EU Cybersecurity Act
EU Cybersecurity Act (Regulation (EU) 2019/881)
Gave ENISA, the EU Agency for Cybersecurity, a permanent mandate and created the EU-wide cybersecurity certification framework for ICT products, services and processes.
In force: Adopted 2019 and in force the same year; since amended
Who it applies to
ENISA and national certification authorities directly; vendors and service providers when they seek (or a sector law requires) a European cybersecurity certificate.
Key requirements
- A permanent mandate and wider tasks for ENISA.
- European cybersecurity certification schemes, such as the EUCC scheme based on Common Criteria.
- Assurance levels of 'basic', 'substantial' and 'high' within schemes.
- National cybersecurity certification authorities to supervise certificates.
- Certificates issued under a scheme are recognised across all Member States.
Breach and incident notification
Not an incident reporting law. Incident reporting duties come from NIS2, DORA, the GDPR and the Cyber Resilience Act.
Penalties
Member States set penalties for breaching certification scheme rules.
Related frameworks
Shows up on these exams
Official source
EUR-Lex: Regulation (EU) 2019/881Not legal advice
This is a study summary, not legal advice. Laws and their guidance change, and obligations depend on your facts and jurisdiction. Check the official source and the current, dated text, and consult a qualified lawyer before acting.
Go deeper
Security glossary
Practise this topic hands-on.
GDPR
European Union - Privacy & data protection
NIS2
European Union - Cybersecurity & incident reporting
DORA
European Union - Sector-specific
EU CRA
European Union - Cybersecurity & incident reporting
EU AI Act
European Union - AI
ePrivacy
European Union - Privacy & data protection