G/TBT/N/EU/1019  
5 October 2023  
(23-6680) Page: 1/2 
Committee on Technical Barriers to Trade  Original:  English  
 
  
NOTIFICATION  
The following notification is being circulated in accordance with Article 10.6  
 
1. Notifying Member:  EUROPEAN UNION  
If applicable, name of local government involved (Article 3.2 and 7.2):   
2. Agency responsible:   
European Commission  
Name and address (including telephone and fax numbers , email and website 
addresses, if available) of agency or authority designated to handle comments 
regarding the notification shall be indicated if different from above:   
European Comm ission,  
EU-TBT Enquiry Point,  
Fax: +(32) 2 299 80 43,  
E-mail: grow-eu-tbt@ec.europa.eu  
Website: http://ec.europa.eu/growth/tools -databases/tbt/en/  
3. Notified under Article 2.9.2 [X], 2.10.1 [  ], 5.6.2 [X], 5.7.1 [  ], 3.2 [  ], 7.2 [  ], 
other :  
4. Products covered (HS or CCCN where applicable, otherwise national tariff 
heading. ICS numbers may be provided in addition, where applicable):  The draft 
certification scheme primarily covers specialised IT and ICT equipment, such as integrated 
circuits, smart cards and related products (cryptographic elements, microcontrollers, 
dedicated software), network devices and systems (routers, switches, access points) and 
products for digital signatures (cryptographic modules, hardware security modules, 
secure servers). The draft certification scheme is not aimed at general purpose or 
consumer products  
5. Title, number of pages and language(s) of the notified document:  Draft 
Commission Implementing Regulation laying down rules for the application of Regu lation 
(EU) 2019/881 of the European Parliament and of the Council as regards the adoption of 
the European Common Criteria -based cybersecurity certification scheme (EUCC); (34 
page(s), in English), (18 page(s), in English)  
6. Description of content:  This draft Commission Implementing Regulation introduces the 
European Union Common Criteria -based certification scheme (EUCC) as the first scheme 
under the CSA certification framework.  
The European cybersecurity certification framework aims at increasing the 
trustworthiness of ICT products, ICT services and ICT processes by means of European 
cybersecurity certification schemes, as certification demonstrates that the scheme's 
cybersecurity requirements have been met. The framework also aims at av oiding the 
overlap of cybersecurity certification schemes across the Member States, reducing costs 
for undertakings operating in the digital single market as well as making available, 
transparent and comparable assurance statements to customers by means of  certificates 
including marks and labels.  G/TBT/N/EU/1019  
 
- 2 - 
 
  The scheme builds on international standards (see point 8). The requirements and 
conformity assessment procedures are based on international standards.  
7. Objective and rationale, including the nature of urgent pr oblems where 
applicable:  By providing scalable assurance about cybersecurity measures up to the 
highest sophistication of cyberattacks, the EUCC scheme will enhance trust in the digital 
single market. EUCC certification provides coherent and consistent inf ormation about 
cybersecurity properties in a value chain so that customers can make informed decisions. 
In EUCC certification, cybersecurity claims of an ICT product extend over their lifecycle. 
EUCC certification increases the probability of discovering a nd removing unwarranted 
risks, such as illicit data exfiltration, and thus discourages the placing of insecure products 
on the market; Consumer information, labelling; Prevention of deceptive practices and 
consumer protection; Quality requirements  
8. Relevant documents:   
The EUCC builds on two standards (publicly available on ISO website): Common Criteria 
for Information Technology Security Evaluation, as set out in EN ISO/IEC 15408 (available 
here); and Common Methodology for Information Technology Security Evaluation, as set 
out in EN ISO/IEC 18045 . 
The basis for this implementing regulation is Regulation (EU) No 2019/881 of the 
European Parliament and of the Council of 17 April 2019 on ENISA (the European Union 
Agency for Cybersecurity) and on information and communications technology security 
certification and r epealing Regulation (EU) No 526/2013 (Cybersecurity Act).  
Both standards are used by the international Common Criteria community convened 
under the CCRA.  
9. Proposed date of adoption:  4th Quarter 2023  
Proposed date of entry into force:  20 days from publication in the Official Journal of 
the EU, with some provisions applying one year after entry into force.  
10. Final date for comments:  60 days from notification  
11. Texts available from:  National enquiry point [ ] or address, telephone and fax 
numbers and email and website addresses, if available , of other body:   
European Commission,  
EU-TBT Enquiry Point,  
Fax: + (32) 2 299 80 43,  
E-mail: grow-eu-tbt@ec.europa.eu  
The text is available on the EU -TBT Website : http://ec.europa.eu/growth/to ols-
databases/tbt/en/  
https://members.wto.org/crnattachments/2023/TBT/EEC/23_12824_00_e.pdf  
https://members.wto.org/crnattachments/2023/TBT/EEC/23_12824_01_e.pdf