European UnionCybersecurity Act, European Cybersecurity Certification Framework, Duties of Manufacturers, Providers and Certificate Holders
Regulation (EU) 2019/881, Arts. 53, 55 and 56
In force since .
A product security requirements rule binding public and private bodies.
- Obligation class
- Disclosure, Reporting
As of .
What it requires
- It reaches you if you manufacture or provide ICT products, ICT services or ICT processes, or managed security services, that a European cybersecurity certification scheme covers; certification is voluntary unless Union law or Member State law specifies otherwise (Article 56(2)), and a certificate or EU statement of conformity carries legal weight where other law gives it some, as Article 27(8) of Regulation (EU) 2024/2847 and Article 24 of Directive (EU) 2022/2555 do.
- If you hold a European cybersecurity certificate, inform the authority or body that issues it of any subsequently detected vulnerabilities or irregularities concerning the security of the certified product, service, process or managed security service that may have an impact on its compliance with the requirements related to the certification (Article 56(8)).
- If you manufacture or provide a certified ICT product, service or process, or one for which an EU statement of conformity has been issued, make publicly available guidance and recommendations for secure configuration, installation, deployment, operation and maintenance, the period during which security support will be offered, in particular the availability of cybersecurity related updates, your contact information and accepted methods for receiving vulnerability information from end users and security researchers, and a reference to online repositories listing publicly disclosed vulnerabilities and to any relevant cybersecurity advisories (Article 55(1)).
- Keep that information available in electronic form and update it as necessary at least until the certificate or EU statement of conformity expires (Article 55(2)).
- If you issue an EU statement of conformity under a scheme that allows conformity self-assessment, which is permitted only for low-risk products at assurance level basic, assume responsibility for the compliance of the product, service, process or managed security service with the scheme, make the statement, the technical documentation and all other relevant information available to the national cybersecurity certification authority for the period the scheme provides, and submit a copy of the statement to that authority and to ENISA (Article 53(1) to (3)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Member States, which under Article 65 lay down the rules on penalties applicable to infringements of Title III and of European cybersecurity certification schemes.
What this law does
Article 46 of Regulation (EU) 2019/881, as replaced by Regulation (EU) 2025/37, establishes the European cybersecurity certification framework to improve the functioning of the internal market by increasing the level of cybersecurity within the Union and enabling a harmonised approach to European cybersecurity certification schemes for ICT products, ICT services, ICT processes and managed security services.
Regulation (EU) 2025/37 extended the certification framework to managed security services. Article 56(2) provides that cybersecurity certification is voluntary, unless otherwise specified by Union law or Member State law. Under Article 56(1), as replaced by Regulation (EU) 2025/37, ICT products, ICT services, ICT processes and managed security services certified under a European cybersecurity certification scheme are presumed to comply with the requirements of that scheme.
Article 56(8), as replaced by Regulation (EU) 2025/37, requires the holder of a European cybersecurity certificate to inform the authority or body that issues it of any subsequently detected vulnerabilities or irregularities concerning the security of the certified ICT product, ICT service, ICT process or managed security service that may have an impact on its compliance with the requirements related to the certification.
Article 55(1) requires the manufacturer or provider of certified ICT products, ICT services or ICT processes, or of those for which an EU statement of conformity has been issued, to make publicly available guidance and recommendations for secure configuration, installation, deployment, operation and maintenance; the period during which security support will be offered, in particular the availability of cybersecurity related updates; contact information and accepted methods for receiving vulnerability information from end users and security researchers; and a reference to online repositories listing publicly disclosed vulnerabilities and to any relevant cybersecurity advisories.
Article 55(2) requires the supplementary cybersecurity information to be available in electronic form and to remain available and be updated as necessary at least until the expiry of the corresponding European cybersecurity certificate or EU statement of conformity.
Article 53, as replaced by Regulation (EU) 2025/37, lets a scheme allow conformity self-assessment under the sole responsibility of the manufacturer or provider, only for products, services, processes and managed security services that present a low risk corresponding to assurance level basic.
A manufacturer or provider that issues an EU statement of conformity assumes responsibility for the compliance of the product, service, process or managed security service with the requirements of the scheme, and must make the statement, the technical documentation and all other relevant information available to the national cybersecurity certification authority and submit a copy of the statement to that authority and to ENISA.
Article 65 requires Member States to lay down the rules on penalties applicable to infringements of Title III and of European cybersecurity certification schemes, and the penalties must be effective, proportionate and dissuasive. Article 69(1) provides that the Regulation enters into force on the twentieth day following its publication in the Official Journal, and Article 69(2) applies Articles 58, 60, 61, 63, 64 and 65 from .
Article 27(8) of Regulation (EU) 2024/2847 presumes that products with digital elements and processes put in place by the manufacturer, for which an EU statement of conformity or certificate has been issued under a European cybersecurity certification scheme adopted pursuant to Regulation (EU) 2019/881, conform with the essential cybersecurity requirements in Annex I in so far as the statement or certificate covers those requirements.
Article 24(1) of Directive (EU) 2022/2555 allows Member States, to demonstrate compliance with particular requirements of Article 21, to require essential and important entities to use particular ICT products, ICT services and ICT processes that are certified under European cybersecurity certification schemes adopted pursuant to Article 49 of Regulation (EU) 2019/881.
Commission Implementing Regulation (EU) 2024/482 lays down the rules for the application of Regulation (EU) 2019/881 as regards the adoption of the European Common Criteria-based cybersecurity certification scheme (EUCC).
When LexLint raises it
When your app profile says your app distributes a software product.