules, smartcards and secure elements fall in that Act’s critical category. Their conformity assessment involves an independent notified body; self-assessment is not available to them.

  • Under the eIDAS reference standards, a qualified trust service provider generates and uses its keys inside a certified cryptographic device: Common Criteria or EUCC at Evaluation Assurance Level 4 (EAL4) or higher, or Federal Information Processing Standard (FIPS) 140-3 Level 3 until 31 December 2030.

  • FIPS 140-3 is a United States and Canadian federal validation for cryptographic modules. It is not a European certificate and does not substitute for EUCC.

 

1. The map

Each instrument answers a different question. The Cybersecurity Act creates EU certification schemes. EUCC is the scheme for ICT products. The Common Criteria is the evaluation standard EUCC applies. eIDAS, the Cyber Resilience Act and NIS2 decide when certification or independent assessment is needed, and at what level. FIPS 140-3 sits outside EU law.

Diagram of how the instruments connect. The EU Cybersecurity Act creates EUCC, which applies the Common Criteria. eIDAS accepts EUCC or Common Criteria at EAL4 or higher for trust-service devices. Under the Cyber Resilience Act, EUCC becomes a route once a delegated act is adopted. Under NIS2, Member States may require certified products. FIPS 140-3 sits outside EU law and is accepted by eIDAS at Level 3 until 31 December 2030.
Diagram of how the instruments connect. The EU Cybersecurity Act creates EUCC, which applies the Common Criteria. eIDAS accepts EUCC or Common Criteria at EAL4 or higher for trust-service devices. Under the Cyber Resilience Act, EUCC becomes a route once a delegated act is adopted. Under NIS2, Member States may require certified products. FIPS 140-3 sits outside EU law and is accepted by eIDAS at Level 3 until 31 December 2030.

​EU Cybersecurity Act

What it is: The EU law that gives the European Union Agency for Cybersecurity (ENISA) its mandate and creates the framework for EU-wide cybersecurity certification schemes.

What it sets: Three assurance levels a scheme may use: ‘basic’, ‘substantial’ and ‘high’. ‘Substantial’ is aimed at attackers with limited skills and resources; ‘high’ at state-of-the-art attacks by attackers with significant skills and resources.

Status: Adopted in 2019. Certification under it is voluntary unless EU or national law requires it. A replacement, the proposed Cybersecurity Act 2, was published on 20 January 2026 and is under negotiation.

 

EUCC

What it is: The European Common Criteria-based cybersecurity certification scheme, adopted by the European Commission under the Cybersecurity Act in January 2024 and amended in December 2024 and December 2025.

What it certifies: ICT products, such as chips, smartcards, hardware and software, and protection profiles, evaluated against the Common Criteria and its evaluation methodology.

Levels: ‘Substantial’, covering vulnerability analysis at level 1 or 2, or ‘high’, covering level 3, 4 or 5. There is no ‘basic’ level, and self-assessment is not permitted.

Who issues it: An accredited certification body, working with an accredited information technology security evaluation facility (ITSEF). For ‘high’, the national cybersecurity certification authority must also authorise both.

Status: Applies since 27 February 2025. Member States’ own Common Criteria schemes for the same products ceased to have effect that day; certifications started under them before then had until 27 February 2026 to finish. An EUCC certificate lasts up to five years unless the national authority approves longer.

 

Common Criteria and EALs

What it is: The international standard for evaluating the security of information technology products, published as ISO/IEC 15408 (current edition CC:2022), with a companion evaluation methodology published as ISO/IEC 18045.

What an EAL is: An Evaluation Assurance Level is a pre-defined package of assurance requirements. There are seven, EAL1 to EAL7. Each gives more assurance than those below it, by adding rigour, scope and depth to the evaluation.

What it is not: An EAL states how deeply the product’s security claims were examined. The claims themselves sit in the product’s security target, so two products at the same EAL can make very different claims. An EAL is not a FIPS security level.

Status: CC:2022 is the current version. Under EUCC, certificates may still be issued against the earlier version 3.1 until 31 December 2027.

 

eIDAS

What it is: The EU regulation on electronic identification and trust services, such as electronic signatures, seals, time stamps and validation, as amended in 2024.

Where a device certificate is required: Qualified signature and seal creation devices must be certified by a body designated by a Member State. The certificate lasts up to five years, with a vulnerability assessment every two years. Separately, the reference standards adopted in September 2025 for qualified certificates, qualified time stamps and qualified validation services require the provider’s keys to be generated, or held and used, inside a certified cryptographic device.

Accepted routes for those devices: Common Criteria at EAL4 or higher; EUCC at EAL4 or higher; or FIPS 140-3 Level 3 until 31 December 2030. A device certified under EUCC must be configured and used as its certificate specifies.

How binding: Meeting the reference standards gives the provider a presumption of compliance with eIDAS. A provider may use other practices, but must then demonstrate compliance without that presumption.

 

Cyber Resilience Act

What it is: EU product law setting cybersecurity requirements for hardware and software products with digital elements, enforced through conformity assessment and CE marking.

Timeline: In force since 10 December 2024. Rules on notified bodies apply since 11 June 2026. Reporting of actively exploited vulnerabilities and severe incidents to the designated national computer security incident response team and ENISA applies since 11 September 2026, including for products already on the market. The main obligations apply from 11 December 2027.

Conformity routes: Default products: the manufacturer’s own assessment. Important products, class I: own assessment only where harmonised standards, common specifications or a certification scheme at ‘substantial’ are applied in full; otherwise a notified body. Important products, class II, and critical products: a notified body, through EU-type examination or full quality assurance.

Hardware security modules: They are critical products: the Commission’s technical description of ‘hardware devices with security boxes’ names hardware security modules that generate and manage cryptographic elements.

EUCC under the Act: EUCC becomes a usable conformity route only when the Commission specifies, by delegated act, what an EUCC certificate covers and when it removes the need for a notified body. That act has not been adopted; the Commission’s consultation page plans adoption in the first quarter of 2027. A separate power to make a certificate mandatory for critical products has not been used.

 

NIS2 Directive

What it is: EU law on cybersecurity risk management and incident reporting for organisations classed as essential or important entities. Member States were required to apply it from 18 October 2024, through national law.

How certified products fit: A Member State may require those entities to use ICT products, services and processes certified under a European scheme such as EUCC, to show they meet the Directive’s risk-management measures. The Commission may make this mandatory for categories of entities by delegated act. It has not done so.

Proposed cyber-posture certification: The proposed Cybersecurity Act 2 would allow certification schemes for an organisation’s overall cyber posture, starting with entities in scope of NIS2. Such a certificate would cover the organisation, not a product. It is a proposal and has no legal effect yet.

 

FIPS 140-3, outside EU law

What it is: The United States Federal Information Processing Standard (FIPS) for cryptographic modules, published by the National Institute of Standards and Technology (NIST) in March 2019. Validation is run jointly by NIST and the Canadian Centre for Cyber Security.

Levels: Four increasing security levels, 1 to 4, specific to cryptographic modules.

Relationship to EUCC: Different standard, authority, scale and purpose. Neither certificate converts into the other. Within the EU rules covered here, FIPS 140-3 appears only in the eIDAS trust-service reference standards, at Level 3, until 31 December 2030.

Status: Under NIST’s transition schedule, validations under the earlier FIPS 140-2 go to its historical list after 21 September 2026, for use in existing systems only.

 

Evaluation Assurance Levels and EUCC levels

  • EAL1, functionally tested: vulnerability analysis level 1; EUCC level ‘substantial’.

  • EAL2, structurally tested: vulnerability analysis level 2; EUCC level ‘substantial’.

  • EAL3, methodically tested and checked: vulnerability analysis level 2; EUCC level ‘substantial’.

  • EAL4, methodically designed, tested and reviewed: vulnerability analysis level 3; EUCC level ‘high’.

  • EAL5, semi-formally designed and tested: vulnerability analysis level 4; EUCC level ‘high’.

  • EAL6, semi-formally verified design and tested: vulnerability analysis level 5; EUCC level ‘high’.

  • EAL7, formally verified design and tested: vulnerability analysis level 5; EUCC level ‘high’.

EUCC sets its level by the vulnerability analysis level alone, so a certificate can be ‘high’ on a lower EAL augmented with deeper vulnerability analysis. FIPS 140-3 Levels 1 to 4 are a separate scale, and none of them corresponds to an EAL.

2. Which applies to you

Three questions settle the starting position: what the product is, who buys it, and which law applies at that point. Classification under the Cyber Resilience Act turns on the product’s core functionality, as the Commission’s technical descriptions set out.

 

Decision aid

  • A hardware security module, sold to any customer in the EU. Rule: Cyber Resilience Act, critical product. What you need: conformity assessment involving a notified body before CE marking, from 11 December 2027. EUCC becomes a route once the Commission specifies it by delegated act.

  • A hardware security module, sold to qualified trust service providers. Rule: eIDAS reference standards. What you need: Common Criteria or EUCC at EAL4 or higher, or FIPS 140-3 Level 3 until 31 December 2030. EUCC lists the European standard protection profile EN 419221-5 for cryptographic modules used in trust services.

  • A smartcard, secure element or signing token, sold to any customer in the EU. Rule: Cyber Resilience Act, critical product. What you need: conformity assessment involving a notified body, from 11 December 2027.

  • A qualified signature or seal creation device, sold to trust service providers and their users. Rule: eIDAS. What you need: certification by a body designated by a Member State, valid up to five years, with a vulnerability assessment every two years.

  • A tamper-resistant microprocessor or microcontroller, sold to any customer in the EU. Rule: Cyber Resilience Act, important product, class II. What you need: conformity assessment involving a notified body, from 11 December 2027.

  • Public key infrastructure (PKI) or certificate issuance software, or a virtual private network (VPN) product, sold to any customer in the EU. Rule: Cyber Resilience Act, important product, class I. What you need: own assessment where harmonised standards, common specifications or a certification scheme at ‘substantial’ are applied in full; otherwise a notified body.

  • A cryptographic library, or another product outside the listed categories, sold to any customer in the EU. Rule: Cyber Resilience Act, default product. What you need: own conformity assessment, technical documentation and CE marking, from 11 December 2027.

  • Any ICT product or service, sold to essential and important entities under NIS2. Rule: national law implementing NIS2. What you need: a European certificate such as EUCC where the Member State requires it. Check each Member State you sell into.

  • A cryptographic module, sold to United States or Canadian federal agencies. Rule: FIPS 140-3. What you need: validation by NIST and the Canadian Centre for Cyber Security. It is not an EU certificate; within the EU rules covered here, it counts only in the time-limited eIDAS route above.

For products within the Cyber Resilience Act’s scope, including those already on the market, its reporting of actively exploited vulnerabilities and severe incidents already applies.

 

3. How you get there

The route below follows EUCC, the European certificate that eIDAS accepts today and that the Cyber Resilience Act and NIS2 can call on.

 

1. Define the scope

Fix the Target of Evaluation: the exact product, version, configuration and boundary to be certified. Write the security target, which states the security claims the evaluation will test.

 

2. Choose the level and the protection profile

Choose ‘substantial’ or ‘high’, and the EAL your buyers and rules demand, such as EAL4 or higher for eIDAS trust-service devices. Where a certified protection profile covers your product type, claim conformance to it.

 

3. Engage the evaluation facility and certification body

Both must be accredited, and their accreditation must cover your product category. For ‘high’, both must also be authorised by the national cybersecurity certification authority.

 

4. Evaluate and certify

The facility evaluates the product against its security target using the Common Criteria and its methodology, then reports to the certification body, which decides and issues the certificate. The certificate, certification report and security target are published, in English at least.

 

5. Maintain the certificate

An EUCC certificate lasts up to five years. The holder monitors vulnerabilities, including in dependencies, and handles them under the scheme’s rules. To keep the certificate through a product change, the holder submits an impact analysis to the certification body: a minor change keeps the certificate, a major change needs re-evaluation.

 

4. The traps

Trap 1: EUCC certified is not EAL4 or higher

An EUCC certificate states ‘substantial’ or ‘high’, and need not state an EAL at all. ‘Substantial’ covers vulnerability analysis at level 1 or 2. EAL4 requires level 3, so a ‘substantial’ certificate cannot meet an EAL4 requirement. ‘High’ starts at level 3, but a certificate can be ‘high’ on a lower EAL augmented with deeper vulnerability analysis. Where a rule says EAL4 or higher, read the EAL on the certificate.

 

Trap 2: FIPS validation is not a European equivalent of EUCC

FIPS 140-3 validates a cryptographic module against a United States federal standard, for United States and Canadian federal buyers. EUCC certifies an ICT product under EU law. The standards, authorities and scales differ, and neither certificate converts into the other. FIPS is not a conformity route under the Cyber Resilience Act. Under eIDAS it is accepted only in the trust-service reference standards, at Level 3, until 31 December 2030.

 

Trap 3: 31 December 2030 is a narrow date

The date sits in the eIDAS implementing acts of September 2025 on qualified trust services. It limits how long a qualified trust service provider can rely on a FIPS 140-3 Level 3 device to meet those reference standards. It is not an EU-wide expiry of FIPS, and it changes nothing for FIPS validations outside those rules. The route names FIPS 140-3, so a FIPS 140-2 validation does not meet it.

5. How SITG-Consulting helps

SITG-Consulting is a vendor-independent advisory practice. We advise product and compliance leads on reaching the certificates their markets require.

 

Scoping the route

Which instruments apply to your product, buyers and markets; the assurance level and EAL each one demands; and one certification plan that satisfies them together.

 

Preparing for evaluation

The Target of Evaluation, security target and supporting evidence, brought to the standard an evaluation facility and certification body will expect before the evaluation starts.

 

Managing the certificate lifecycle

Product changes, vulnerability handling, reporting duties under the Cyber Resilience Act and renewal, tracked against the Commission acts still to come.

 

To discuss your route, contact Brian Couzens, CEO, at brian.couzens@sitg-consulting.com or through the contact form.

 

Important Notice

This page is general advisory information. It is not legal advice and does not address the circumstances of any particular product or organisation. It states the position as at 13 November 2026. The European Commission continues to adopt implementing and delegated acts under these laws, and the position will change. Confirm the current position with the issuing body before relying on any statement on this page.

 

Official texts

bottom of page