Does NIS2 require EUCC certification today?
NIS2 does not require EUCC certification today. The Directive creates no certificate of compliance, and European cybersecurity certification is not automatically required for the products or services an entity buys. Certified products become mandatory only if a Member State requires them under Article 24(1) or the Commission adopts a delegated act under Article 24(2) that obliges a category of entities to use certified products or obtain a certificate under a European scheme. If your customer, regulator or procurement team has asked whether NIS2 means certified products, the first question to answer is whether either of those two triggers applies to your entity, sector and Member State.
The answer depends on national transposition and on your entity's category and sector. NIS2 is a directive, so obligations reach you through the national law of the Member State with jurisdiction, and that law may or may not use the Article 24(1) power. Confirm with your national competent authority whether it requires certified ICT products, which entity types it covers and whether any sector-specific rules apply. Also check whether the Commission has adopted any delegated act under Article 24(2), since that power runs for five years from 16 January 2023 under Article 38(2). Recital 80 points to European and international standards as the means of showing compliance where no European scheme applies, so most entities will rely on documented evidence for their Article 21 measures rather than on a certificate.
Your organization owns its controls and decides how to meet its obligations. An implementation partner can prepare systems, configurations and evidence, but only an independent certification body issues an EUCC certificate, and only for the product or evaluation scope agreed with it. Before buying certified products, ask your supplier for the scope and assurance level of any certificate, and ask your authority in writing whether certification is required for your case. The NIS2 Technical Implementation Guidance from ENISA is a useful reference for the evidence supervisors expect.
What EUCC covers and which assurance level fits the risk
EUCC is the first certification scheme adopted under the Cybersecurity Act. It is based on the Common Criteria and certifies the cybersecurity of ICT products across their lifecycle. Participation is voluntary, but a certificate is recognised across the EU, so you can compare products on one basis. Member States may require entities to use certified ICT products under European schemes, so a certificate can also become a procurement condition in your sector.
- Start from the risk of the intended use: Assurance levels of basic, substantial or high are meant to match the risk of the use case, so a product guarding a privileged network path needs a different level than a low-exposure peripheral.
- Ask which level and which product version: A certificate covers a specific product, configuration and version. Confirm that the version you plan to deploy is the one certified.
- Read the security target: The security target states what was evaluated and what was assumed. Gaps between those assumptions and your deployment are your residual risk.
- Check the lifecycle commitments: Ask how the vendor maintains the certified product, including patches, and whether a change triggers re-evaluation.
- Verify the certificate yourself: Confirm the certificate and its scope with the certification body or the published certificate record before you rely on it in a contract.
Ask your vendor or the certification body to confirm the certified scope, level and validity period in writing.
If you sell ICT products into regulated EU sectors, EUCC lets you show independent evaluation of your product against a common basis instead of answering each customer questionnaire separately. Certification is a significant investment, and the choice of assurance level drives the depth of evaluation and the evidence you must prepare. Because the scheme is voluntary, the business case depends on whether your buyers will ask for it.
- Match the level to your market: Select the assurance level by the use cases your customers actually have, not by the highest level available.
- Prepare the evidence early: Design documentation, test results and vulnerability handling records must exist before an evaluator can examine them.
- Define the scope tightly: Certify the product configuration customers will deploy. A narrower scope is easier to maintain across releases.
- Plan for re-evaluation: Budget for updates, because changes to the certified product can require further assessment.
- Engage the right body: Confirm with the certification body which evaluation facility will test the product and how long the process is expected to take.
Ask the certification body to confirm the evaluation method, the fees, and what changes trigger re-evaluation before you commit to a scope.
For NIS2, certification is not a certificate of compliance. The directive creates no such certificate, and national authorities oversee compliance through their own supervisory powers. A certified product is evidence that a specific component was independently evaluated, which can support your risk-management measures and your position with a supervisor. Adherence to approved certification mechanisms is a factor authorities must consider when deciding enforcement measures and fines, but it does not replace your own risk assessment.
- Treat certification as one input: Use it to support the Article 21 measures for the components it covers, and document how you reached that conclusion.
- Map certified products to your risk assessment: Record which systems rely on certified components and which do not, so gaps are visible.
- Track national requirements: Check whether your Member State has used its power to require certified products in your sector.
- Keep supplier evidence on file: Store certificates, scope statements and validity dates with your supply chain records.
- Review the 2026 proposal: The Commission's January 2026 proposal would change how certification schemes are developed, so revisit this mapping as it progresses.
Confirm with your national competent authority how it expects certification evidence to be presented.
Can certification reduce fines and enforcement?
Certification and approved standards do not exempt an organization from NIS2. Article 21 still applies in full, and supervisors decide what to do about gaps. What certification changes is the evidence an entity can put in front of an authority when enforcement decisions are weighed.
Adherence as a statutory factor
Articles 32(7)(g) and 34(3) require competent authorities to consider adherence to approved codes of conduct or approved certification mechanisms when they decide on enforcement measures and fines. Adherence is one input among several, so an authority still assesses the facts of the case. Ask your supervisor or national transposition law which mechanisms, if any, are approved in your Member State before you plan around them.
Certification is not a shield
A certificate does not replace the duty to manage risk under Article 21. If an authority finds that your measures are weak in practice, a certificate covering a narrower scope or an older state of the system will not prevent enforcement. Treat certification as evidence that supports your compliance position, and keep the risk assessment and control operation current across the full scope.
Recital 80 and standards
Recital 80 notes that, without appropriate European certification schemes, Member States should promote relevant European and international standards for demonstrating compliance with risk-management measures. Where no EU scheme covers your product or service, standards-based management systems can serve as the demonstration. Confirm with your national authority which standards it accepts as evidence for Article 21.
Scope must match the evidence
Authorities look at whether the certified or assessed scope covers the systems that deliver your essential or important services. A certificate for one product line or one site may carry little weight if the service runs elsewhere. Before relying on any certificate, confirm the scope statement, the assurance level where applicable, and the validity period with the issuing body.
Evidence still needed for inspections
Supervisors can run inspections, security audits and information requests whatever certificates you hold. Keep the operational evidence ready: the risk assessment, policies, access records, patch and vulnerability logs, backup tests and incident records. A certificate is most useful when these records already show that the controls it describes run every day.
Cost and effort to confirm
Preparing for certification costs money and staff time, and the audit fee is only one part of it. Ask a certification body or consultant to state in writing what is in scope, which evidence you must supply, and what must be repeated at surveillance or renewal. Weigh that cost against the enforcement position it supports, since the NIS2 Article 21 work is required either way.
Who issues a certificate and what the organization still owns
Only an independent certification body or conformity assessment body issues an EUCC certificate. NIS2 itself creates no certificate of compliance, so no single document proves that an entity meets the Directive. The organization owns its products, its controls and its compliance position. An implementation partner such as DeployOpen can prepare systems, configurations and evidence for an assessment, but DeployOpen does not certify anything, and a report or certificate from DeployOpen would carry no weight with a regulator. Before engaging anyone, confirm with the chosen certification body which scheme, assurance level and evaluation process apply to the specific product, and who signs the resulting certificate.
National competent authorities supervise NIS2 compliance under Articles 32 to 34. They use inspections, security audits, security scans, information requests and, where warranted, administrative fines. Those powers belong to the authority, so the entity must be able to show its own evidence on request. Ask your supervisor or national authority how it expects that evidence to be packaged, and whether it accepts third-party assessments as support. A certificate under a European scheme may be one input, but it does not replace the organization's own risk-management record. Each control owner, not the consultant or the certification body, remains accountable for keeping that record current.
In practice, the organization keeps several decisions in-house: which products fall under a certification requirement, which assurance level matches the intended risk, who approves the scope of an assessment, and how findings are closed. Document these decisions in writing before an evaluation starts, and assign a named owner to each. Work with an implementation partner on the technical preparation, then confirm in the written scope which deliverables are evidence packs and which are certified outcomes, so that no one later mistakes preparation for a certificate.
How to decide whether certified products belong in your NIS2 program
This sequence turns the question of certified ICT products into a documented decision you can defend to a supervisor. It starts with your legal position under NIS2 and ends with a recorded link between each product choice and the Article 21 measures it supports.
Confirm your entity category and sector
Start by establishing whether your organization is an essential or important entity and which Annex I or Annex II sector it falls under. Management, with legal and compliance support, should confirm this against the scope rules in NIS2 and the national law of each Member State where you operate. The output is a short scope memo, approved by the management body, that states your classification and the competent authority responsible for you. Every later step depends on this record, so keep it current when your structure or service lines change.
Check national transposition for Article 24 rules
Read the transposition law of each Member State where you are in scope and look for any provision that requires entities to use ICT products, services or processes certified under an adopted European scheme. Article 24(1) allows Member States to impose such requirements, so the answer varies by jurisdiction and can change over time. Compliance counsel should confirm the current text, and the output is a register of applicable national requirements with the source article cited for each. If no requirement exists, record that finding too, because it shapes how much weight certification carries in your decision.
Inventory ICT products in your risk assessment
List the ICT products, services and processes that support the systems you rely on, drawing from the risk assessment that Article 21 requires. Security, IT and business owners should identify which products handle sensitive data, control access, process network traffic or sit in critical paths, and rank them by the impact of failure. The output is an inventory linked to risk ratings, so you can see which products carry the most risk and where certification would add the most assurance. Note which items are open-source components you host yourself, because they will need a different evidence approach.
Request existing certificates and assurance levels
For each high-priority product, ask the vendor in writing whether it holds a certificate under the EUCC scheme or another recognized certification, and which assurance level applies (basic, substantial or high). Ask for the certificate number, the scope of the evaluated product version, its validity dates and the certifying body. Procurement should verify these details against the published certificate records, not only the vendor's summary. The output is a vendor certificate file for each product, with gaps marked where no certificate exists, and the assurance level matched to the risk rating from the previous step.
Assess gaps where no certificate exists
Where a product has no certificate, or the certified version differs from the one you deploy, assess the gap with the security team. Consider whether the product's security evidence, such as independent testing reports, vulnerability handling practices and documented configurations, can support the Article 21 measures in its place. Recital 80 notes that, without European certification schemes, authorities expect entities to use relevant European and international standards to demonstrate compliance, so record which standards you apply. The output is a gap assessment per product stating the compensating evidence and any residual risk accepted by the management body.
Decide and record the product choice
Using the scope memo, national requirements, risk ratings and gap assessments, decide for each product whether to require certification, accept equivalent evidence, or replace the product. The decision should be approved by the person accountable for Article 21 measures and reported to the management body. Record the reasoning in a decision log so that a supervisor can see why each product was retained or changed. The output is a signed decision register that feeds procurement requirements and future contracts.
Map each choice to Article 21 measures
Link every decision to the specific Article 21(2) measure it supports, such as supply chain security, access control or cryptography, and to the control owner who maintains it. This mapping shows the supervisor how certification fits within your broader risk-management program rather than standing alone. Review it when the risk assessment changes or a certificate expires. The output is a traceability matrix that connects product certificates, decisions, owners and review dates, ready to present during inspection or audit.
Retain evidence for supervisory review
Assemble the outputs of each step into one evidence file: the scope memo, the transposition register, the product inventory, vendor certificate records, gap assessments, the decision log and the traceability matrix. Store the file under version control with dated approvals so that the record shows how the position developed. Confirm with your competent authority which formats it accepts, since supervisors may request information at any time. Certification is a factor authorities consider in enforcement, so a documented, reasoned file gives you the strongest position if questions arise.
Where buyers go wrong with certification clauses
Buyers often write certification requirements into supplier contracts faster than they check what the law allows. The four errors below come up repeatedly, and each one has a specific check that prevents it. Read them before drafting any clause that names EUCC, a certificate or a European scheme.
Writing EUCC into contracts before checking national law
Article 24(1) lets Member States require certified ICT products, but it is their choice whether to do so. Article 24(2) gives the Commission a separate power to adopt delegated acts, which requires an impact assessment and an implementation period. Before writing a clause that requires EUCC, confirm with your national competent authority or legal counsel whether your Member State or a delegated act actually imposes that requirement on your sector. A clause that asks for more than the law requires may be unenforceable or may create cost you did not plan for. Keep the clause conditional on the legal requirement until that check is complete.
Treating a certificate as full NIS2 compliance
An EUCC certificate covers the security evaluation of one ICT product against a defined scheme. It does not cover the Article 21 risk-management measures, the management body duties in Article 20, or the reporting process in Article 23. NIS2 creates no certificate of compliance, and national authorities oversee compliance through inspections, audits and information requests. Recital 80 points to standards for demonstrating compliance where European schemes are absent. Write clauses that ask for evidence against the measures the supplier controls, and treat the product certificate as one input.
Ignoring the assurance level fit to risk
EUCC certificates carry an assurance level of basic, substantial or high, and the level is meant to match the risk of the intended use. A clause that asks for the highest level on every product adds cost and evaluation time without necessarily reducing the risk that matters to your environment. A clause that asks for basic on a product that controls access to critical systems may fail your own risk assessment. Ask the supplier which level applies, how the intended use was defined, and whether the risk assessment under your NIS2 program supports that choice.
Writing terms around the 2026 proposal
The Commission's proposal of 20 January 2026 would amend the Cybersecurity Act, renew the certification framework and make ENISA-managed schemes a voluntary tool for showing compliance. It is a proposal, and it has not been adopted. Contract terms that depend on its outcome, such as a fixed date for certifying cyber posture, can fail if the text changes or the timing slips. Draft the clause against the law in force, and add a review trigger that reopens the terms when the amendment is adopted and its transition period is known. Ask counsel to confirm the status with the European Parliament and Council before signing.
Questions buyers ask about EUCC and NIS2
Does NIS2 require a certificate to show compliance?
No. NIS2 creates no certificate of compliance. National competent authorities oversee compliance through inspections, security audits, security scans, information requests and administrative fines. Certification under a European scheme is a tool that Member States may require for certain ICT products, services and processes, and that the Commission may later require through a delegated act. Adherence to approved codes of conduct or approved certification mechanisms is a factor authorities must consider when they decide enforcement measures and fines, so a certificate can help in an enforcement discussion without replacing the evidence you show your supervisor. Confirm with your national competent authority which tools it recognizes.
What does an EUCC certificate cost, and who pays for it?
The organization that holds the product certificate pays. Costs are driven by the product's size and complexity, the assurance level sought, the evaluation laboratory's effort, the certification body's fees and the number of re-evaluations needed when the product changes. Costs recur whenever the product is updated and the certificate must be maintained. The organization also pays its own internal effort to prepare documentation. Ask any evaluation laboratory or certification body for a written quote that separates evaluation, certification and maintenance fees, lists the documents you must supply, and states what triggers a re-evaluation. Implementation partners can prepare evidence, but they do not issue the certificate.
How long does a European cybersecurity certification take?
The duration depends on the scheme, the product's complexity, the assurance level and how ready the documentation is when evaluation starts. Evaluation tends to be the longest phase, and delays often come from incomplete design documents, unresolved findings and waiting for laboratory capacity. Ask the certification body for its published timeline for the specific scheme and assurance level, and ask the evaluation laboratory which deliverables it needs before the clock starts. Plan for a retest if the product changes after evaluation.
Can an implementation partner prepare the evidence for certification?
Yes, an implementation partner can prepare systems, configuration baselines, architecture documentation, test records and change logs that feed a certification or a NIS2 evidence file. DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure, and runs security testing that produces findings to resolve. The partner does not issue audit reports, attestations or certificates. Only an independent auditor, assessor or certification body does that. Agree the scope, deliverables and timeline in writing before work starts.
Who chooses the assurance level for a certificate?
The product owner chooses the target assurance level, with input from the risk assessment and the intended use of the product. EUCC certificates carry basic, substantial or high assurance levels, commensurate with the risk of the intended use. Your risk assessment should justify the choice, and your supervisor may ask how you reached it. Certification bodies and evaluation laboratories confirm whether the product can meet the level, but they do not set the risk appetite. Involve your management body, since it approves and oversees the risk-management measures under NIS2.
What should we confirm before the 2026 NIS2 proposal is adopted?
The Commission's January 2026 proposal to amend NIS2 (COM(2026) 13) and its revised Cybersecurity Act proposal are still proposals that need approval by the European Parliament and the Council. Before adoption, confirm with your national competent authority how your national transposition law applies today, whether the proposed changes affect your entity category, and whether the proposed certification framework would change which schemes apply. Track the official proposal text on the Commission's digital strategy site and plan your evidence file so it does not depend on a scheme that may change.
Does a European certificate cover our whole NIS2 program?
No. A certificate of an ICT product under a European scheme covers that product within the scheme's scope and assurance level. NIS2 Article 21 requires a broader set of risk-management measures across your organization, including governance, incident handling, business continuity, supply chain security and vulnerability handling. Use certified products where your Member State requires them or where they reduce risk, but build the rest of the evidence from your own policies, configurations, logs and test results. Confirm the exact scope of any certificate before you rely on it in a supplier or audit discussion.
How DeployOpen prepares NIS2 evidence for certification reviews
DeployOpen works on the technical side of NIS2 and European cybersecurity certification (EUCC) readiness: scoping the systems in question, building or hardening self-hosted open-source platforms inside your own infrastructure, and documenting the evidence an assessor will ask for. Your organization owns its controls and decisions, and only an independent certification body or auditor issues any certificate.
How we scope
- Agree a written scope naming the systems, products and services that a certification or supervisory review would cover.
- Map which assets fall under the EUCC question, which rely on Member State requirements, and which remain outside the review.
- Confirm with your certification body or national authority which assurance level and evidence they expect before work starts.
How we build
- Implement and harden self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks.
- Configure logging, access control, configuration baselines and change records so each control leaves traceable evidence.
- Test the platforms against the security requirements in scope, and record findings and remediation for your assessor.
How we hand over
- Deliver documentation covering architecture, configurations, test results and the evidence index agreed in the scope.
- Walk your internal team and assessors through the evidence so your staff can explain and maintain it after handover.
- Leave the organization owning all controls, credentials and records, with the certification decision made by the independent body.
How we support
- Provide ongoing support, upgrades and continuous testing for the systems in scope as a retainer, if you want it.
- Update evidence when platforms change, when a certification scheme or assurance level changes, or when the Commission adopts a delegated act.
- Work alongside your consultants, certification body and managed security provider, with roles agreed in writing.
Sources and further reading
- Directive (EU) 2022/2555 (NIS2), EUR-Lex ↗
- The EU cybersecurity certification framework, European Commission ↗
- NIS2 Technical Implementation Guidance (June 2025), ENISA ↗
- Proposal for a Directive as regards simplification measures and alignment with the Cybersecurity Act, COM(2026) 13 ↗
- Commission strengthens EU cybersecurity resilience and capabilities, press release IP/26/105 ↗
